From f908234911e59c3dc0b3d044db098d0bc1473664 Mon Sep 17 00:00:00 2001
From: Simon Hagger <simon.hagger@gmail.com>
Date: Thu, 12 Feb 2026 11:26:43 +0000
Subject: [PATCH 01/24] test(runtime): add Electron smoke guard for renderer
 diagnostics

---
 apps/desktop-main/src/main.ts   | 78 ++++++++++++++++++++++++++-
 package.json                    |  3 +-
 tools/scripts/runtime-smoke.mjs | 96 +++++++++++++++++++++++++++++++++
 3 files changed, 174 insertions(+), 3 deletions(-)
 create mode 100644 tools/scripts/runtime-smoke.mjs

diff --git a/apps/desktop-main/src/main.ts b/apps/desktop-main/src/main.ts
index 454af77..75b9d5e 100644
--- a/apps/desktop-main/src/main.ts
+++ b/apps/desktop-main/src/main.ts
@@ -34,10 +34,12 @@ import {
 } from '@electron-foundation/contracts';
 import { toStructuredLogLine } from '@electron-foundation/common';
 
-const isDevelopment = !app.isPackaged;
+const runtimeSmokeEnabled = process.env.RUNTIME_SMOKE === '1';
+const isDevelopment = !app.isPackaged && !runtimeSmokeEnabled;
 const rendererDevUrl = process.env.RENDERER_DEV_URL ?? 'http://localhost:4200';
 const fileTokenTtlMs = 5 * 60 * 1000;
 const fileTokenCleanupIntervalMs = 60 * 1000;
+const runtimeSmokeSettleMs = 4_000;
 const allowedDevHosts = new Set(['localhost', '127.0.0.1']);
 
 const resolveExistingPath = (
@@ -190,6 +192,73 @@ const clearFileTokensForWindow = (windowId: number) => {
   }
 };
 
+const enableRuntimeSmokeMode = (window: BrowserWindow) => {
+  const diagnostics: string[] = [];
+  const pushDiagnostic = (message: string) => {
+    diagnostics.push(message);
+  };
+
+  window.webContents.on('console-message', (details) => {
+    if (details.level === 'warning' || details.level === 'error') {
+      const label = details.level === 'warning' ? 'warn' : 'error';
+      pushDiagnostic(
+        `${label} ${details.sourceId}:${details.lineNumber} ${details.message}`,
+      );
+    }
+  });
+
+  window.webContents.on('render-process-gone', (_event, details) => {
+    pushDiagnostic(`render-process-gone: ${details.reason}`);
+  });
+
+  window.webContents.on('did-fail-load', (_event, code, description, url) => {
+    pushDiagnostic(`did-fail-load: ${code} ${description} ${url}`);
+  });
+
+  window.webContents.once('did-finish-load', () => {
+    setTimeout(async () => {
+      try {
+        await window.webContents.executeJavaScript(`
+          (() => {
+            const labels = ['Material', 'Carbon', 'Tailwind'];
+            let delay = 150;
+            for (const label of labels) {
+              setTimeout(() => {
+                const candidates = [...document.querySelectorAll('a,[role="link"],button')];
+                const target = candidates.find((el) =>
+                  (el.textContent || '').toLowerCase().includes(label.toLowerCase())
+                );
+                target?.click();
+              }, delay);
+              delay += 250;
+            }
+          })();
+        `);
+      } catch (error) {
+        pushDiagnostic(
+          `route-probe-failed: ${
+            error instanceof Error ? error.message : String(error)
+          }`,
+        );
+      }
+
+      setTimeout(() => {
+        if (diagnostics.length > 0) {
+          console.error('Runtime smoke failed due to renderer diagnostics.');
+          for (const message of diagnostics) {
+            console.error(`- ${message}`);
+          }
+          app.exit(1);
+          return;
+        }
+
+        console.info('Runtime smoke passed: no renderer warnings or errors.');
+        app.exit(0);
+      }, runtimeSmokeSettleMs);
+    }, 250);
+  });
+};
+
 const createMainWindow = async (): Promise<BrowserWindow> => {
   const window = new BrowserWindow({
     width: 1440,
@@ -210,6 +279,9 @@ const createMainWindow = async (): Promise<BrowserWindow> => {
   });
 
   hardenWebContents(window.webContents);
+  if (runtimeSmokeEnabled) {
+    enableRuntimeSmokeMode(window);
+  }
 
   window.on('closed', () => {
     clearFileTokensForWindow(window.id);
@@ -224,7 +296,9 @@ const createMainWindow = async (): Promise<BrowserWindow> => {
 
   if (isDevelopment) {
     await window.loadURL(resolveRendererDevUrl().toString());
-    window.webContents.openDevTools({ mode: 'detach' });
+    if (!runtimeSmokeEnabled) {
+      window.webContents.openDevTools({ mode: 'detach' });
+    }
   } else {
     await window.loadFile(resolveRendererIndexPath());
   }
diff --git a/package.json b/package.json
index d874601..6341b1a 100644
--- a/package.json
+++ b/package.json
@@ -31,6 +31,7 @@
     "perf:ipc": "node ./tools/scripts/perf-ipc.mjs",
     "perf:memory": "node ./tools/scripts/perf-memory.mjs",
     "perf:check": "node ./tools/scripts/perf-check.mjs",
+    "runtime:smoke": "cross-env NX_DAEMON=false TMPDIR=/tmp TMP=/tmp TEMP=/tmp pnpm nx run-many -t build --projects=renderer,desktop-preload,desktop-main && node tools/scripts/runtime-smoke.mjs",
     "security-checklist:gate": "node ./tools/scripts/security-checklist-gate.mjs",
     "forge:clean": "node ./tools/scripts/clean-forge-output.mjs",
     "forge:start": "pnpm run build-desktop && electron-forge start",
@@ -42,7 +43,7 @@
     "dependency-audit": "pnpm audit --prod",
     "license-compliance": "license-checker --summary",
     "commitlint": "commitlint --edit",
-    "ci:local": "pnpm nx format:check --all && pnpm lint && pnpm typecheck && pnpm unit-test && pnpm integration-test && pnpm e2e-smoke && pnpm a11y-e2e && pnpm i18n-check && pnpm build-renderer && pnpm build-desktop && pnpm dependency-audit --audit-level=high && pnpm license-compliance && pnpm perf:check"
+    "ci:local": "pnpm nx format:check --all && pnpm lint && pnpm typecheck && pnpm unit-test && pnpm integration-test && pnpm e2e-smoke && pnpm a11y-e2e && pnpm i18n-check && pnpm build-renderer && pnpm build-desktop && pnpm runtime:smoke && pnpm dependency-audit --audit-level=high && pnpm license-compliance && pnpm perf:check"
   },
   "private": true,
   "packageManager": "pnpm@10.14.0",
diff --git a/tools/scripts/runtime-smoke.mjs b/tools/scripts/runtime-smoke.mjs
new file mode 100644
index 0000000..17fd2cb
--- /dev/null
+++ b/tools/scripts/runtime-smoke.mjs
@@ -0,0 +1,96 @@
+import { existsSync } from 'node:fs';
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const workspaceRoot = path.resolve(__dirname, '..', '..');
+const desktopMainEntry = path.resolve(
+  workspaceRoot,
+  'dist/apps/desktop-main/main.js',
+);
+
+if (!existsSync(desktopMainEntry)) {
+  console.error('Runtime smoke failed: desktop main entry was not found.');
+  console.error(`Expected: ${desktopMainEntry}`);
+  process.exit(1);
+}
+
+const require = createRequire(import.meta.url);
+const electronBinary = require('electron');
+const timeoutMs = 25_000;
+const launchEnv = {
+  ...process.env,
+  NODE_ENV: 'production',
+  RUNTIME_SMOKE: '1',
+};
+delete launchEnv.ELECTRON_RUN_AS_NODE;
+
+const child = spawn(electronBinary, [desktopMainEntry], {
+  cwd: workspaceRoot,
+  env: launchEnv,
+  stdio: ['ignore', 'pipe', 'pipe'],
+});
+
+let stdout = '';
+let stderr = '';
+let settled = false;
+
+child.stdout.setEncoding('utf8');
+child.stderr.setEncoding('utf8');
+
+child.stdout.on('data', (chunk) => {
+  stdout += chunk;
+  process.stdout.write(chunk);
+});
+
+child.stderr.on('data', (chunk) => {
+  stderr += chunk;
+  process.stderr.write(chunk);
+});
+
+const timeout = setTimeout(() => {
+  if (settled) {
+    return;
+  }
+  settled = true;
+  child.kill('SIGTERM');
+  console.error(`Runtime smoke timed out after ${timeoutMs}ms.`);
+  process.exit(1);
+}, timeoutMs);
+
+child.on('error', (error) => {
+  if (settled) {
+    return;
+  }
+  settled = true;
+  clearTimeout(timeout);
+  console.error(`Runtime smoke failed to launch Electron: ${error.message}`);
+  process.exit(1);
+});
+
+child.on('close', (code) => {
+  if (settled) {
+    return;
+  }
+  settled = true;
+  clearTimeout(timeout);
+
+  if (code === 0) {
+    console.log('Runtime smoke passed.');
+    process.exit(0);
+  }
+
+  console.error(`Runtime smoke failed with exit code ${code ?? -1}.`);
+  if (stdout.trim().length > 0) {
+    console.error('Captured stdout:');
+    console.error(stdout.trim());
+  }
+  if (stderr.trim().length > 0) {
+    console.error('Captured stderr:');
+    console.error(stderr.trim());
+  }
+  process.exit(code ?? 1);
+});

From 83e037b5d0e29093c1261054ec00bdc6af14f916 Mon Sep 17 00:00:00 2001
From: Simon Hagger <simon.hagger@gmail.com>
Date: Thu, 12 Feb 2026 11:39:39 +0000
Subject: [PATCH 02/24] feat(contracts): add auth IPC contract schemas for OIDC
 phase 1

---
 libs/shared/contracts/src/index.ts            |  1 +
 .../shared/contracts/src/lib/auth.contract.ts | 52 +++++++++++++++++++
 .../contracts/src/lib/contracts.spec.ts       | 40 ++++++++++++++
 3 files changed, 93 insertions(+)
 create mode 100644 libs/shared/contracts/src/lib/auth.contract.ts

diff --git a/libs/shared/contracts/src/index.ts b/libs/shared/contracts/src/index.ts
index 90d6727..21439b1 100644
--- a/libs/shared/contracts/src/index.ts
+++ b/libs/shared/contracts/src/index.ts
@@ -5,6 +5,7 @@ export * from './lib/error-envelope';
 
 export * from './lib/app.contract';
 export * from './lib/api.contract';
+export * from './lib/auth.contract';
 export * from './lib/dialog.contract';
 export * from './lib/fs.contract';
 export * from './lib/storage.contract';
diff --git a/libs/shared/contracts/src/lib/auth.contract.ts b/libs/shared/contracts/src/lib/auth.contract.ts
new file mode 100644
index 0000000..f524353
--- /dev/null
+++ b/libs/shared/contracts/src/lib/auth.contract.ts
@@ -0,0 +1,52 @@
+import { z } from 'zod';
+import { emptyPayloadSchema, requestEnvelope } from './request-envelope';
+
+export const authSessionStateSchema = z.enum([
+  'signed-out',
+  'signing-in',
+  'active',
+  'refresh-failed',
+]);
+
+export const authSessionSummarySchema = z
+  .object({
+    state: authSessionStateSchema,
+    userId: z.string().min(1).optional(),
+    email: z.string().email().optional(),
+    name: z.string().min(1).optional(),
+    expiresAt: z.string().datetime().optional(),
+    scopes: z.array(z.string().min(1)).default([]),
+    entitlements: z.array(z.string().min(1)).default([]),
+  })
+  .strict();
+
+export const authSignInRequestSchema = requestEnvelope(emptyPayloadSchema);
+export const authSignInResponseSchema = z
+  .object({
+    initiated: z.boolean(),
+  })
+  .strict();
+
+export const authSignOutRequestSchema = requestEnvelope(emptyPayloadSchema);
+export const authSignOutResponseSchema = z
+  .object({
+    signedOut: z.boolean(),
+  })
+  .strict();
+
+export const authGetSessionSummaryRequestSchema =
+  requestEnvelope(emptyPayloadSchema);
+export const authGetSessionSummaryResponseSchema = authSessionSummarySchema;
+
+export type AuthSessionState = z.infer<typeof authSessionStateSchema>;
+export type AuthSessionSummary = z.infer<typeof authSessionSummarySchema>;
+export type AuthSignInRequest = z.infer<typeof authSignInRequestSchema>;
+export type AuthSignInResponse = z.infer<typeof authSignInResponseSchema>;
+export type AuthSignOutRequest = z.infer<typeof authSignOutRequestSchema>;
+export type AuthSignOutResponse = z.infer<typeof authSignOutResponseSchema>;
+export type AuthGetSessionSummaryRequest = z.infer<
+  typeof authGetSessionSummaryRequestSchema
+>;
+export type AuthGetSessionSummaryResponse = z.infer<
+  typeof authGetSessionSummaryResponseSchema
+>;
diff --git a/libs/shared/contracts/src/lib/contracts.spec.ts b/libs/shared/contracts/src/lib/contracts.spec.ts
index 43ef3d3..35f1bf6 100644
--- a/libs/shared/contracts/src/lib/contracts.spec.ts
+++ b/libs/shared/contracts/src/lib/contracts.spec.ts
@@ -1,6 +1,10 @@
 import { z } from 'zod';
 import { parseOrFailure } from './contracts';
 import { apiInvokeRequestSchema } from './api.contract';
+import {
+  authGetSessionSummaryResponseSchema,
+  authSignInRequestSchema,
+} from './auth.contract';
 import { readTextFileRequestSchema } from './fs.contract';
 import { storageSetRequestSchema } from './storage.contract';
 
@@ -134,3 +138,39 @@ describe('storageSetRequestSchema', () => {
     expect(parsed.success).toBe(false);
   });
 });
+
+describe('auth contracts', () => {
+  it('accepts sign-in requests with empty payload', () => {
+    const parsed = authSignInRequestSchema.safeParse({
+      contractVersion: '1.0.0',
+      correlationId: 'corr-auth-1',
+      payload: {},
+    });
+
+    expect(parsed.success).toBe(true);
+  });
+
+  it('accepts active session summary payloads', () => {
+    const parsed = authGetSessionSummaryResponseSchema.safeParse({
+      state: 'active',
+      userId: 'user-1',
+      email: 'user@example.com',
+      name: 'Example User',
+      expiresAt: '2026-02-12T20:00:00.000Z',
+      scopes: ['openid', 'profile'],
+      entitlements: ['storage.read'],
+    });
+
+    expect(parsed.success).toBe(true);
+  });
+
+  it('rejects malformed session summary payloads', () => {
+    const parsed = authGetSessionSummaryResponseSchema.safeParse({
+      state: 'active',
+      email: 'not-an-email',
+      scopes: [123],
+    });
+
+    expect(parsed.success).toBe(false);
+  });
+});

From 83ac001eb62b5455b53893fdbc9c7f57b9eba658 Mon Sep 17 00:00:00 2001
From: Simon Hagger <simon.hagger@gmail.com>
Date: Thu, 12 Feb 2026 11:42:45 +0000
Subject: [PATCH 03/24] feat(desktop): add auth IPC channels and preload/main
 stubs

---
 apps/desktop-main/src/main.ts                 | 82 +++++++++++++++++++
 apps/desktop-preload/src/main.ts              | 53 ++++++++++++
 .../desktop-api/src/lib/desktop-api.ts        |  8 ++
 libs/shared/contracts/src/lib/channels.ts     |  3 +
 4 files changed, 146 insertions(+)

diff --git a/apps/desktop-main/src/main.ts b/apps/desktop-main/src/main.ts
index 75b9d5e..dcf302a 100644
--- a/apps/desktop-main/src/main.ts
+++ b/apps/desktop-main/src/main.ts
@@ -17,6 +17,9 @@ import { invokeApiOperation } from './api-gateway';
 import { StorageGateway } from './storage-gateway';
 import {
   apiInvokeRequestSchema,
+  authGetSessionSummaryRequestSchema,
+  authSignInRequestSchema,
+  authSignOutRequestSchema,
   appVersionRequestSchema,
   asFailure,
   asSuccess,
@@ -406,6 +409,85 @@ const registerIpcHandlers = () => {
     return asSuccess({ version: app.getVersion() });
   });
 
+  ipcMain.handle(IPC_CHANNELS.authSignIn, (event, payload) => {
+    const correlationId = getCorrelationId(payload);
+    const unauthorized = assertAuthorizedSender(event, correlationId);
+    if (unauthorized) {
+      return unauthorized;
+    }
+
+    const parsed = authSignInRequestSchema.safeParse(payload);
+    if (!parsed.success) {
+      return asFailure(
+        'IPC/VALIDATION_FAILED',
+        'IPC payload failed validation.',
+        parsed.error.flatten(),
+        false,
+        correlationId,
+      );
+    }
+
+    return asFailure(
+      'AUTH/NOT_IMPLEMENTED',
+      'Auth sign-in flow is not implemented yet.',
+      { operation: 'auth.signIn' },
+      false,
+      parsed.data.correlationId,
+    );
+  });
+
+  ipcMain.handle(IPC_CHANNELS.authSignOut, (event, payload) => {
+    const correlationId = getCorrelationId(payload);
+    const unauthorized = assertAuthorizedSender(event, correlationId);
+    if (unauthorized) {
+      return unauthorized;
+    }
+
+    const parsed = authSignOutRequestSchema.safeParse(payload);
+    if (!parsed.success) {
+      return asFailure(
+        'IPC/VALIDATION_FAILED',
+        'IPC payload failed validation.',
+        parsed.error.flatten(),
+        false,
+        correlationId,
+      );
+    }
+
+    return asFailure(
+      'AUTH/NOT_IMPLEMENTED',
+      'Auth sign-out flow is not implemented yet.',
+      { operation: 'auth.signOut' },
+      false,
+      parsed.data.correlationId,
+    );
+  });
+
+  ipcMain.handle(IPC_CHANNELS.authGetSessionSummary, (event, payload) => {
+    const correlationId = getCorrelationId(payload);
+    const unauthorized = assertAuthorizedSender(event, correlationId);
+    if (unauthorized) {
+      return unauthorized;
+    }
+
+    const parsed = authGetSessionSummaryRequestSchema.safeParse(payload);
+    if (!parsed.success) {
+      return asFailure(
+        'IPC/VALIDATION_FAILED',
+        'IPC payload failed validation.',
+        parsed.error.flatten(),
+        false,
+        correlationId,
+      );
+    }
+
+    return asSuccess({
+      state: 'signed-out' as const,
+      scopes: [],
+      entitlements: [],
+    });
+  });
+
   ipcMain.handle(IPC_CHANNELS.dialogOpenFile, async (event, payload) => {
     const correlationId = getCorrelationId(payload);
     const unauthorized = assertAuthorizedSender(event, correlationId);
diff --git a/apps/desktop-preload/src/main.ts b/apps/desktop-preload/src/main.ts
index ed06574..1da9df6 100644
--- a/apps/desktop-preload/src/main.ts
+++ b/apps/desktop-preload/src/main.ts
@@ -5,6 +5,12 @@ import { toStructuredLogLine } from '@electron-foundation/common';
 import {
   apiInvokeRequestSchema,
   apiInvokeResponseSchema,
+  authGetSessionSummaryRequestSchema,
+  authGetSessionSummaryResponseSchema,
+  authSignInRequestSchema,
+  authSignInResponseSchema,
+  authSignOutRequestSchema,
+  authSignOutResponseSchema,
   appVersionRequestSchema,
   appVersionResponseSchema,
   asFailure,
@@ -193,6 +199,53 @@ const desktopApi: DesktopApi = {
       return mapResult(result, (value) => value.version);
     },
   },
+  auth: {
+    async signIn() {
+      const correlationId = createCorrelationId();
+      const request = authSignInRequestSchema.parse({
+        contractVersion: CONTRACT_VERSION,
+        correlationId,
+        payload: {},
+      });
+
+      return invoke(
+        IPC_CHANNELS.authSignIn,
+        request,
+        correlationId,
+        authSignInResponseSchema,
+      );
+    },
+    async signOut() {
+      const correlationId = createCorrelationId();
+      const request = authSignOutRequestSchema.parse({
+        contractVersion: CONTRACT_VERSION,
+        correlationId,
+        payload: {},
+      });
+
+      return invoke(
+        IPC_CHANNELS.authSignOut,
+        request,
+        correlationId,
+        authSignOutResponseSchema,
+      );
+    },
+    async getSessionSummary() {
+      const correlationId = createCorrelationId();
+      const request = authGetSessionSummaryRequestSchema.parse({
+        contractVersion: CONTRACT_VERSION,
+        correlationId,
+        payload: {},
+      });
+
+      return invoke(
+        IPC_CHANNELS.authGetSessionSummary,
+        request,
+        correlationId,
+        authGetSessionSummaryResponseSchema,
+      );
+    },
+  },
   dialog: {
     async openFile(request = {}) {
       const correlationId = createCorrelationId();
diff --git a/libs/platform/desktop-api/src/lib/desktop-api.ts b/libs/platform/desktop-api/src/lib/desktop-api.ts
index 9d1c3f2..ad7391f 100644
--- a/libs/platform/desktop-api/src/lib/desktop-api.ts
+++ b/libs/platform/desktop-api/src/lib/desktop-api.ts
@@ -1,5 +1,6 @@
 import type {
   ApiOperationId,
+  AuthSessionSummary,
   ContractVersion,
   DesktopResult,
 } from '@electron-foundation/contracts';
@@ -18,6 +19,12 @@ export interface DesktopDialogApi {
   >;
 }
 
+export interface DesktopAuthApi {
+  signIn: () => Promise<DesktopResult<{ initiated: boolean }>>;
+  signOut: () => Promise<DesktopResult<{ signedOut: boolean }>>;
+  getSessionSummary: () => Promise<DesktopResult<AuthSessionSummary>>;
+}
+
 export interface DesktopFsApi {
   readTextFile: (fileToken: string) => Promise<DesktopResult<string>>;
 }
@@ -74,6 +81,7 @@ export interface DesktopTelemetryApi {
 
 export interface DesktopApi {
   app: DesktopAppApi;
+  auth: DesktopAuthApi;
   dialog: DesktopDialogApi;
   fs: DesktopFsApi;
   storage: DesktopStorageApi;
diff --git a/libs/shared/contracts/src/lib/channels.ts b/libs/shared/contracts/src/lib/channels.ts
index f5fdc67..e41044b 100644
--- a/libs/shared/contracts/src/lib/channels.ts
+++ b/libs/shared/contracts/src/lib/channels.ts
@@ -1,6 +1,9 @@
 export const IPC_CHANNELS = {
   handshake: 'contract:handshake',
   appGetVersion: 'app:get-version',
+  authSignIn: 'auth:sign-in',
+  authSignOut: 'auth:sign-out',
+  authGetSessionSummary: 'auth:get-session-summary',
   dialogOpenFile: 'dialog:open-file',
   fsReadTextFile: 'fs:read-text-file',
   storageSetItem: 'storage:set-item',

From 9d71e0d52eb3150bce648eeb51b8c56cb7441920 Mon Sep 17 00:00:00 2001
From: Simon Hagger <simon.hagger@gmail.com>
Date: Thu, 12 Feb 2026 11:49:14 +0000
Subject: [PATCH 04/24] feat(auth): implement OIDC PKCE flow with secure token
 storage

---
 apps/desktop-main/src/main.ts                 |  79 ++-
 apps/desktop-main/src/oidc-config.spec.ts     |  46 ++
 apps/desktop-main/src/oidc-config.ts          |  48 ++
 apps/desktop-main/src/oidc-service.ts         | 642 ++++++++++++++++++
 apps/desktop-main/src/secure-token-store.ts   | 133 ++++
 apps/renderer/src/app/app.html                |   8 +
 apps/renderer/src/app/app.routes.ts           |   7 +
 .../auth-session-lab-page.css                 |  47 ++
 .../auth-session-lab-page.html                |  93 +++
 .../auth-session-lab/auth-session-lab-page.ts | 113 +++
 package.json                                  |   4 +-
 pnpm-lock.yaml                                | 116 ++++
 12 files changed, 1316 insertions(+), 20 deletions(-)
 create mode 100644 apps/desktop-main/src/oidc-config.spec.ts
 create mode 100644 apps/desktop-main/src/oidc-config.ts
 create mode 100644 apps/desktop-main/src/oidc-service.ts
 create mode 100644 apps/desktop-main/src/secure-token-store.ts
 create mode 100644 apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.css
 create mode 100644 apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.html
 create mode 100644 apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.ts

diff --git a/apps/desktop-main/src/main.ts b/apps/desktop-main/src/main.ts
index dcf302a..223a316 100644
--- a/apps/desktop-main/src/main.ts
+++ b/apps/desktop-main/src/main.ts
@@ -5,6 +5,7 @@ import {
   ipcMain,
   safeStorage,
   session,
+  shell,
   type IpcMainInvokeEvent,
   type WebContents,
 } from 'electron';
@@ -14,6 +15,9 @@ import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import { autoUpdater } from 'electron-updater';
 import { invokeApiOperation } from './api-gateway';
+import { loadOidcConfig } from './oidc-config';
+import { OidcService } from './oidc-service';
+import { createRefreshTokenStore } from './secure-token-store';
 import { StorageGateway } from './storage-gateway';
 import {
   apiInvokeRequestSchema,
@@ -93,6 +97,7 @@ type FileSelectionToken = {
 const selectedFileTokens = new Map<string, FileSelectionToken>();
 let tokenCleanupTimer: NodeJS.Timeout | null = null;
 let storageGateway: StorageGateway | null = null;
+let oidcService: OidcService | null = null;
 let mainWindow: BrowserWindow | null = null;
 const APP_VERSION = app.getVersion();
 
@@ -427,13 +432,17 @@ const registerIpcHandlers = () => {
       );
     }
 
-    return asFailure(
-      'AUTH/NOT_IMPLEMENTED',
-      'Auth sign-in flow is not implemented yet.',
-      { operation: 'auth.signIn' },
-      false,
-      parsed.data.correlationId,
-    );
+    if (!oidcService) {
+      return asFailure(
+        'AUTH/NOT_CONFIGURED',
+        'OIDC authentication is not configured for this build.',
+        undefined,
+        false,
+        parsed.data.correlationId,
+      );
+    }
+
+    return oidcService.signIn();
   });
 
   ipcMain.handle(IPC_CHANNELS.authSignOut, (event, payload) => {
@@ -454,13 +463,11 @@ const registerIpcHandlers = () => {
       );
     }
 
-    return asFailure(
-      'AUTH/NOT_IMPLEMENTED',
-      'Auth sign-out flow is not implemented yet.',
-      { operation: 'auth.signOut' },
-      false,
-      parsed.data.correlationId,
-    );
+    if (!oidcService) {
+      return asSuccess({ signedOut: true });
+    }
+
+    return oidcService.signOut();
   });
 
   ipcMain.handle(IPC_CHANNELS.authGetSessionSummary, (event, payload) => {
@@ -481,11 +488,15 @@ const registerIpcHandlers = () => {
       );
     }
 
-    return asSuccess({
-      state: 'signed-out' as const,
-      scopes: [],
-      entitlements: [],
-    });
+    if (!oidcService) {
+      return asSuccess({
+        state: 'signed-out' as const,
+        scopes: [],
+        entitlements: [],
+      });
+    }
+
+    return oidcService.getSessionSummary();
   });
 
   ipcMain.handle(IPC_CHANNELS.dialogOpenFile, async (event, payload) => {
@@ -813,6 +824,35 @@ const bootstrap = async () => {
       ? (cipherText) => safeStorage.decryptString(cipherText)
       : undefined,
   });
+  const oidcConfig = loadOidcConfig();
+  if (oidcConfig) {
+    const refreshTokenStore = await createRefreshTokenStore({
+      userDataPath: app.getPath('userData'),
+      encryptString: safeStorage.isEncryptionAvailable()
+        ? (plainText) => safeStorage.encryptString(plainText)
+        : undefined,
+      decryptString: safeStorage.isEncryptionAvailable()
+        ? (cipherText) => safeStorage.decryptString(cipherText)
+        : undefined,
+      allowInsecurePlaintext:
+        process.env.OIDC_ALLOW_INSECURE_TOKEN_STORAGE === '1',
+      logger: (level, message) => {
+        logEvent(level, 'auth.token_store', undefined, { message });
+      },
+    });
+
+    oidcService = new OidcService({
+      config: oidcConfig,
+      tokenStore: refreshTokenStore,
+      openExternal: (url) => shell.openExternal(url).then(() => undefined),
+      logger: (level, event, details) => {
+        logEvent(level, event, undefined, details);
+      },
+    });
+  } else {
+    logEvent('info', 'auth.not_configured');
+  }
+
   registerIpcHandlers();
   mainWindow = await createMainWindow();
   logEvent('info', 'app.bootstrapped');
@@ -827,6 +867,7 @@ const bootstrap = async () => {
 app.on('window-all-closed', () => {
   selectedFileTokens.clear();
   stopFileTokenCleanup();
+  oidcService?.dispose();
   storageGateway?.close();
   if (process.platform !== 'darwin') {
     app.quit();
diff --git a/apps/desktop-main/src/oidc-config.spec.ts b/apps/desktop-main/src/oidc-config.spec.ts
new file mode 100644
index 0000000..fab9a82
--- /dev/null
+++ b/apps/desktop-main/src/oidc-config.spec.ts
@@ -0,0 +1,46 @@
+import { describe, expect, it } from 'vitest';
+import { loadOidcConfig } from './oidc-config';
+
+describe('loadOidcConfig', () => {
+  it('returns null when OIDC env vars are not provided', () => {
+    const config = loadOidcConfig({});
+    expect(config).toBeNull();
+  });
+
+  it('loads valid OIDC config values', () => {
+    const config = loadOidcConfig({
+      OIDC_ISSUER: 'https://issuer.example.com/',
+      OIDC_CLIENT_ID: 'desktop-client',
+      OIDC_REDIRECT_URI: 'http://127.0.0.1:42813/callback',
+      OIDC_SCOPES: 'openid profile email',
+      OIDC_AUDIENCE: 'api://desktop',
+    });
+
+    expect(config).toEqual({
+      issuer: 'https://issuer.example.com',
+      clientId: 'desktop-client',
+      redirectUri: 'http://127.0.0.1:42813/callback',
+      scopes: ['openid', 'profile', 'email'],
+      audience: 'api://desktop',
+    });
+  });
+
+  it('throws when required fields are missing', () => {
+    expect(() =>
+      loadOidcConfig({
+        OIDC_ISSUER: 'https://issuer.example.com',
+      }),
+    ).toThrow(/OIDC configuration is incomplete/i);
+  });
+
+  it('throws when openid scope is missing', () => {
+    expect(() =>
+      loadOidcConfig({
+        OIDC_ISSUER: 'https://issuer.example.com',
+        OIDC_CLIENT_ID: 'desktop-client',
+        OIDC_REDIRECT_URI: 'http://127.0.0.1:42813/callback',
+        OIDC_SCOPES: 'profile email',
+      }),
+    ).toThrow(/must include "openid"/i);
+  });
+});
diff --git a/apps/desktop-main/src/oidc-config.ts b/apps/desktop-main/src/oidc-config.ts
new file mode 100644
index 0000000..70e6450
--- /dev/null
+++ b/apps/desktop-main/src/oidc-config.ts
@@ -0,0 +1,48 @@
+export type OidcConfig = {
+  issuer: string;
+  clientId: string;
+  redirectUri: string;
+  scopes: string[];
+  audience?: string;
+};
+
+const splitScopes = (value: string): string[] =>
+  value
+    .split(/[,\s]+/)
+    .map((scope) => scope.trim())
+    .filter((scope) => scope.length > 0);
+
+export const loadOidcConfig = (
+  env: NodeJS.ProcessEnv = process.env,
+): OidcConfig | null => {
+  const issuer = env.OIDC_ISSUER?.trim();
+  const clientId = env.OIDC_CLIENT_ID?.trim();
+  const redirectUri = env.OIDC_REDIRECT_URI?.trim();
+  const scopeValue = env.OIDC_SCOPES?.trim();
+  const audience = env.OIDC_AUDIENCE?.trim();
+
+  if (!issuer && !clientId && !redirectUri && !scopeValue) {
+    return null;
+  }
+
+  if (!issuer || !clientId || !redirectUri) {
+    throw new Error(
+      'OIDC configuration is incomplete. Required: OIDC_ISSUER, OIDC_CLIENT_ID, OIDC_REDIRECT_URI.',
+    );
+  }
+
+  const scopes = splitScopes(scopeValue ?? 'openid profile email');
+  if (!scopes.includes('openid')) {
+    throw new Error('OIDC_SCOPES must include "openid".');
+  }
+
+  const normalizedIssuer = issuer.endsWith('/') ? issuer.slice(0, -1) : issuer;
+
+  return {
+    issuer: normalizedIssuer,
+    clientId,
+    redirectUri,
+    scopes,
+    audience: audience && audience.length > 0 ? audience : undefined,
+  };
+};
diff --git a/apps/desktop-main/src/oidc-service.ts b/apps/desktop-main/src/oidc-service.ts
new file mode 100644
index 0000000..46ac823
--- /dev/null
+++ b/apps/desktop-main/src/oidc-service.ts
@@ -0,0 +1,642 @@
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import http from 'node:http';
+import { URL } from 'node:url';
+import {
+  asFailure,
+  asSuccess,
+  type AuthSessionSummary,
+  type DesktopResult,
+} from '@electron-foundation/contracts';
+import type { OidcConfig } from './oidc-config';
+import type { RefreshTokenStore } from './secure-token-store';
+
+type DiscoveryDocument = {
+  authorization_endpoint: string;
+  token_endpoint: string;
+  revocation_endpoint?: string;
+};
+
+type TokenResponse = {
+  access_token: string;
+  token_type: string;
+  expires_in?: number;
+  refresh_token?: string;
+  id_token?: string;
+  scope?: string;
+};
+
+type OidcServiceOptions = {
+  config: OidcConfig;
+  tokenStore: RefreshTokenStore;
+  openExternal: (url: string) => Promise<void>;
+  fetchFn?: typeof fetch;
+  logger?: (
+    level: 'info' | 'warn' | 'error',
+    event: string,
+    details?: Record<string, unknown>,
+  ) => void;
+};
+
+type ActiveTokens = {
+  accessToken: string;
+  accessTokenExpiresAt: number;
+  refreshToken?: string;
+  idToken?: string;
+};
+
+const authTimeoutMs = 180_000;
+const refreshLeadTimeMs = 60_000;
+
+const toBase64Url = (value: Buffer): string =>
+  value
+    .toString('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/g, '');
+
+const createPkcePair = () => {
+  const verifier = toBase64Url(randomBytes(64));
+  const challenge = toBase64Url(createHash('sha256').update(verifier).digest());
+
+  return { verifier, challenge };
+};
+
+const decodeJwtPayload = (
+  token: string | undefined,
+): Record<string, unknown> | null => {
+  if (!token) {
+    return null;
+  }
+
+  const parts = token.split('.');
+  if (parts.length < 2) {
+    return null;
+  }
+
+  try {
+    const base64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64 + '='.repeat((4 - (base64.length % 4 || 4)) % 4);
+    const json = Buffer.from(padded, 'base64').toString('utf8');
+    const payload = JSON.parse(json) as Record<string, unknown>;
+    return payload;
+  } catch {
+    return null;
+  }
+};
+
+const parseScopeList = (scopeValue: string | undefined): string[] =>
+  (scopeValue ?? '')
+    .split(/\s+/)
+    .map((item) => item.trim())
+    .filter((item) => item.length > 0);
+
+const buildSignedOutSummary = (): AuthSessionSummary => ({
+  state: 'signed-out',
+  scopes: [],
+  entitlements: [],
+});
+
+const isLoopbackRedirect = (redirectUri: string) => {
+  const parsed = new URL(redirectUri);
+  const host = parsed.hostname.toLowerCase();
+  return (
+    parsed.protocol === 'http:' &&
+    (host === '127.0.0.1' || host === 'localhost')
+  );
+};
+
+const withResolvedRedirectPort = (redirectUri: string) => {
+  if (redirectUri.includes('{port}')) {
+    return redirectUri.replace('{port}', '0');
+  }
+
+  if (redirectUri.includes('__PORT__')) {
+    return redirectUri.replace('__PORT__', '0');
+  }
+
+  return redirectUri;
+};
+
+const renderCallbackPage = (ok: boolean, message: string): string => `
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>Authentication</title>
+    <style>
+      body { font-family: sans-serif; margin: 2rem; }
+      .ok { color: #0f62fe; }
+      .err { color: #a2191f; }
+    </style>
+  </head>
+  <body>
+    <h1 class="${ok ? 'ok' : 'err'}">${ok ? 'Sign-in complete' : 'Sign-in failed'}</h1>
+    <p>${message}</p>
+    <p>You can close this window and return to the app.</p>
+  </body>
+</html>`;
+
+export class OidcService {
+  private readonly config: OidcConfig;
+  private readonly tokenStore: RefreshTokenStore;
+  private readonly openExternal: (url: string) => Promise<void>;
+  private readonly fetchFn: typeof fetch;
+  private readonly logger?: OidcServiceOptions['logger'];
+  private discoveryCache: DiscoveryDocument | null = null;
+  private summary: AuthSessionSummary = buildSignedOutSummary();
+  private tokens: ActiveTokens | null = null;
+  private refreshTimer: NodeJS.Timeout | null = null;
+  private signInInFlight = false;
+
+  constructor(options: OidcServiceOptions) {
+    this.config = options.config;
+    this.tokenStore = options.tokenStore;
+    this.openExternal = options.openExternal;
+    this.fetchFn = options.fetchFn ?? fetch;
+    this.logger = options.logger;
+  }
+
+  dispose() {
+    this.clearRefreshTimer();
+  }
+
+  async signIn(): Promise<DesktopResult<{ initiated: boolean }>> {
+    if (this.signInInFlight) {
+      return asFailure(
+        'AUTH/SIGNIN_IN_PROGRESS',
+        'A sign-in flow is already in progress.',
+        undefined,
+        false,
+      );
+    }
+
+    this.signInInFlight = true;
+    this.summary = {
+      state: 'signing-in',
+      scopes: this.summary.scopes ?? [],
+      entitlements: this.summary.entitlements ?? [],
+    };
+
+    try {
+      if (!isLoopbackRedirect(this.config.redirectUri)) {
+        return asFailure(
+          'AUTH/UNSUPPORTED_REDIRECT_URI',
+          'Only loopback redirect URIs are currently supported.',
+          { redirectUri: this.config.redirectUri },
+          false,
+        );
+      }
+
+      const discovery = await this.getDiscovery();
+      const { verifier, challenge } = createPkcePair();
+      const state = randomUUID();
+      const nonce = randomUUID();
+      const callbackResult = await this.waitForAuthorizationCode(
+        this.config.redirectUri,
+        state,
+      );
+
+      const redirectUriForRequest = callbackResult.redirectUri;
+      const authorizationUrl = new URL(discovery.authorization_endpoint);
+      authorizationUrl.searchParams.set('response_type', 'code');
+      authorizationUrl.searchParams.set('client_id', this.config.clientId);
+      authorizationUrl.searchParams.set('redirect_uri', redirectUriForRequest);
+      authorizationUrl.searchParams.set('scope', this.config.scopes.join(' '));
+      authorizationUrl.searchParams.set('state', state);
+      authorizationUrl.searchParams.set('nonce', nonce);
+      authorizationUrl.searchParams.set('code_challenge', challenge);
+      authorizationUrl.searchParams.set('code_challenge_method', 'S256');
+      if (this.config.audience) {
+        authorizationUrl.searchParams.set('audience', this.config.audience);
+      }
+
+      await this.openExternal(authorizationUrl.toString());
+      const code = await callbackResult.waitForCode();
+
+      const tokenResult = await this.exchangeCodeForTokens({
+        code,
+        codeVerifier: verifier,
+        redirectUri: redirectUriForRequest,
+      });
+      if (!tokenResult.ok) {
+        const failure = tokenResult as Extract<
+          typeof tokenResult,
+          { ok: false }
+        >;
+        this.summary = {
+          state: 'signed-out',
+          scopes: [],
+          entitlements: [],
+        };
+        return asFailure(
+          failure.error.code,
+          failure.error.message,
+          failure.error.details,
+          failure.error.retryable,
+          failure.error.correlationId,
+        );
+      }
+
+      this.applyTokenResponse(tokenResult.data);
+      this.logger?.('info', 'auth.signin.success', {
+        tokenStore: this.tokenStore.kind,
+      });
+      return asSuccess({ initiated: true });
+    } catch (error) {
+      this.summary = buildSignedOutSummary();
+      this.logger?.('error', 'auth.signin.failed', {
+        message: error instanceof Error ? error.message : String(error),
+      });
+      return asFailure(
+        'AUTH/SIGNIN_FAILED',
+        'Authentication sign-in failed.',
+        error instanceof Error
+          ? { name: error.name, message: error.message }
+          : String(error),
+        true,
+      );
+    } finally {
+      this.signInInFlight = false;
+    }
+  }
+
+  async signOut(): Promise<DesktopResult<{ signedOut: boolean }>> {
+    this.clearRefreshTimer();
+    this.tokens = null;
+    this.summary = buildSignedOutSummary();
+
+    try {
+      await this.tokenStore.clear();
+      return asSuccess({ signedOut: true });
+    } catch (error) {
+      return asFailure(
+        'AUTH/SIGNOUT_FAILED',
+        'Failed to clear authentication state.',
+        error instanceof Error
+          ? { name: error.name, message: error.message }
+          : String(error),
+        false,
+      );
+    }
+  }
+
+  async getSessionSummary(): Promise<DesktopResult<AuthSessionSummary>> {
+    if (this.tokens && Date.now() >= this.tokens.accessTokenExpiresAt) {
+      const refreshed = await this.refreshAccessToken();
+      if (!refreshed.ok) {
+        return refreshed;
+      }
+    }
+
+    if (!this.tokens) {
+      return asSuccess(this.summary);
+    }
+
+    return asSuccess(this.summary);
+  }
+
+  getAccessToken(): string | null {
+    if (!this.tokens) {
+      return null;
+    }
+
+    if (Date.now() >= this.tokens.accessTokenExpiresAt) {
+      return null;
+    }
+
+    return this.tokens.accessToken;
+  }
+
+  private clearRefreshTimer() {
+    if (!this.refreshTimer) {
+      return;
+    }
+    clearTimeout(this.refreshTimer);
+    this.refreshTimer = null;
+  }
+
+  private scheduleRefresh() {
+    this.clearRefreshTimer();
+    if (!this.tokens?.refreshToken) {
+      return;
+    }
+
+    const msUntilRefresh = Math.max(
+      5_000,
+      this.tokens.accessTokenExpiresAt - Date.now() - refreshLeadTimeMs,
+    );
+
+    this.refreshTimer = setTimeout(() => {
+      void this.refreshAccessToken();
+    }, msUntilRefresh);
+  }
+
+  private async getDiscovery(): Promise<DiscoveryDocument> {
+    if (this.discoveryCache) {
+      return this.discoveryCache;
+    }
+
+    const response = await this.fetchFn(
+      `${this.config.issuer}/.well-known/openid-configuration`,
+      {
+        method: 'GET',
+      },
+    );
+
+    if (!response.ok) {
+      throw new Error(`OIDC discovery failed (${response.status}).`);
+    }
+
+    const payload = (await response.json()) as Partial<DiscoveryDocument>;
+    if (!payload.authorization_endpoint || !payload.token_endpoint) {
+      throw new Error('OIDC discovery payload is missing required endpoints.');
+    }
+
+    this.discoveryCache = {
+      authorization_endpoint: payload.authorization_endpoint,
+      token_endpoint: payload.token_endpoint,
+      revocation_endpoint: payload.revocation_endpoint,
+    };
+    return this.discoveryCache;
+  }
+
+  private async exchangeCodeForTokens(input: {
+    code: string;
+    codeVerifier: string;
+    redirectUri: string;
+  }): Promise<DesktopResult<TokenResponse>> {
+    const discovery = await this.getDiscovery();
+    const body = new URLSearchParams();
+    body.set('grant_type', 'authorization_code');
+    body.set('client_id', this.config.clientId);
+    body.set('code', input.code);
+    body.set('redirect_uri', input.redirectUri);
+    body.set('code_verifier', input.codeVerifier);
+
+    if (this.config.audience) {
+      body.set('audience', this.config.audience);
+    }
+
+    const response = await this.fetchFn(discovery.token_endpoint, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/x-www-form-urlencoded',
+      },
+      body: body.toString(),
+    });
+
+    if (!response.ok) {
+      const detail = await response.text();
+      return asFailure(
+        'AUTH/TOKEN_EXCHANGE_FAILED',
+        'OIDC token exchange failed.',
+        { status: response.status, detail },
+        true,
+      );
+    }
+
+    const payload = (await response.json()) as Partial<TokenResponse>;
+    if (!payload.access_token || !payload.token_type) {
+      return asFailure(
+        'AUTH/TOKEN_PAYLOAD_INVALID',
+        'OIDC token response is missing required fields.',
+        payload,
+        false,
+      );
+    }
+
+    return asSuccess({
+      access_token: payload.access_token,
+      token_type: payload.token_type,
+      expires_in: payload.expires_in,
+      refresh_token: payload.refresh_token,
+      id_token: payload.id_token,
+      scope: payload.scope,
+    });
+  }
+
+  private async refreshAccessToken(): Promise<
+    DesktopResult<AuthSessionSummary>
+  > {
+    const discovery = await this.getDiscovery();
+    const refreshToken =
+      this.tokens?.refreshToken ?? (await this.tokenStore.get());
+
+    if (!refreshToken) {
+      this.summary = buildSignedOutSummary();
+      this.tokens = null;
+      return asSuccess(this.summary);
+    }
+
+    const body = new URLSearchParams();
+    body.set('grant_type', 'refresh_token');
+    body.set('client_id', this.config.clientId);
+    body.set('refresh_token', refreshToken);
+    if (this.config.audience) {
+      body.set('audience', this.config.audience);
+    }
+
+    const response = await this.fetchFn(discovery.token_endpoint, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/x-www-form-urlencoded',
+      },
+      body: body.toString(),
+    });
+
+    if (!response.ok) {
+      await this.signOut();
+      this.summary = {
+        state: 'refresh-failed',
+        scopes: [],
+        entitlements: [],
+      };
+      return asFailure(
+        'AUTH/REFRESH_FAILED',
+        'Session refresh failed. Please sign in again.',
+        { status: response.status },
+        false,
+      );
+    }
+
+    const payload = (await response.json()) as Partial<TokenResponse>;
+    if (!payload.access_token || !payload.token_type) {
+      await this.signOut();
+      return asFailure(
+        'AUTH/TOKEN_PAYLOAD_INVALID',
+        'Refresh response is missing required token fields.',
+        payload,
+        false,
+      );
+    }
+
+    this.applyTokenResponse({
+      access_token: payload.access_token,
+      token_type: payload.token_type,
+      expires_in: payload.expires_in,
+      refresh_token: payload.refresh_token ?? refreshToken,
+      id_token: payload.id_token ?? this.tokens?.idToken,
+      scope: payload.scope,
+    });
+
+    return asSuccess(this.summary);
+  }
+
+  private applyTokenResponse(tokenResponse: TokenResponse) {
+    const expiresInSeconds =
+      typeof tokenResponse.expires_in === 'number' &&
+      Number.isFinite(tokenResponse.expires_in)
+        ? Math.max(60, Math.floor(tokenResponse.expires_in))
+        : 300;
+    const expiresAt = Date.now() + expiresInSeconds * 1000;
+    const refreshToken = tokenResponse.refresh_token;
+    const idClaims = decodeJwtPayload(tokenResponse.id_token);
+    const scopes =
+      parseScopeList(tokenResponse.scope) ||
+      this.config.scopes.filter((scope) => scope.length > 0);
+    const entitlements =
+      Array.isArray(idClaims?.roles) &&
+      idClaims.roles.every((value) => typeof value === 'string')
+        ? (idClaims.roles as string[])
+        : [];
+
+    this.tokens = {
+      accessToken: tokenResponse.access_token,
+      accessTokenExpiresAt: expiresAt,
+      refreshToken,
+      idToken: tokenResponse.id_token,
+    };
+
+    this.summary = {
+      state: 'active',
+      userId:
+        typeof idClaims?.sub === 'string'
+          ? (idClaims.sub as string)
+          : undefined,
+      email:
+        typeof idClaims?.email === 'string'
+          ? (idClaims.email as string)
+          : undefined,
+      name:
+        typeof idClaims?.name === 'string'
+          ? (idClaims.name as string)
+          : undefined,
+      expiresAt: new Date(expiresAt).toISOString(),
+      scopes:
+        scopes.length > 0
+          ? scopes
+          : this.config.scopes.filter((scope) => scope.length > 0),
+      entitlements,
+    };
+
+    if (refreshToken) {
+      void this.tokenStore.set(refreshToken);
+    }
+
+    this.scheduleRefresh();
+  }
+
+  private async waitForAuthorizationCode(
+    redirectUriTemplate: string,
+    expectedState: string,
+  ): Promise<{ redirectUri: string; waitForCode: () => Promise<string> }> {
+    const redirectUri = withResolvedRedirectPort(redirectUriTemplate);
+    const parsed = new URL(redirectUri);
+
+    if (parsed.protocol !== 'http:') {
+      throw new Error('OIDC redirect URI must use loopback HTTP.');
+    }
+
+    const pathname = parsed.pathname;
+    const hostname = parsed.hostname;
+    const timeoutAt = Date.now() + authTimeoutMs;
+
+    let settle: ((value: string | PromiseLike<string>) => void) | null = null;
+    let rejectSettle: ((reason?: unknown) => void) | null = null;
+    const codePromise = new Promise<string>((resolve, reject) => {
+      settle = resolve;
+      rejectSettle = reject;
+    });
+
+    const server = http.createServer((req, res) => {
+      const requestUrl = new URL(req.url ?? '/', `http://${req.headers.host}`);
+      if (requestUrl.pathname !== pathname) {
+        res.statusCode = 404;
+        res.end('Not found');
+        return;
+      }
+
+      const state = requestUrl.searchParams.get('state');
+      const code = requestUrl.searchParams.get('code');
+      const error = requestUrl.searchParams.get('error');
+
+      if (state !== expectedState) {
+        res.statusCode = 400;
+        res.setHeader('Content-Type', 'text/html; charset=utf-8');
+        res.end(renderCallbackPage(false, 'State mismatch.'));
+        rejectSettle?.(new Error('OIDC callback state mismatch.'));
+        return;
+      }
+
+      if (error) {
+        res.statusCode = 400;
+        res.setHeader('Content-Type', 'text/html; charset=utf-8');
+        res.end(renderCallbackPage(false, `Authorization failed: ${error}`));
+        rejectSettle?.(
+          new Error(`OIDC provider returned an authorization error: ${error}`),
+        );
+        return;
+      }
+
+      if (!code) {
+        res.statusCode = 400;
+        res.setHeader('Content-Type', 'text/html; charset=utf-8');
+        res.end(renderCallbackPage(false, 'Missing authorization code.'));
+        rejectSettle?.(new Error('OIDC callback missing authorization code.'));
+        return;
+      }
+
+      res.statusCode = 200;
+      res.setHeader('Content-Type', 'text/html; charset=utf-8');
+      res.end(
+        renderCallbackPage(true, 'Authentication finished successfully.'),
+      );
+      settle?.(code);
+    });
+
+    await new Promise<void>((resolve, reject) => {
+      server.once('error', reject);
+      server.listen(Number(parsed.port || 0), hostname, () => resolve());
+    });
+
+    const address = server.address();
+    if (!address || typeof address === 'string') {
+      server.close();
+      throw new Error('OIDC callback server failed to bind.');
+    }
+
+    const effectiveRedirectUri = new URL(redirectUriTemplate);
+    effectiveRedirectUri.protocol = 'http:';
+    effectiveRedirectUri.hostname = hostname;
+    effectiveRedirectUri.port = String(address.port);
+
+    const timeoutHandle = setInterval(() => {
+      if (Date.now() >= timeoutAt) {
+        clearInterval(timeoutHandle);
+        rejectSettle?.(new Error('OIDC sign-in timed out.'));
+      }
+    }, 200);
+
+    return {
+      redirectUri: effectiveRedirectUri.toString(),
+      waitForCode: async () => {
+        try {
+          return await codePromise;
+        } finally {
+          clearInterval(timeoutHandle);
+          server.close();
+        }
+      },
+    };
+  }
+}
diff --git a/apps/desktop-main/src/secure-token-store.ts b/apps/desktop-main/src/secure-token-store.ts
new file mode 100644
index 0000000..161b277
--- /dev/null
+++ b/apps/desktop-main/src/secure-token-store.ts
@@ -0,0 +1,133 @@
+import { existsSync } from 'node:fs';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+
+export interface RefreshTokenStore {
+  get(): Promise<string | null>;
+  set(token: string): Promise<void>;
+  clear(): Promise<void>;
+  kind: 'keytar' | 'file-encrypted' | 'file-plain';
+}
+
+type FileStoreOptions = {
+  userDataPath: string;
+  encryptString?: (plainText: string) => Buffer;
+  decryptString?: (cipherText: Buffer) => string;
+  allowInsecurePlaintext?: boolean;
+  logger?: (level: 'warn' | 'info', message: string) => void;
+};
+
+const REFRESH_TOKEN_FILE_NAME = 'oidc-refresh-token.bin';
+const KEYTAR_SERVICE = 'Angulectron Desktop';
+const KEYTAR_ACCOUNT = 'oidc-refresh-token';
+
+const createFileStore = async (
+  options: FileStoreOptions,
+): Promise<RefreshTokenStore> => {
+  const directory = path.join(options.userDataPath, 'auth');
+  const filePath = path.join(directory, REFRESH_TOKEN_FILE_NAME);
+  await fs.mkdir(directory, { recursive: true });
+
+  const encrypted =
+    typeof options.encryptString === 'function' &&
+    typeof options.decryptString === 'function';
+  const allowPlain = options.allowInsecurePlaintext === true;
+
+  if (!encrypted && !allowPlain) {
+    throw new Error(
+      'No secure token storage is available. Enable platform encryption or set OIDC_ALLOW_INSECURE_TOKEN_STORAGE=1 for local development only.',
+    );
+  }
+
+  return {
+    kind: encrypted ? 'file-encrypted' : 'file-plain',
+    async get() {
+      if (!existsSync(filePath)) {
+        return null;
+      }
+
+      const raw = await fs.readFile(filePath);
+      if (raw.byteLength === 0) {
+        return null;
+      }
+
+      if (encrypted) {
+        return options.decryptString!(raw);
+      }
+
+      return raw.toString('utf8');
+    },
+    async set(token) {
+      if (encrypted) {
+        await fs.writeFile(filePath, options.encryptString!(token));
+        return;
+      }
+
+      options.logger?.(
+        'warn',
+        'Using plaintext refresh-token storage for local development.',
+      );
+      await fs.writeFile(filePath, token, 'utf8');
+    },
+    async clear() {
+      if (!existsSync(filePath)) {
+        return;
+      }
+      await fs.unlink(filePath);
+    },
+  };
+};
+
+const createKeytarStore = async (): Promise<RefreshTokenStore> => {
+  const keytarModule = (await import('keytar')) as {
+    default?: {
+      getPassword(service: string, account: string): Promise<string | null>;
+      setPassword(
+        service: string,
+        account: string,
+        password: string,
+      ): Promise<void>;
+      deletePassword(service: string, account: string): Promise<boolean>;
+    };
+    getPassword(service: string, account: string): Promise<string | null>;
+    setPassword(
+      service: string,
+      account: string,
+      password: string,
+    ): Promise<void>;
+    deletePassword(service: string, account: string): Promise<boolean>;
+  };
+
+  const keytar = keytarModule.default ?? keytarModule;
+  return {
+    kind: 'keytar',
+    async get() {
+      return keytar.getPassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
+    },
+    async set(token) {
+      await keytar.setPassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT, token);
+    },
+    async clear() {
+      await keytar.deletePassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
+    },
+  };
+};
+
+export const createRefreshTokenStore = async (
+  options: FileStoreOptions,
+): Promise<RefreshTokenStore> => {
+  if (process.platform === 'win32') {
+    try {
+      return await createKeytarStore();
+    } catch (error) {
+      options.logger?.(
+        'warn',
+        `Keytar unavailable; falling back to file-based token store: ${
+          error instanceof Error ? error.message : String(error)
+        }`,
+      );
+    }
+  }
+
+  return createFileStore(options);
+};
diff --git a/apps/renderer/src/app/app.html b/apps/renderer/src/app/app.html
index e2cbf3a..c0de43b 100644
--- a/apps/renderer/src/app/app.html
+++ b/apps/renderer/src/app/app.html
@@ -142,6 +142,14 @@
         <mat-icon matListItemIcon aria-hidden="true">cable</mat-icon>
         <span matListItemTitle>IPC Diagnostics</span>
       </a>
+      <a
+        mat-list-item
+        routerLink="/auth-session-lab"
+        routerLinkActive="active-link"
+      >
+        <mat-icon matListItemIcon aria-hidden="true">badge</mat-icon>
+        <span matListItemTitle>Auth Session Lab</span>
+      </a>
       <a mat-list-item routerLink="/file-tools" routerLinkActive="active-link">
         <mat-icon matListItemIcon aria-hidden="true">folder_open</mat-icon>
         <span matListItemTitle>File Tools</span>
diff --git a/apps/renderer/src/app/app.routes.ts b/apps/renderer/src/app/app.routes.ts
index 8331472..0ed28ff 100644
--- a/apps/renderer/src/app/app.routes.ts
+++ b/apps/renderer/src/app/app.routes.ts
@@ -111,6 +111,13 @@ export const appRoutes: Route[] = [
         (m) => m.IpcDiagnosticsPage,
       ),
   },
+  {
+    path: 'auth-session-lab',
+    loadComponent: () =>
+      import('./features/auth-session-lab/auth-session-lab-page').then(
+        (m) => m.AuthSessionLabPage,
+      ),
+  },
   {
     path: 'file-tools',
     loadComponent: () =>
diff --git a/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.css b/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.css
new file mode 100644
index 0000000..04cfe60
--- /dev/null
+++ b/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.css
@@ -0,0 +1,47 @@
+.auth-session-page {
+  display: grid;
+  gap: 1rem;
+}
+
+.hero {
+  border-radius: 0;
+}
+
+.actions {
+  display: flex;
+  gap: 0.75rem;
+  flex-wrap: wrap;
+  margin-bottom: 0.75rem;
+}
+
+.status {
+  margin: 0;
+}
+
+.status.error {
+  color: #a2191f;
+}
+
+.summary-grid {
+  display: grid;
+  grid-template-columns: 10rem 1fr;
+  gap: 0.4rem 0.8rem;
+  margin: 0 0 1rem;
+}
+
+.summary-grid dt {
+  font-weight: 600;
+}
+
+.summary-grid dd {
+  margin: 0;
+}
+
+.chip-row h3 {
+  margin: 0.4rem 0;
+}
+
+.muted {
+  opacity: 0.75;
+  margin: 0.25rem 0 0.5rem;
+}
diff --git a/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.html b/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.html
new file mode 100644
index 0000000..d1496f7
--- /dev/null
+++ b/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.html
@@ -0,0 +1,93 @@
+<section class="auth-session-page">
+  <mat-card class="hero">
+    <mat-card-subtitle>IDENTITY LAB</mat-card-subtitle>
+    <mat-card-title>OIDC Session Console</mat-card-title>
+    <mat-card-content>
+      Exercises desktop auth bridge APIs (`signIn`, `signOut`,
+      `getSessionSummary`) without exposing token values in renderer context.
+    </mat-card-content>
+  </mat-card>
+
+  <mat-card>
+    <mat-card-title>Session Controls</mat-card-title>
+    <mat-card-content>
+      <div class="actions">
+        <button
+          mat-flat-button
+          type="button"
+          (click)="refreshSummary()"
+          [disabled]="loading()"
+        >
+          Refresh Summary
+        </button>
+        <button
+          mat-flat-button
+          type="button"
+          (click)="signIn()"
+          [disabled]="loading() || !desktopAvailable()"
+        >
+          Sign In
+        </button>
+        <button
+          mat-stroked-button
+          type="button"
+          (click)="signOut()"
+          [disabled]="loading() || !desktopAvailable()"
+        >
+          Sign Out
+        </button>
+      </div>
+      <p class="status" [class.error]="statusTone() === 'error'">
+        {{ statusText() }}
+      </p>
+    </mat-card-content>
+  </mat-card>
+
+  <mat-card>
+    <mat-card-title>Current Session</mat-card-title>
+    <mat-card-content>
+      @if (summary(); as session) {
+      <dl class="summary-grid">
+        <dt>State</dt>
+        <dd>{{ session.state }}</dd>
+        <dt>User ID</dt>
+        <dd>{{ session.userId ?? 'n/a' }}</dd>
+        <dt>Email</dt>
+        <dd>{{ session.email ?? 'n/a' }}</dd>
+        <dt>Name</dt>
+        <dd>{{ session.name ?? 'n/a' }}</dd>
+        <dt>Expires</dt>
+        <dd>{{ session.expiresAt ?? 'n/a' }}</dd>
+      </dl>
+      } @else {
+      <p>No session summary loaded yet.</p>
+      }
+
+      <div class="chip-row">
+        <h3>Scopes</h3>
+        @if (scopes().length > 0) {
+        <mat-chip-set>
+          @for (scope of scopes(); track scope) {
+          <mat-chip>{{ scope }}</mat-chip>
+          }
+        </mat-chip-set>
+        } @else {
+        <p class="muted">No scopes.</p>
+        }
+      </div>
+
+      <div class="chip-row">
+        <h3>Entitlements</h3>
+        @if (entitlements().length > 0) {
+        <mat-chip-set>
+          @for (entitlement of entitlements(); track entitlement) {
+          <mat-chip>{{ entitlement }}</mat-chip>
+          }
+        </mat-chip-set>
+        } @else {
+        <p class="muted">No entitlements.</p>
+        }
+      </div>
+    </mat-card-content>
+  </mat-card>
+</section>
diff --git a/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.ts b/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.ts
new file mode 100644
index 0000000..b7816d0
--- /dev/null
+++ b/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.ts
@@ -0,0 +1,113 @@
+import {
+  ChangeDetectionStrategy,
+  Component,
+  computed,
+  signal,
+} from '@angular/core';
+import { CommonModule } from '@angular/common';
+import { MatCardModule } from '@angular/material/card';
+import { MatButtonModule } from '@angular/material/button';
+import { MatChipsModule } from '@angular/material/chips';
+import { MatIconModule } from '@angular/material/icon';
+import type { AuthSessionSummary } from '@electron-foundation/contracts';
+import { getDesktopApi } from '@electron-foundation/desktop-api';
+
+type StatusTone = 'info' | 'success' | 'warn' | 'error';
+
+@Component({
+  selector: 'app-auth-session-lab-page',
+  imports: [
+    CommonModule,
+    MatCardModule,
+    MatButtonModule,
+    MatChipsModule,
+    MatIconModule,
+  ],
+  templateUrl: './auth-session-lab-page.html',
+  styleUrl: './auth-session-lab-page.css',
+  changeDetection: ChangeDetectionStrategy.OnPush,
+})
+export class AuthSessionLabPage {
+  readonly desktopAvailable = signal(!!getDesktopApi());
+  readonly loading = signal(false);
+  readonly statusText = signal('Idle.');
+  readonly statusTone = signal<StatusTone>('info');
+  readonly summary = signal<AuthSessionSummary | null>(null);
+  readonly scopes = computed(() => this.summary()?.scopes ?? []);
+  readonly entitlements = computed(() => this.summary()?.entitlements ?? []);
+
+  async refreshSummary() {
+    const desktop = getDesktopApi();
+    if (!desktop) {
+      this.statusText.set('Desktop bridge unavailable in browser mode.');
+      this.statusTone.set('warn');
+      return;
+    }
+
+    this.loading.set(true);
+    try {
+      const result = await desktop.auth.getSessionSummary();
+      if (!result.ok) {
+        this.statusText.set(result.error.message);
+        this.statusTone.set('error');
+        return;
+      }
+
+      this.summary.set(result.data);
+      this.statusText.set(`Session state: ${result.data.state}`);
+      this.statusTone.set(result.data.state === 'active' ? 'success' : 'info');
+    } finally {
+      this.loading.set(false);
+    }
+  }
+
+  async signIn() {
+    const desktop = getDesktopApi();
+    if (!desktop) {
+      this.statusText.set('Desktop bridge unavailable in browser mode.');
+      this.statusTone.set('warn');
+      return;
+    }
+
+    this.loading.set(true);
+    try {
+      const result = await desktop.auth.signIn();
+      if (!result.ok) {
+        this.statusText.set(result.error.message);
+        this.statusTone.set('error');
+        return;
+      }
+
+      this.statusText.set('Sign-in completed.');
+      this.statusTone.set('success');
+      await this.refreshSummary();
+    } finally {
+      this.loading.set(false);
+    }
+  }
+
+  async signOut() {
+    const desktop = getDesktopApi();
+    if (!desktop) {
+      this.statusText.set('Desktop bridge unavailable in browser mode.');
+      this.statusTone.set('warn');
+      return;
+    }
+
+    this.loading.set(true);
+    try {
+      const result = await desktop.auth.signOut();
+      if (!result.ok) {
+        this.statusText.set(result.error.message);
+        this.statusTone.set('error');
+        return;
+      }
+
+      this.statusText.set('Signed out.');
+      this.statusTone.set('info');
+      await this.refreshSummary();
+    } finally {
+      this.loading.set(false);
+    }
+  }
+}
diff --git a/package.json b/package.json
index 6341b1a..cc4555d 100644
--- a/package.json
+++ b/package.json
@@ -62,7 +62,8 @@
       "esbuild",
       "electron",
       "electron-winstaller",
-      "@carbon/styles"
+      "@carbon/styles",
+      "keytar"
     ]
   },
   "devDependencies": {
@@ -145,6 +146,7 @@
     "@fontsource/material-icons": "^5.2.7",
     "@jsverse/transloco": "^8.2.1",
     "electron-updater": "^6.7.3",
+    "keytar": "^7.9.0",
     "rxjs": "~7.8.0",
     "zod": "^4.3.6"
   }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 1c8737f..cf059c4 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -53,6 +53,9 @@ importers:
       electron-updater:
         specifier: ^6.7.3
         version: 6.7.3
+      keytar:
+        specifier: ^7.9.0
+        version: 7.9.0
       rxjs:
         specifier: ~7.8.0
         version: 7.8.2
@@ -4786,6 +4789,9 @@ packages:
     resolution: {integrity: sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw==}
     engines: {node: '>= 20.19.0'}
 
+  chownr@1.1.4:
+    resolution: {integrity: sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==}
+
   chownr@2.0.0:
     resolution: {integrity: sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==}
     engines: {node: '>=10'}
@@ -5253,6 +5259,10 @@ packages:
   deep-equal@1.0.1:
     resolution: {integrity: sha512-bHtC0iYvWhyaTzvV3CZgPeZQqCOBGyGsVV7v4eevpdkLHfiSrXUdBG+qAuSz4RI70sszvjQ1QSZ98An1yNwpSw==}
 
+  deep-extend@0.6.0:
+    resolution: {integrity: sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==}
+    engines: {node: '>=4.0.0'}
+
   deep-is@0.1.4:
     resolution: {integrity: sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==}
 
@@ -5649,6 +5659,10 @@ packages:
     resolution: {integrity: sha512-+I6B/IkJc1o/2tiURyz/ivu/O0nKNEArIUB5O7zBrlDVJr22SCLH3xTeEry428LvFhRzIA1g8izguxJ/gbNcVQ==}
     engines: {node: '>= 0.8.0'}
 
+  expand-template@2.0.3:
+    resolution: {integrity: sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==}
+    engines: {node: '>=6'}
+
   expand-tilde@2.0.2:
     resolution: {integrity: sha512-A5EmesHW6rfnZ9ysHQjPdJRni0SRar0tjtG5MNtm9n5TUvsYU8oozprtRD4AqHxcZWWlVuAmQo2nWKfN9oyjTw==}
     engines: {node: '>=0.10.0'}
@@ -5957,6 +5971,9 @@ packages:
     engines: {node: '>=16'}
     hasBin: true
 
+  github-from-package@0.0.0:
+    resolution: {integrity: sha512-SyHy3T1v2NUXn29OsWdxmK6RwHD+vkj3v8en8AOBZ1wBQ/hCAQ5bAQTD02kW4W9tUp/3Qh6J8r9EvntiyCmOOw==}
+
   glob-parent@5.1.2:
     resolution: {integrity: sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==}
     engines: {node: '>= 6'}
@@ -6706,6 +6723,9 @@ packages:
     resolution: {integrity: sha512-iYSchDJ+liQ8iwbSI2QqsQOvqv58eJCEanyJPJi+Khyu8smkcKSFUCbPwzFcL7YVtZ6eONjqRX/38caJ7QjRAQ==}
     engines: {node: '>= 0.6'}
 
+  keytar@7.9.0:
+    resolution: {integrity: sha512-VPD8mtVtm5JNtA2AErl6Chp06JBfy7diFQ7TQQhdpWOl6MrCRB+eRbvAZUsbGQS9kiMq0coJsy0W0vHpDCkWsQ==}
+
   keyv@4.5.4:
     resolution: {integrity: sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==}
 
@@ -7213,6 +7233,9 @@ packages:
     resolution: {integrity: sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==}
     engines: {node: '>= 18'}
 
+  mkdirp-classic@0.5.3:
+    resolution: {integrity: sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==}
+
   mkdirp@0.5.6:
     resolution: {integrity: sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==}
     hasBin: true
@@ -7267,6 +7290,9 @@ packages:
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
+  napi-build-utils@2.0.0:
+    resolution: {integrity: sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==}
+
   napi-postinstall@0.3.4:
     resolution: {integrity: sha512-PHI5f1O0EP5xJ9gQmFGMS6IZcrVvTjpXjz7Na41gTE7eE2hK11lg04CECCYEEjdc17EV4DO+fkGEtt7TpTaTiQ==}
     engines: {node: ^12.20.0 || ^14.18.0 || >=16.0.0}
@@ -7318,6 +7344,9 @@ packages:
   node-abort-controller@3.1.1:
     resolution: {integrity: sha512-AGK2yQKIjRuqnc6VkX2Xj5d+QW8xZ87pa1UK6yA6ouUyuxfHuMP6umE5QK7UmTeOAymo+Zx1Fxiuw9rVx8taHQ==}
 
+  node-addon-api@4.3.0:
+    resolution: {integrity: sha512-73sE9+3UaLYYFmDsFZnqCInzPyh3MqIwZO9cw58yIqAZhONrrabrYyYe3TuIqtIiOuTXVhsGau8hcrhhwSsDIQ==}
+
   node-addon-api@6.1.0:
     resolution: {integrity: sha512-+eawOlIgy680F0kBzPUNFhMZGtJ1YmqM6l4+Crf4IkImjYrO/mqPwRMh352g23uIaQKFItcQ64I7KMaJxHgAVA==}
 
@@ -8017,6 +8046,11 @@ packages:
     engines: {node: '>=14.0.0'}
     hasBin: true
 
+  prebuild-install@7.1.3:
+    resolution: {integrity: sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==}
+    engines: {node: '>=10'}
+    hasBin: true
+
   prelude-ls@1.2.1:
     resolution: {integrity: sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==}
     engines: {node: '>= 0.8.0'}
@@ -8121,6 +8155,10 @@ packages:
     resolution: {integrity: sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==}
     engines: {node: '>= 0.10'}
 
+  rc@1.2.8:
+    resolution: {integrity: sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==}
+    hasBin: true
+
   react-dom@19.2.4:
     resolution: {integrity: sha512-AXJdLo8kgMbimY95O2aKQqsz2iWi9jMgKJhRBAxECE4IFxfcazB2LmzloIoibJI3C12IlY20+KFaLv+71bUJeQ==}
     peerDependencies:
@@ -8628,6 +8666,12 @@ packages:
     resolution: {integrity: sha512-/fUgUhYghuLzVT/gaJoeVehLCgZiUxPCPMcyVNY0lIf/cTCz58K/WTI7PefDarXxp9nUKpEwg1yyz3eSBMTtgA==}
     engines: {node: ^20.17.0 || >=22.9.0}
 
+  simple-concat@1.0.1:
+    resolution: {integrity: sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q==}
+
+  simple-get@4.0.1:
+    resolution: {integrity: sha512-brv7p5WgH0jmQJr1ZDDfKDOSeWWg+OVypG99A/5vYGPqJ6pxiaHLy8nxtFjBA7oMa01ebA9gfh1uMCFqOuXxvA==}
+
   simple-swizzle@0.2.4:
     resolution: {integrity: sha512-nAu1WFPQSMNr2Zn9PGSZK9AGn4t/y97lEm+MXTtUDwfP0ksAIX4nO+6ruD9Jwut4C49SB1Ws+fbXsm/yScWOHw==}
 
@@ -8827,6 +8871,10 @@ packages:
     resolution: {integrity: sha512-7FCwGGmx8mD5xQd3RPUvnSpUXHM3BWuzjtpD4TXsfcZ9EL4azvVVUscFYwD9nx8Kh+uCBC00XBtAykoMHwTh8Q==}
     engines: {node: '>=0.10.0'}
 
+  strip-json-comments@2.0.1:
+    resolution: {integrity: sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==}
+    engines: {node: '>=0.10.0'}
+
   strip-json-comments@3.1.1:
     resolution: {integrity: sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==}
     engines: {node: '>=8'}
@@ -8894,6 +8942,9 @@ packages:
     resolution: {integrity: sha512-g9ljZiwki/LfxmQADO3dEY1CbpmXT5Hm2fJ+QaGKwSXUylMybePR7/67YW7jOrrvjEgL1Fmz5kzyAjWVWLlucg==}
     engines: {node: '>=6'}
 
+  tar-fs@2.1.4:
+    resolution: {integrity: sha512-mDAjwmZdh7LTT6pNleZ05Yt65HC3E+NiQzl672vQG38jIrehtJk/J3mNwIg+vShQPcLF/LV7CMnDW6vjj6sfYQ==}
+
   tar-stream@2.2.0:
     resolution: {integrity: sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==}
     engines: {node: '>=6'}
@@ -9078,6 +9129,9 @@ packages:
     resolution: {integrity: sha512-50QV99kCKH5P/Vs4E2Gzp7BopNV+KzTXqWeaxrfu5IQJBOULRsTIS9seSsOVT8ZnGXzCyx55nYWAi4qJzpZKEQ==}
     engines: {node: ^20.17.0 || >=22.9.0}
 
+  tunnel-agent@0.6.0:
+    resolution: {integrity: sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==}
+
   type-check@0.4.0:
     resolution: {integrity: sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==}
     engines: {node: '>= 0.8.0'}
@@ -15293,6 +15347,8 @@ snapshots:
     dependencies:
       readdirp: 5.0.0
 
+  chownr@1.1.4: {}
+
   chownr@2.0.0: {}
 
   chownr@3.0.0: {}
@@ -15729,6 +15785,8 @@ snapshots:
 
   deep-equal@1.0.1: {}
 
+  deep-extend@0.6.0: {}
+
   deep-is@0.1.4: {}
 
   deepmerge@4.3.1: {}
@@ -16193,6 +16251,8 @@ snapshots:
 
   exit-x@0.2.2: {}
 
+  expand-template@2.0.3: {}
+
   expand-tilde@2.0.2:
     dependencies:
       homedir-polyfill: 1.0.3
@@ -16602,6 +16662,8 @@ snapshots:
       meow: 12.1.1
       split2: 4.2.0
 
+  github-from-package@0.0.0: {}
+
   glob-parent@5.1.2:
     dependencies:
       is-glob: 4.0.3
@@ -17539,6 +17601,11 @@ snapshots:
     dependencies:
       tsscmp: 1.0.6
 
+  keytar@7.9.0:
+    dependencies:
+      node-addon-api: 4.3.0
+      prebuild-install: 7.1.3
+
   keyv@4.5.4:
     dependencies:
       json-buffer: 3.0.1
@@ -18090,6 +18157,8 @@ snapshots:
     dependencies:
       minipass: 7.1.2
 
+  mkdirp-classic@0.5.3: {}
+
   mkdirp@0.5.6:
     dependencies:
       minimist: 1.2.8
@@ -18136,6 +18205,8 @@ snapshots:
 
   nanoid@3.3.11: {}
 
+  napi-build-utils@2.0.0: {}
+
   napi-postinstall@0.3.4: {}
 
   natural-compare@1.4.0: {}
@@ -18192,6 +18263,8 @@ snapshots:
 
   node-abort-controller@3.1.1: {}
 
+  node-addon-api@4.3.0: {}
+
   node-addon-api@6.1.0:
     optional: true
 
@@ -18923,6 +18996,21 @@ snapshots:
     dependencies:
       commander: 9.5.0
 
+  prebuild-install@7.1.3:
+    dependencies:
+      detect-libc: 2.1.2
+      expand-template: 2.0.3
+      github-from-package: 0.0.0
+      minimist: 1.2.8
+      mkdirp-classic: 0.5.3
+      napi-build-utils: 2.0.0
+      node-abi: 3.87.0
+      pump: 3.0.3
+      rc: 1.2.8
+      simple-get: 4.0.1
+      tar-fs: 2.1.4
+      tunnel-agent: 0.6.0
+
   prelude-ls@1.2.1: {}
 
   prettier@2.8.8: {}
@@ -19007,6 +19095,13 @@ snapshots:
       iconv-lite: 0.7.2
       unpipe: 1.0.0
 
+  rc@1.2.8:
+    dependencies:
+      deep-extend: 0.6.0
+      ini: 1.3.8
+      minimist: 1.2.8
+      strip-json-comments: 2.0.1
+
   react-dom@19.2.4(react@19.2.4):
     dependencies:
       react: 19.2.4
@@ -19589,6 +19684,14 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  simple-concat@1.0.1: {}
+
+  simple-get@4.0.1:
+    dependencies:
+      decompress-response: 6.0.0
+      once: 1.4.0
+      simple-concat: 1.0.1
+
   simple-swizzle@0.2.4:
     dependencies:
       is-arrayish: 0.3.4
@@ -19812,6 +19915,8 @@ snapshots:
 
   strip-eof@1.0.0: {}
 
+  strip-json-comments@2.0.1: {}
+
   strip-json-comments@3.1.1: {}
 
   strip-outer@1.0.1:
@@ -19874,6 +19979,13 @@ snapshots:
 
   tapable@2.3.0: {}
 
+  tar-fs@2.1.4:
+    dependencies:
+      chownr: 1.1.4
+      mkdirp-classic: 0.5.3
+      pump: 3.0.3
+      tar-stream: 2.2.0
+
   tar-stream@2.2.0:
     dependencies:
       bl: 4.1.0
@@ -20067,6 +20179,10 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  tunnel-agent@0.6.0:
+    dependencies:
+      safe-buffer: 5.2.1
+
   type-check@0.4.0:
     dependencies:
       prelude-ls: 1.2.1

From e5fb6506da455fa6422ec22d2ec408b8ef491ca9 Mon Sep 17 00:00:00 2001
From: Simon Hagger <simon.hagger@gmail.com>
Date: Thu, 12 Feb 2026 11:50:21 +0000
Subject: [PATCH 05/24] feat(api): support OIDC session token auth in gateway

---
 apps/desktop-main/src/api-gateway.spec.ts | 65 ++++++++++++++++++++++-
 apps/desktop-main/src/api-gateway.ts      | 27 ++++++++++
 apps/desktop-main/src/main.ts             |  4 +-
 3 files changed, 93 insertions(+), 3 deletions(-)

diff --git a/apps/desktop-main/src/api-gateway.spec.ts b/apps/desktop-main/src/api-gateway.spec.ts
index 4910234..44315f8 100644
--- a/apps/desktop-main/src/api-gateway.spec.ts
+++ b/apps/desktop-main/src/api-gateway.spec.ts
@@ -1,10 +1,14 @@
-import { describe, expect, it } from 'vitest';
+import { afterEach, describe, expect, it } from 'vitest';
 import type {
   ApiInvokeRequest,
   ApiOperationId,
   DesktopResult,
 } from '@electron-foundation/contracts';
-import { invokeApiOperation, type ApiOperation } from './api-gateway';
+import {
+  invokeApiOperation,
+  setOidcAccessTokenResolver,
+  type ApiOperation,
+} from './api-gateway';
 
 const baseRequest = (
   operationId: ApiOperationId,
@@ -32,6 +36,10 @@ const expectFailure = (
 };
 
 describe('invokeApiOperation', () => {
+  afterEach(() => {
+    setOidcAccessTokenResolver(null);
+  });
+
   it('rejects unknown operations', async () => {
     const result = await invokeApiOperation(
       {
@@ -194,6 +202,59 @@ describe('invokeApiOperation', () => {
     expect(error.code).toBe('API/CREDENTIALS_UNAVAILABLE');
   });
 
+  it('rejects oidc-auth operations when no session token is available', async () => {
+    const operations: Partial<Record<ApiOperationId, ApiOperation>> = {
+      'status.github': {
+        method: 'GET',
+        url: 'https://api.example.com/secure',
+        auth: {
+          type: 'oidc',
+        },
+      },
+    };
+    setOidcAccessTokenResolver(() => null);
+
+    const result = await invokeApiOperation(baseRequest('status.github'), {
+      operations,
+    });
+
+    const error = expectFailure(result);
+    expect(error.code).toBe('API/AUTH_REQUIRED');
+  });
+
+  it('attaches oidc bearer token when resolver returns an access token', async () => {
+    const operations: Partial<Record<ApiOperationId, ApiOperation>> = {
+      'status.github': {
+        method: 'GET',
+        url: 'https://api.example.com/secure',
+        auth: {
+          type: 'oidc',
+        },
+      },
+    };
+    setOidcAccessTokenResolver(() => 'oidc-token-123');
+
+    let authHeader = '';
+    const fetchFn: typeof fetch = async (_input, init) => {
+      const headers = new Headers(init?.headers);
+      authHeader = headers.get('Authorization') ?? '';
+      return new Response(JSON.stringify({ ok: true }), {
+        status: 200,
+        headers: {
+          'content-type': 'application/json',
+        },
+      });
+    };
+
+    const result = await invokeApiOperation(baseRequest('status.github'), {
+      operations,
+      fetchFn,
+    });
+
+    expect(result.ok).toBe(true);
+    expect(authHeader).toBe('Bearer oidc-token-123');
+  });
+
   it('retries GET requests for retryable errors', async () => {
     const operations: Partial<Record<ApiOperationId, ApiOperation>> = {
       'status.github': {
diff --git a/apps/desktop-main/src/api-gateway.ts b/apps/desktop-main/src/api-gateway.ts
index 3b57de5..f8ba083 100644
--- a/apps/desktop-main/src/api-gateway.ts
+++ b/apps/desktop-main/src/api-gateway.ts
@@ -24,6 +24,9 @@ export type ApiOperation = {
         type: 'bearer';
         tokenEnvVar: string;
       }
+    | {
+        type: 'oidc';
+      }
     | {
         type: 'none';
       };
@@ -62,6 +65,13 @@ type OperationRuntimeState = {
 };
 
 const operationRuntimeState = new Map<string, OperationRuntimeState>();
+let oidcAccessTokenResolver: (() => string | null) | null = null;
+
+export const setOidcAccessTokenResolver = (
+  resolver: (() => string | null) | null,
+) => {
+  oidcAccessTokenResolver = resolver;
+};
 
 const sleep = (ms: number) =>
   new Promise<void>((resolve) => {
@@ -214,6 +224,23 @@ const invokeSingleAttempt = async (
     headers.set('Authorization', `Bearer ${token}`);
   }
 
+  if (auth.type === 'oidc') {
+    const token = oidcAccessTokenResolver?.();
+    if (!token) {
+      return asFailure(
+        'API/AUTH_REQUIRED',
+        'An active OIDC session is required for this API operation.',
+        {
+          operationId: request.payload.operationId,
+        },
+        false,
+        correlationId,
+      );
+    }
+
+    headers.set('Authorization', `Bearer ${token}`);
+  }
+
   const abortController = new AbortController();
   const timeoutHandle = setTimeout(() => abortController.abort(), timeoutMs);
 
diff --git a/apps/desktop-main/src/main.ts b/apps/desktop-main/src/main.ts
index 223a316..41e728f 100644
--- a/apps/desktop-main/src/main.ts
+++ b/apps/desktop-main/src/main.ts
@@ -14,7 +14,7 @@ import { existsSync } from 'node:fs';
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import { autoUpdater } from 'electron-updater';
-import { invokeApiOperation } from './api-gateway';
+import { invokeApiOperation, setOidcAccessTokenResolver } from './api-gateway';
 import { loadOidcConfig } from './oidc-config';
 import { OidcService } from './oidc-service';
 import { createRefreshTokenStore } from './secure-token-store';
@@ -849,8 +849,10 @@ const bootstrap = async () => {
         logEvent(level, event, undefined, details);
       },
     });
+    setOidcAccessTokenResolver(() => oidcService?.getAccessToken() ?? null);
   } else {
     logEvent('info', 'auth.not_configured');
+    setOidcAccessTokenResolver(null);
   }
 
   registerIpcHandlers();

From 5bfee5da5a6544852df73cdea50023201267fe70 Mon Sep 17 00:00:00 2001
From: Simon Hagger <simon.hagger@gmail.com>
Date: Thu, 12 Feb 2026 11:50:49 +0000
Subject: [PATCH 06/24] feat(renderer): include auth session probe in IPC
 diagnostics

---
 .../app/features/ipc-diagnostics/ipc-diagnostics-page.ts | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/apps/renderer/src/app/features/ipc-diagnostics/ipc-diagnostics-page.ts b/apps/renderer/src/app/features/ipc-diagnostics/ipc-diagnostics-page.ts
index 577d68e..c696bf1 100644
--- a/apps/renderer/src/app/features/ipc-diagnostics/ipc-diagnostics-page.ts
+++ b/apps/renderer/src/app/features/ipc-diagnostics/ipc-diagnostics-page.ts
@@ -77,6 +77,15 @@ export class IpcDiagnosticsPage {
       }),
     );
 
+    results.push(
+      await this.probe('Auth Session Channel', async () => {
+        const response = await desktop.auth.getSessionSummary();
+        return response.ok
+          ? { ok: true, detail: response.data.state }
+          : { ok: false, detail: response.error.message };
+      }),
+    );
+
     this.probes.set(results);
     const failed = results.some((result) => !result.ok);
     this.status.set(

From d50cee42cb968b4c3c7b9f1d7b32cbe14f79ba20 Mon Sep 17 00:00:00 2001
From: Simon Hagger <simon.hagger@gmail.com>
Date: Thu, 12 Feb 2026 11:51:22 +0000
Subject: [PATCH 07/24] docs(readme): document OIDC env setup and runtime
 behavior

---
 README.md | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/README.md b/README.md
index 127c583..53ee949 100644
--- a/README.md
+++ b/README.md
@@ -89,6 +89,28 @@ Then relaunch desktop dev:
 pnpm desktop:dev:win
 ```
 
+## OIDC Authentication (Desktop)
+
+OIDC support is implemented in main/preload with Authorization Code + PKCE.
+
+Required environment variables:
+
+- `OIDC_ISSUER`
+- `OIDC_CLIENT_ID`
+- `OIDC_REDIRECT_URI` (loopback URI, for example `http://127.0.0.1:42813/callback`)
+- `OIDC_SCOPES` (must include `openid`)
+
+Optional:
+
+- `OIDC_AUDIENCE`
+- `OIDC_ALLOW_INSECURE_TOKEN_STORAGE=1` (development-only fallback when OS secure storage is unavailable)
+
+Runtime behavior:
+
+- Refresh tokens are stored in OS secure storage on Windows (`keytar`) with encrypted file fallback.
+- Renderer can only call `desktop.auth.signIn()`, `desktop.auth.signOut()`, and `desktop.auth.getSessionSummary()`.
+- Access token attachment for secured API operations occurs in main process only.
+
 ## Repository Layout
 
 Top-level:

From 183634d625f787776e7d66bcbba7b634f4896783 Mon Sep 17 00:00:00 2001
From: Simon Hagger <simon.hagger@gmail.com>
Date: Thu, 12 Feb 2026 12:08:02 +0000
Subject: [PATCH 08/24] chore(devx): auto-load .env.local for desktop dev on
 Windows

---
 .env.example                      |  9 ++++++++
 .gitignore                        |  7 +++++-
 README.md                         |  8 +++++++
 tools/scripts/desktop-dev-win.ps1 | 38 +++++++++++++++++++++++++++++++
 4 files changed, 61 insertions(+), 1 deletion(-)
 create mode 100644 .env.example

diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..381b684
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,9 @@
+# Copy this file to ".env.local" and set values for local development.
+
+OIDC_ISSUER=https://willing-elephant-20.clerk.accounts.dev
+OIDC_CLIENT_ID=replace-with-client-id
+OIDC_REDIRECT_URI=http://127.0.0.1:42813/callback
+OIDC_SCOPES=openid profile email offline_access
+# Optional:
+# OIDC_AUDIENCE=api.adopa.co
+# OIDC_ALLOW_INSECURE_TOKEN_STORAGE=1
diff --git a/.gitignore b/.gitignore
index 7eac3a1..0ecd8f0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -49,4 +49,9 @@ __screenshots__/
 vitest.config.*.timestamp*
 
 FILE_INDEX.txt
-FEEDBACK.md
\ No newline at end of file
+FEEDBACK.md
+
+# local environment configuration
+.env
+.env.local
+.env.*.local
diff --git a/README.md b/README.md
index 53ee949..6b136ab 100644
--- a/README.md
+++ b/README.md
@@ -105,6 +105,14 @@ Optional:
 - `OIDC_AUDIENCE`
 - `OIDC_ALLOW_INSECURE_TOKEN_STORAGE=1` (development-only fallback when OS secure storage is unavailable)
 
+Recommended local setup:
+
+1. Copy `.env.example` to `.env.local`.
+2. Fill in your OIDC values.
+3. Run `pnpm desktop:dev:win`.
+
+`desktop:dev:win` now auto-loads `.env` and `.env.local` (with `.env.local` taking precedence).
+
 Runtime behavior:
 
 - Refresh tokens are stored in OS secure storage on Windows (`keytar`) with encrypted file fallback.
diff --git a/tools/scripts/desktop-dev-win.ps1 b/tools/scripts/desktop-dev-win.ps1
index cb4fc7d..c032590 100644
--- a/tools/scripts/desktop-dev-win.ps1
+++ b/tools/scripts/desktop-dev-win.ps1
@@ -4,6 +4,44 @@ $ErrorActionPreference = "Stop"
 $repoRoot = Resolve-Path (Join-Path $PSScriptRoot "..\..")
 Set-Location $repoRoot
 
+function Import-DotEnvFile {
+  param(
+    [Parameter(Mandatory = $true)]
+    [string]$Path
+  )
+
+  if (-not (Test-Path $Path)) {
+    return
+  }
+
+  Get-Content -Path $Path | ForEach-Object {
+    $line = $_.Trim()
+    if ([string]::IsNullOrWhiteSpace($line) -or $line.StartsWith('#')) {
+      return
+    }
+
+    $match = [regex]::Match($line, '^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)\s*$')
+    if (-not $match.Success) {
+      return
+    }
+
+    $key = $match.Groups[1].Value
+    $value = $match.Groups[2].Value.Trim()
+
+    if (
+      ($value.StartsWith('"') -and $value.EndsWith('"')) -or
+      ($value.StartsWith("'") -and $value.EndsWith("'"))
+    ) {
+      $value = $value.Substring(1, $value.Length - 2)
+    }
+
+    [System.Environment]::SetEnvironmentVariable($key, $value, 'Process')
+  }
+}
+
+Import-DotEnvFile -Path (Join-Path $repoRoot ".env")
+Import-DotEnvFile -Path (Join-Path $repoRoot ".env.local")
+
 # Ensure Electron runs in GUI mode.
 Remove-Item Env:ELECTRON_RUN_AS_NODE -ErrorAction SilentlyContinue
 

From 927dce1024f497eb003b787c9a0ed15cabf683c0 Mon Sep 17 00:00:00 2001
From: Simon Hagger <simon.hagger@gmail.com>
Date: Thu, 12 Feb 2026 12:27:08 +0000
Subject: [PATCH 09/24] fix(auth): bridge clerk sign-in redirect route for
 desktop OIDC

---
 .env.example                                  |  6 +--
 apps/renderer/src/app/app.routes.ts           |  7 ++++
 .../auth-signin-bridge-page.css               | 21 ++++++++++
 .../auth-signin-bridge-page.html              |  7 ++++
 .../auth-signin-bridge-page.ts                | 41 +++++++++++++++++++
 5 files changed, 79 insertions(+), 3 deletions(-)
 create mode 100644 apps/renderer/src/app/features/auth-signin-bridge/auth-signin-bridge-page.css
 create mode 100644 apps/renderer/src/app/features/auth-signin-bridge/auth-signin-bridge-page.html
 create mode 100644 apps/renderer/src/app/features/auth-signin-bridge/auth-signin-bridge-page.ts

diff --git a/.env.example b/.env.example
index 381b684..cbab68f 100644
--- a/.env.example
+++ b/.env.example
@@ -1,9 +1,9 @@
 # Copy this file to ".env.local" and set values for local development.
 
-OIDC_ISSUER=https://willing-elephant-20.clerk.accounts.dev
-OIDC_CLIENT_ID=replace-with-client-id
+OIDC_ISSUER=https://your-issuer.example.com
+OIDC_CLIENT_ID=your-client-id
 OIDC_REDIRECT_URI=http://127.0.0.1:42813/callback
 OIDC_SCOPES=openid profile email offline_access
 # Optional:
-# OIDC_AUDIENCE=api.adopa.co
+# OIDC_AUDIENCE=your-api-audience
 # OIDC_ALLOW_INSECURE_TOKEN_STORAGE=1
diff --git a/apps/renderer/src/app/app.routes.ts b/apps/renderer/src/app/app.routes.ts
index 0ed28ff..76bd181 100644
--- a/apps/renderer/src/app/app.routes.ts
+++ b/apps/renderer/src/app/app.routes.ts
@@ -1,6 +1,13 @@
 import { Route } from '@angular/router';
 
 export const appRoutes: Route[] = [
+  {
+    path: 'sign-in',
+    loadComponent: () =>
+      import('./features/auth-signin-bridge/auth-signin-bridge-page').then(
+        (m) => m.AuthSigninBridgePage,
+      ),
+  },
   {
     path: '',
     loadComponent: () =>
diff --git a/apps/renderer/src/app/features/auth-signin-bridge/auth-signin-bridge-page.css b/apps/renderer/src/app/features/auth-signin-bridge/auth-signin-bridge-page.css
new file mode 100644
index 0000000..47b6417
--- /dev/null
+++ b/apps/renderer/src/app/features/auth-signin-bridge/auth-signin-bridge-page.css
@@ -0,0 +1,21 @@
+.signin-bridge {
+  margin: 2rem;
+  max-width: 48rem;
+  font-family: 'IBM Plex Sans', sans-serif;
+}
+
+.signin-bridge h1 {
+  margin: 0 0 0.75rem;
+  font-size: 1.6rem;
+}
+
+.signin-bridge p {
+  margin: 0 0 1rem;
+}
+
+.signin-bridge pre {
+  background: #fff1f1;
+  border: 1px solid #d9a7a7;
+  padding: 0.75rem;
+  white-space: pre-wrap;
+}
diff --git a/apps/renderer/src/app/features/auth-signin-bridge/auth-signin-bridge-page.html b/apps/renderer/src/app/features/auth-signin-bridge/auth-signin-bridge-page.html
new file mode 100644
index 0000000..6efcd76
--- /dev/null
+++ b/apps/renderer/src/app/features/auth-signin-bridge/auth-signin-bridge-page.html
@@ -0,0 +1,7 @@
+<section class="signin-bridge">
+  <h1>Sign-In Redirect</h1>
+  <p>{{ message() }}</p>
+  @if (error(); as errorMessage) {
+  <pre>{{ errorMessage }}</pre>
+  }
+</section>
diff --git a/apps/renderer/src/app/features/auth-signin-bridge/auth-signin-bridge-page.ts b/apps/renderer/src/app/features/auth-signin-bridge/auth-signin-bridge-page.ts
new file mode 100644
index 0000000..0aa4c74
--- /dev/null
+++ b/apps/renderer/src/app/features/auth-signin-bridge/auth-signin-bridge-page.ts
@@ -0,0 +1,41 @@
+import {
+  ChangeDetectionStrategy,
+  Component,
+  inject,
+  signal,
+} from '@angular/core';
+import { ActivatedRoute } from '@angular/router';
+
+@Component({
+  selector: 'app-auth-signin-bridge-page',
+  templateUrl: './auth-signin-bridge-page.html',
+  styleUrl: './auth-signin-bridge-page.css',
+  changeDetection: ChangeDetectionStrategy.OnPush,
+})
+export class AuthSigninBridgePage {
+  private readonly route = inject(ActivatedRoute);
+
+  readonly message = signal('Preparing authentication redirect...');
+  readonly error = signal<string | null>(null);
+
+  constructor() {
+    const redirectUrl = this.route.snapshot.queryParamMap.get('redirect_url');
+    if (!redirectUrl) {
+      this.error.set('Missing redirect_url query parameter.');
+      this.message.set('Unable to continue sign-in.');
+      return;
+    }
+
+    try {
+      const parsed = new URL(redirectUrl);
+      if (parsed.protocol !== 'https:') {
+        throw new Error('Only HTTPS redirect URLs are allowed.');
+      }
+
+      window.location.replace(parsed.toString());
+    } catch (error) {
+      this.error.set(error instanceof Error ? error.message : String(error));
+      this.message.set('Unable to continue sign-in.');
+    }
+  }
+}

From 540e9205b6f317541b9b6d2e01ffaef5b000b022 Mon Sep 17 00:00:00 2001
From: Simon Hagger <simon.hagger@gmail.com>
Date: Thu, 12 Feb 2026 12:28:56 +0000
Subject: [PATCH 10/24] fix(auth): use extended IPC timeout for interactive
 sign-in flow

---
 apps/desktop-preload/src/main.ts | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/apps/desktop-preload/src/main.ts b/apps/desktop-preload/src/main.ts
index 1da9df6..6d379a5 100644
--- a/apps/desktop-preload/src/main.ts
+++ b/apps/desktop-preload/src/main.ts
@@ -56,6 +56,7 @@ const logPreloadError = (
 };
 
 const ipcInvokeTimeoutMs = 10_000;
+const authSignInTimeoutMs = 5 * 60_000;
 
 const createCorrelationId = (): string => {
   if (typeof globalThis.crypto?.randomUUID === 'function') {
@@ -96,13 +97,11 @@ const invoke = async <TResponse>(
   request: unknown,
   correlationId: string,
   responsePayloadSchema: ZodType<TResponse>,
+  timeoutMs = ipcInvokeTimeoutMs,
 ): Promise<DesktopResult<TResponse>> => {
   try {
     const timeoutPromise = new Promise<never>((_resolve, reject) => {
-      setTimeout(
-        () => reject(new Error('IPC invoke timed out')),
-        ipcInvokeTimeoutMs,
-      );
+      setTimeout(() => reject(new Error('IPC invoke timed out')), timeoutMs);
     });
     const response = await Promise.race([
       ipcRenderer.invoke(channel, request),
@@ -128,12 +127,12 @@ const invoke = async <TResponse>(
     if (error instanceof Error && error.message === 'IPC invoke timed out') {
       logPreloadError('ipc.invoke_timeout', correlationId, {
         channel,
-        timeoutMs: ipcInvokeTimeoutMs,
+        timeoutMs,
       });
       return asFailure(
         'IPC/TIMEOUT',
         `IPC invoke timed out for channel: ${channel}`,
-        { timeoutMs: ipcInvokeTimeoutMs },
+        { timeoutMs },
         true,
         correlationId,
       );
@@ -213,6 +212,7 @@ const desktopApi: DesktopApi = {
         request,
         correlationId,
         authSignInResponseSchema,
+        authSignInTimeoutMs,
       );
     },
     async signOut() {

From bc23b6500b54d94f4042195f57c353bb3d3ec5e3 Mon Sep 17 00:00:00 2001
From: Simon Hagger <simon.hagger@gmail.com>
Date: Thu, 12 Feb 2026 12:37:18 +0000
Subject: [PATCH 11/24] fix(auth): redirect sign-in bridge to Clerk hosted
 sign-in page

---
 .../features/auth-signin-bridge/auth-signin-bridge-page.ts  | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/apps/renderer/src/app/features/auth-signin-bridge/auth-signin-bridge-page.ts b/apps/renderer/src/app/features/auth-signin-bridge/auth-signin-bridge-page.ts
index 0aa4c74..6f2ed1c 100644
--- a/apps/renderer/src/app/features/auth-signin-bridge/auth-signin-bridge-page.ts
+++ b/apps/renderer/src/app/features/auth-signin-bridge/auth-signin-bridge-page.ts
@@ -32,7 +32,11 @@ export class AuthSigninBridgePage {
         throw new Error('Only HTTPS redirect URLs are allowed.');
       }
 
-      window.location.replace(parsed.toString());
+      const signInHost = parsed.hostname;
+      const hostedSignInUrl = new URL(`https://${signInHost}/sign-in`);
+      hostedSignInUrl.searchParams.set('redirect_url', parsed.toString());
+
+      window.location.replace(hostedSignInUrl.toString());
     } catch (error) {
       this.error.set(error instanceof Error ? error.message : String(error));
       this.message.set('Unable to continue sign-in.');

From e275095c7ebc95ae49680304ad1c43a1e87f1b2e Mon Sep 17 00:00:00 2001
From: Simon Hagger <simon.hagger@gmail.com>
Date: Thu, 12 Feb 2026 12:44:11 +0000
Subject: [PATCH 12/24] fix(auth): prevent redundant sign-in and avoid full
 session UI lock

---
 apps/desktop-main/src/oidc-service.ts         |  8 +++++
 .../auth-session-lab-page.html                |  6 ++--
 .../auth-session-lab/auth-session-lab-page.ts | 31 +++++++++++++------
 3 files changed, 33 insertions(+), 12 deletions(-)

diff --git a/apps/desktop-main/src/oidc-service.ts b/apps/desktop-main/src/oidc-service.ts
index 46ac823..2924644 100644
--- a/apps/desktop-main/src/oidc-service.ts
+++ b/apps/desktop-main/src/oidc-service.ts
@@ -161,6 +161,14 @@ export class OidcService {
   }
 
   async signIn(): Promise<DesktopResult<{ initiated: boolean }>> {
+    if (
+      this.summary.state === 'active' &&
+      this.tokens &&
+      Date.now() < this.tokens.accessTokenExpiresAt
+    ) {
+      return asSuccess({ initiated: false });
+    }
+
     if (this.signInInFlight) {
       return asFailure(
         'AUTH/SIGNIN_IN_PROGRESS',
diff --git a/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.html b/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.html
index d1496f7..01b6915 100644
--- a/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.html
+++ b/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.html
@@ -16,7 +16,7 @@
           mat-flat-button
           type="button"
           (click)="refreshSummary()"
-          [disabled]="loading()"
+          [disabled]="refreshPending() || signOutPending()"
         >
           Refresh Summary
         </button>
@@ -24,7 +24,7 @@
           mat-flat-button
           type="button"
           (click)="signIn()"
-          [disabled]="loading() || !desktopAvailable()"
+          [disabled]="signInPending() || !desktopAvailable() || isActive()"
         >
           Sign In
         </button>
@@ -32,7 +32,7 @@
           mat-stroked-button
           type="button"
           (click)="signOut()"
-          [disabled]="loading() || !desktopAvailable()"
+          [disabled]="signOutPending() || !desktopAvailable()"
         >
           Sign Out
         </button>
diff --git a/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.ts b/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.ts
index b7816d0..b8318d2 100644
--- a/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.ts
+++ b/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.ts
@@ -29,10 +29,13 @@ type StatusTone = 'info' | 'success' | 'warn' | 'error';
 })
 export class AuthSessionLabPage {
   readonly desktopAvailable = signal(!!getDesktopApi());
-  readonly loading = signal(false);
+  readonly signInPending = signal(false);
+  readonly refreshPending = signal(false);
+  readonly signOutPending = signal(false);
   readonly statusText = signal('Idle.');
   readonly statusTone = signal<StatusTone>('info');
   readonly summary = signal<AuthSessionSummary | null>(null);
+  readonly isActive = computed(() => this.summary()?.state === 'active');
   readonly scopes = computed(() => this.summary()?.scopes ?? []);
   readonly entitlements = computed(() => this.summary()?.entitlements ?? []);
 
@@ -44,7 +47,7 @@ export class AuthSessionLabPage {
       return;
     }
 
-    this.loading.set(true);
+    this.refreshPending.set(true);
     try {
       const result = await desktop.auth.getSessionSummary();
       if (!result.ok) {
@@ -57,7 +60,7 @@ export class AuthSessionLabPage {
       this.statusText.set(`Session state: ${result.data.state}`);
       this.statusTone.set(result.data.state === 'active' ? 'success' : 'info');
     } finally {
-      this.loading.set(false);
+      this.refreshPending.set(false);
     }
   }
 
@@ -69,7 +72,13 @@ export class AuthSessionLabPage {
       return;
     }
 
-    this.loading.set(true);
+    if (this.isActive()) {
+      this.statusText.set('Session is already active.');
+      this.statusTone.set('info');
+      return;
+    }
+
+    this.signInPending.set(true);
     try {
       const result = await desktop.auth.signIn();
       if (!result.ok) {
@@ -78,11 +87,15 @@ export class AuthSessionLabPage {
         return;
       }
 
-      this.statusText.set('Sign-in completed.');
-      this.statusTone.set('success');
+      this.statusText.set(
+        result.data.initiated
+          ? 'Sign-in completed.'
+          : 'Session is already active.',
+      );
+      this.statusTone.set(result.data.initiated ? 'success' : 'info');
       await this.refreshSummary();
     } finally {
-      this.loading.set(false);
+      this.signInPending.set(false);
     }
   }
 
@@ -94,7 +107,7 @@ export class AuthSessionLabPage {
       return;
     }
 
-    this.loading.set(true);
+    this.signOutPending.set(true);
     try {
       const result = await desktop.auth.signOut();
       if (!result.ok) {
@@ -107,7 +120,7 @@ export class AuthSessionLabPage {
       this.statusTone.set('info');
       await this.refreshSummary();
     } finally {
-      this.loading.set(false);
+      this.signOutPending.set(false);
     }
   }
 }

From 4c73ba965fd85308492c2b59df2e011dbf86738e Mon Sep 17 00:00:00 2001
From: Simon Hagger <simon.hagger@gmail.com>
Date: Thu, 12 Feb 2026 14:55:55 +0000
Subject: [PATCH 13/24] feat(auth): add token diagnostics IPC and dev-only
 session diagnostics UI

---
 apps/desktop-main/src/api-gateway.ts          | 134 +++++++++++++++++-
 apps/desktop-main/src/main.ts                 |  41 +++++-
 apps/desktop-main/src/oidc-config.spec.ts     |  27 ++++
 apps/desktop-main/src/oidc-config.ts          |  10 ++
 apps/desktop-main/src/oidc-service.ts         |  82 ++++++++++-
 apps/desktop-preload/src/main.ts              |  17 +++
 .../api-playground/api-playground-page.ts     |   7 +-
 .../auth-session-lab-page.css                 |   9 ++
 .../auth-session-lab-page.html                |  18 ++-
 .../auth-session-lab/auth-session-lab-page.ts |  71 ++++++++--
 .../desktop-api/src/lib/desktop-api.ts        |   4 +
 .../shared/contracts/src/lib/auth.contract.ts |  44 ++++++
 libs/shared/contracts/src/lib/channels.ts     |   1 +
 .../contracts/src/lib/contracts.spec.ts       |  29 ++++
 14 files changed, 469 insertions(+), 25 deletions(-)

diff --git a/apps/desktop-main/src/api-gateway.ts b/apps/desktop-main/src/api-gateway.ts
index f8ba083..16bc324 100644
--- a/apps/desktop-main/src/api-gateway.ts
+++ b/apps/desktop-main/src/api-gateway.ts
@@ -46,6 +46,16 @@ export const defaultApiOperations: Record<ApiOperationId, ApiOperation> = {
     minIntervalMs: 300,
     auth: { type: 'none' },
   },
+  'portfolio.user': {
+    method: 'GET',
+    url: 'https://api.adopa.uk/users/{{user_id}}/portfolio',
+    timeoutMs: 10_000,
+    maxResponseBytes: 1_000_000,
+    concurrencyLimit: 2,
+    minIntervalMs: 300,
+    auth: { type: 'oidc' },
+    retry: { maxAttempts: 2, baseDelayMs: 200 },
+  },
 };
 
 type InvokeApiDeps = {
@@ -152,6 +162,47 @@ const classifyTransportError = (
   );
 };
 
+const PATH_PARAM_PATTERN = /\{\{([a-zA-Z0-9_]+)\}\}/g;
+const ERROR_DETAIL_PREVIEW_MAX_CHARS = 512;
+
+const decodeJwtPayload = (token: string): Record<string, unknown> | null => {
+  const parts = token.split('.');
+  if (parts.length < 2) {
+    return null;
+  }
+
+  try {
+    const base64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64 + '='.repeat((4 - (base64.length % 4 || 4)) % 4);
+    const json = Buffer.from(padded, 'base64').toString('utf8');
+    return JSON.parse(json) as Record<string, unknown>;
+  } catch {
+    return null;
+  }
+};
+
+const pickTokenDebugClaims = (payload: Record<string, unknown> | null) => {
+  if (!payload) {
+    return null;
+  }
+
+  return {
+    iss: typeof payload.iss === 'string' ? payload.iss : undefined,
+    sub: typeof payload.sub === 'string' ? payload.sub : undefined,
+    aud: Array.isArray(payload.aud)
+      ? payload.aud.filter((value) => typeof value === 'string')
+      : typeof payload.aud === 'string'
+        ? payload.aud
+        : undefined,
+    azp: typeof payload.azp === 'string' ? payload.azp : undefined,
+    scope: typeof payload.scope === 'string' ? payload.scope : undefined,
+    exp: typeof payload.exp === 'number' ? payload.exp : undefined,
+    iat: typeof payload.iat === 'number' ? payload.iat : undefined,
+    token_use:
+      typeof payload.token_use === 'string' ? payload.token_use : undefined,
+  };
+};
+
 const isRetryableFailure = (code: string) =>
   [
     'API/TIMEOUT',
@@ -195,15 +246,67 @@ const invokeSingleAttempt = async (
   const timeoutMs = operation.timeoutMs ?? API_DEFAULT_TIMEOUT_MS;
   const maxResponseBytes =
     operation.maxResponseBytes ?? API_DEFAULT_MAX_RESPONSE_BYTES;
-  const requestUrl = new URL(operationUrl);
+  const providedParams = request.payload.params ?? {};
+  const usedPathParams = new Set<string>();
+  const templatedUrl = operation.url.replace(
+    PATH_PARAM_PATTERN,
+    (_match, rawParamName: string) => {
+      const paramName = String(rawParamName);
+      const paramValue = providedParams[paramName];
+      if (
+        typeof paramValue !== 'string' &&
+        typeof paramValue !== 'number' &&
+        typeof paramValue !== 'boolean'
+      ) {
+        usedPathParams.add(`__missing__${paramName}`);
+        return '';
+      }
+
+      usedPathParams.add(paramName);
+      return encodeURIComponent(String(paramValue));
+    },
+  );
+  const missingPathParams = Array.from(usedPathParams)
+    .filter((key) => key.startsWith('__missing__'))
+    .map((key) => key.replace('__missing__', ''));
+  if (missingPathParams.length > 0) {
+    return asFailure(
+      'API/INVALID_PARAMS',
+      'Required path parameters are missing for API operation.',
+      {
+        operationId: request.payload.operationId,
+        missingPathParams,
+      },
+      false,
+      correlationId,
+    );
+  }
+
+  let requestUrl: URL;
+  try {
+    requestUrl = new URL(templatedUrl);
+  } catch (error) {
+    return asFailure(
+      'API/OPERATION_CONFIG_INVALID',
+      'API operation configuration is invalid.',
+      error,
+      false,
+      correlationId,
+    );
+  }
   if (operation.method === 'GET' && request.payload.params) {
     for (const [key, value] of Object.entries(request.payload.params)) {
+      if (usedPathParams.has(key)) {
+        continue;
+      }
       requestUrl.searchParams.set(key, String(value));
     }
   }
 
   const headers = new Headers();
   headers.set('Accept', 'application/json');
+  const requestUrlString = requestUrl.toString();
+  let oidcTokenClaims: ReturnType<typeof pickTokenDebugClaims> | undefined;
 
   const auth = operation.auth ?? { type: 'none' as const };
   if (auth.type === 'bearer') {
@@ -239,6 +342,7 @@ const invokeSingleAttempt = async (
     }
 
     headers.set('Authorization', `Bearer ${token}`);
+    oidcTokenClaims = pickTokenDebugClaims(decodeJwtPayload(token));
   }
 
   const abortController = new AbortController();
@@ -298,12 +402,31 @@ const invokeSingleAttempt = async (
       );
     }
 
+    const contentType = response.headers.get('content-type') ?? undefined;
+
     if (!response.ok) {
+      const detailPreview =
+        responseText.length > ERROR_DETAIL_PREVIEW_MAX_CHARS
+          ? `${responseText.slice(0, ERROR_DETAIL_PREVIEW_MAX_CHARS)}...`
+          : responseText;
+      const failureDetails = {
+        operationId: request.payload.operationId,
+        requestUrl: requestUrlString,
+        status: response.status,
+        contentType,
+        hasAuthorizationHeader: headers.has('Authorization'),
+        tokenClaims: oidcTokenClaims,
+        detail:
+          detailPreview.length > 0
+            ? detailPreview
+            : 'No response body provided.',
+      };
+
       if (response.status === 401) {
         return asFailure(
           'API/AUTH_REQUIRED',
           'External API requires authentication.',
-          { operationId: request.payload.operationId, status: response.status },
+          failureDetails,
           false,
           correlationId,
         );
@@ -313,7 +436,7 @@ const invokeSingleAttempt = async (
         return asFailure(
           'API/FORBIDDEN',
           'External API request is forbidden by policy or credentials.',
-          { operationId: request.payload.operationId, status: response.status },
+          failureDetails,
           false,
           correlationId,
         );
@@ -333,7 +456,7 @@ const invokeSingleAttempt = async (
         return asFailure(
           'API/SERVER_ERROR',
           'External API returned a server error response.',
-          { operationId: request.payload.operationId, status: response.status },
+          failureDetails,
           true,
           correlationId,
         );
@@ -342,13 +465,12 @@ const invokeSingleAttempt = async (
       return asFailure(
         'API/CLIENT_ERROR',
         'External API returned a client error response.',
-        { operationId: request.payload.operationId, status: response.status },
+        failureDetails,
         false,
         correlationId,
       );
     }
 
-    const contentType = response.headers.get('content-type') ?? undefined;
     const isJsonContentType =
       typeof contentType === 'string' &&
       /^application\/([a-z0-9.+-]+\+)?json/i.test(contentType);
diff --git a/apps/desktop-main/src/main.ts b/apps/desktop-main/src/main.ts
index 41e728f..578975a 100644
--- a/apps/desktop-main/src/main.ts
+++ b/apps/desktop-main/src/main.ts
@@ -22,6 +22,7 @@ import { StorageGateway } from './storage-gateway';
 import {
   apiInvokeRequestSchema,
   authGetSessionSummaryRequestSchema,
+  authGetTokenDiagnosticsRequestSchema,
   authSignInRequestSchema,
   authSignOutRequestSchema,
   appVersionRequestSchema,
@@ -499,6 +500,44 @@ const registerIpcHandlers = () => {
     return oidcService.getSessionSummary();
   });
 
+  ipcMain.handle(IPC_CHANNELS.authGetTokenDiagnostics, (event, payload) => {
+    const correlationId = getCorrelationId(payload);
+    const unauthorized = assertAuthorizedSender(event, correlationId);
+    if (unauthorized) {
+      return unauthorized;
+    }
+
+    const parsed = authGetTokenDiagnosticsRequestSchema.safeParse(payload);
+    if (!parsed.success) {
+      return asFailure(
+        'IPC/VALIDATION_FAILED',
+        'IPC payload failed validation.',
+        parsed.error.flatten(),
+        false,
+        correlationId,
+      );
+    }
+
+    if (!oidcService) {
+      return asSuccess({
+        sessionState: 'signed-out' as const,
+        bearerSource: 'access_token' as const,
+        accessToken: {
+          present: false,
+          format: 'absent' as const,
+          claims: null,
+        },
+        idToken: {
+          present: false,
+          format: 'absent' as const,
+          claims: null,
+        },
+      });
+    }
+
+    return oidcService.getTokenDiagnostics();
+  });
+
   ipcMain.handle(IPC_CHANNELS.dialogOpenFile, async (event, payload) => {
     const correlationId = getCorrelationId(payload);
     const unauthorized = assertAuthorizedSender(event, correlationId);
@@ -849,7 +888,7 @@ const bootstrap = async () => {
         logEvent(level, event, undefined, details);
       },
     });
-    setOidcAccessTokenResolver(() => oidcService?.getAccessToken() ?? null);
+    setOidcAccessTokenResolver(() => oidcService?.getApiBearerToken() ?? null);
   } else {
     logEvent('info', 'auth.not_configured');
     setOidcAccessTokenResolver(null);
diff --git a/apps/desktop-main/src/oidc-config.spec.ts b/apps/desktop-main/src/oidc-config.spec.ts
index fab9a82..76827dc 100644
--- a/apps/desktop-main/src/oidc-config.spec.ts
+++ b/apps/desktop-main/src/oidc-config.spec.ts
@@ -22,9 +22,36 @@ describe('loadOidcConfig', () => {
       redirectUri: 'http://127.0.0.1:42813/callback',
       scopes: ['openid', 'profile', 'email'],
       audience: 'api://desktop',
+      sendAudienceInAuthorize: false,
+      apiBearerTokenSource: 'access_token',
     });
   });
 
+  it('enables audience on authorize when explicitly requested', () => {
+    const config = loadOidcConfig({
+      OIDC_ISSUER: 'https://issuer.example.com/',
+      OIDC_CLIENT_ID: 'desktop-client',
+      OIDC_REDIRECT_URI: 'http://127.0.0.1:42813/callback',
+      OIDC_SCOPES: 'openid profile email',
+      OIDC_AUDIENCE: 'api://desktop',
+      OIDC_SEND_AUDIENCE_IN_AUTHORIZE: '1',
+    });
+
+    expect(config?.sendAudienceInAuthorize).toBe(true);
+  });
+
+  it('can select id_token as API bearer source', () => {
+    const config = loadOidcConfig({
+      OIDC_ISSUER: 'https://issuer.example.com/',
+      OIDC_CLIENT_ID: 'desktop-client',
+      OIDC_REDIRECT_URI: 'http://127.0.0.1:42813/callback',
+      OIDC_SCOPES: 'openid profile email',
+      OIDC_API_BEARER_TOKEN_SOURCE: 'id_token',
+    });
+
+    expect(config?.apiBearerTokenSource).toBe('id_token');
+  });
+
   it('throws when required fields are missing', () => {
     expect(() =>
       loadOidcConfig({
diff --git a/apps/desktop-main/src/oidc-config.ts b/apps/desktop-main/src/oidc-config.ts
index 70e6450..8794c88 100644
--- a/apps/desktop-main/src/oidc-config.ts
+++ b/apps/desktop-main/src/oidc-config.ts
@@ -4,6 +4,8 @@ export type OidcConfig = {
   redirectUri: string;
   scopes: string[];
   audience?: string;
+  sendAudienceInAuthorize: boolean;
+  apiBearerTokenSource: 'access_token' | 'id_token';
 };
 
 const splitScopes = (value: string): string[] =>
@@ -20,6 +22,12 @@ export const loadOidcConfig = (
   const redirectUri = env.OIDC_REDIRECT_URI?.trim();
   const scopeValue = env.OIDC_SCOPES?.trim();
   const audience = env.OIDC_AUDIENCE?.trim();
+  const sendAudienceInAuthorize =
+    env.OIDC_SEND_AUDIENCE_IN_AUTHORIZE?.trim() === '1';
+  const apiBearerTokenSource =
+    env.OIDC_API_BEARER_TOKEN_SOURCE?.trim() === 'id_token'
+      ? 'id_token'
+      : 'access_token';
 
   if (!issuer && !clientId && !redirectUri && !scopeValue) {
     return null;
@@ -44,5 +52,7 @@ export const loadOidcConfig = (
     redirectUri,
     scopes,
     audience: audience && audience.length > 0 ? audience : undefined,
+    sendAudienceInAuthorize,
+    apiBearerTokenSource,
   };
 };
diff --git a/apps/desktop-main/src/oidc-service.ts b/apps/desktop-main/src/oidc-service.ts
index 2924644..9b0f1ce 100644
--- a/apps/desktop-main/src/oidc-service.ts
+++ b/apps/desktop-main/src/oidc-service.ts
@@ -4,6 +4,7 @@ import { URL } from 'node:url';
 import {
   asFailure,
   asSuccess,
+  type AuthGetTokenDiagnosticsResponse,
   type AuthSessionSummary,
   type DesktopResult,
 } from '@electron-foundation/contracts';
@@ -84,6 +85,32 @@ const decodeJwtPayload = (
   }
 };
 
+const pickJwtClaims = (
+  payload: Record<string, unknown> | null,
+): AuthGetTokenDiagnosticsResponse['accessToken']['claims'] => {
+  if (!payload) {
+    return null;
+  }
+
+  const audience = Array.isArray(payload.aud)
+    ? payload.aud.filter((value): value is string => typeof value === 'string')
+    : typeof payload.aud === 'string'
+      ? payload.aud
+      : undefined;
+
+  return {
+    iss: typeof payload.iss === 'string' ? payload.iss : undefined,
+    sub: typeof payload.sub === 'string' ? payload.sub : undefined,
+    aud: audience,
+    azp: typeof payload.azp === 'string' ? payload.azp : undefined,
+    scope: typeof payload.scope === 'string' ? payload.scope : undefined,
+    exp: typeof payload.exp === 'number' ? payload.exp : undefined,
+    iat: typeof payload.iat === 'number' ? payload.iat : undefined,
+    token_use:
+      typeof payload.token_use === 'string' ? payload.token_use : undefined,
+  };
+};
+
 const parseScopeList = (scopeValue: string | undefined): string[] =>
   (scopeValue ?? '')
     .split(/\s+/)
@@ -214,7 +241,7 @@ export class OidcService {
       authorizationUrl.searchParams.set('nonce', nonce);
       authorizationUrl.searchParams.set('code_challenge', challenge);
       authorizationUrl.searchParams.set('code_challenge_method', 'S256');
-      if (this.config.audience) {
+      if (this.config.audience && this.config.sendAudienceInAuthorize) {
         authorizationUrl.searchParams.set('audience', this.config.audience);
       }
 
@@ -251,16 +278,18 @@ export class OidcService {
       });
       return asSuccess({ initiated: true });
     } catch (error) {
+      const errorMessage =
+        error instanceof Error ? error.message : String(error);
       this.summary = buildSignedOutSummary();
       this.logger?.('error', 'auth.signin.failed', {
-        message: error instanceof Error ? error.message : String(error),
+        message: errorMessage,
       });
       return asFailure(
         'AUTH/SIGNIN_FAILED',
-        'Authentication sign-in failed.',
+        `Authentication sign-in failed: ${errorMessage}`,
         error instanceof Error
           ? { name: error.name, message: error.message }
-          : String(error),
+          : errorMessage,
         true,
       );
     } finally {
@@ -303,7 +332,46 @@ export class OidcService {
     return asSuccess(this.summary);
   }
 
-  getAccessToken(): string | null {
+  async getTokenDiagnostics(): Promise<
+    DesktopResult<AuthGetTokenDiagnosticsResponse>
+  > {
+    const describeToken = (
+      token: string | undefined,
+    ): AuthGetTokenDiagnosticsResponse['accessToken'] => {
+      if (!token) {
+        return {
+          present: false,
+          format: 'absent',
+          claims: null,
+        };
+      }
+
+      const claims = pickJwtClaims(decodeJwtPayload(token));
+      if (claims) {
+        return {
+          present: true,
+          format: 'jwt',
+          claims,
+        };
+      }
+
+      return {
+        present: true,
+        format: 'opaque',
+        claims: null,
+      };
+    };
+
+    return asSuccess({
+      sessionState: this.summary.state,
+      bearerSource: this.config.apiBearerTokenSource,
+      expectedAudience: this.config.audience,
+      accessToken: describeToken(this.tokens?.accessToken),
+      idToken: describeToken(this.tokens?.idToken),
+    });
+  }
+
+  getApiBearerToken(): string | null {
     if (!this.tokens) {
       return null;
     }
@@ -312,6 +380,10 @@ export class OidcService {
       return null;
     }
 
+    if (this.config.apiBearerTokenSource === 'id_token') {
+      return this.tokens.idToken ?? null;
+    }
+
     return this.tokens.accessToken;
   }
 
diff --git a/apps/desktop-preload/src/main.ts b/apps/desktop-preload/src/main.ts
index 6d379a5..c193092 100644
--- a/apps/desktop-preload/src/main.ts
+++ b/apps/desktop-preload/src/main.ts
@@ -7,6 +7,8 @@ import {
   apiInvokeResponseSchema,
   authGetSessionSummaryRequestSchema,
   authGetSessionSummaryResponseSchema,
+  authGetTokenDiagnosticsRequestSchema,
+  authGetTokenDiagnosticsResponseSchema,
   authSignInRequestSchema,
   authSignInResponseSchema,
   authSignOutRequestSchema,
@@ -245,6 +247,21 @@ const desktopApi: DesktopApi = {
         authGetSessionSummaryResponseSchema,
       );
     },
+    async getTokenDiagnostics() {
+      const correlationId = createCorrelationId();
+      const request = authGetTokenDiagnosticsRequestSchema.parse({
+        contractVersion: CONTRACT_VERSION,
+        correlationId,
+        payload: {},
+      });
+
+      return invoke(
+        IPC_CHANNELS.authGetTokenDiagnostics,
+        request,
+        correlationId,
+        authGetTokenDiagnosticsResponseSchema,
+      );
+    },
   },
   dialog: {
     async openFile(request = {}) {
diff --git a/apps/renderer/src/app/features/api-playground/api-playground-page.ts b/apps/renderer/src/app/features/api-playground/api-playground-page.ts
index df3e28f..a6ea38a 100644
--- a/apps/renderer/src/app/features/api-playground/api-playground-page.ts
+++ b/apps/renderer/src/app/features/api-playground/api-playground-page.ts
@@ -32,10 +32,8 @@ import { getDesktopApi } from '@electron-foundation/desktop-api';
 export class ApiPlaygroundPage {
   readonly desktopAvailable = signal(!!getDesktopApi());
   readonly operations = API_OPERATION_IDS;
-  readonly operation = signal<ApiOperationId>(API_OPERATION_IDS[0]);
-  readonly paramsText = signal(
-    '{\n  "owner": "simonhagger",\n  "repo": "angulectron"\n}',
-  );
+  readonly operation = signal<ApiOperationId>('portfolio.user');
+  readonly paramsText = signal('{\n  "user_id": "me"\n}');
   readonly requestState = signal('Idle.');
   readonly responseStatus = signal<number | null>(null);
   readonly responseBody = signal('');
@@ -62,6 +60,7 @@ export class ApiPlaygroundPage {
     const response = await desktop.api.invoke(this.operation(), parsedParams);
     if (!response.ok) {
       this.requestState.set(response.error.message);
+      this.responseBody.set(this.pretty(response.error.details ?? {}));
       return;
     }
 
diff --git a/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.css b/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.css
index 04cfe60..4e5ac2b 100644
--- a/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.css
+++ b/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.css
@@ -45,3 +45,12 @@
   opacity: 0.75;
   margin: 0.25rem 0 0.5rem;
 }
+
+.diagnostics-json {
+  margin: 0;
+  padding: 0.75rem;
+  background: #f4f4f4;
+  border: 1px solid #d0d0d0;
+  border-radius: 0;
+  overflow: auto;
+}
diff --git a/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.html b/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.html
index 01b6915..1675247 100644
--- a/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.html
+++ b/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.html
@@ -24,7 +24,7 @@
           mat-flat-button
           type="button"
           (click)="signIn()"
-          [disabled]="signInPending() || !desktopAvailable() || isActive()"
+          [disabled]="!desktopAvailable() || isActive()"
         >
           Sign In
         </button>
@@ -90,4 +90,20 @@ <h3>Entitlements</h3>
       </div>
     </mat-card-content>
   </mat-card>
+
+  @if (showTokenDiagnostics()) {
+  <mat-card>
+    <mat-card-title>Token Diagnostics</mat-card-title>
+    <mat-card-content>
+      @if (tokenDiagnostics()) {
+      <p class="muted">
+        Safe diagnostics only. Token values are not exposed to renderer.
+      </p>
+      <pre class="diagnostics-json">{{ tokenDiagnosticsJson() }}</pre>
+      } @else {
+      <p class="muted">No token diagnostics loaded yet.</p>
+      }
+    </mat-card-content>
+  </mat-card>
+  }
 </section>
diff --git a/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.ts b/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.ts
index b8318d2..d2776d4 100644
--- a/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.ts
+++ b/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.ts
@@ -2,6 +2,7 @@ import {
   ChangeDetectionStrategy,
   Component,
   computed,
+  isDevMode,
   signal,
 } from '@angular/core';
 import { CommonModule } from '@angular/common';
@@ -9,10 +10,14 @@ import { MatCardModule } from '@angular/material/card';
 import { MatButtonModule } from '@angular/material/button';
 import { MatChipsModule } from '@angular/material/chips';
 import { MatIconModule } from '@angular/material/icon';
-import type { AuthSessionSummary } from '@electron-foundation/contracts';
+import type {
+  AuthGetTokenDiagnosticsResponse,
+  AuthSessionSummary,
+} from '@electron-foundation/contracts';
 import { getDesktopApi } from '@electron-foundation/desktop-api';
 
 type StatusTone = 'info' | 'success' | 'warn' | 'error';
+const signInUiPendingMaxMs = 2_000;
 
 @Component({
   selector: 'app-auth-session-lab-page',
@@ -28,6 +33,7 @@ type StatusTone = 'info' | 'success' | 'warn' | 'error';
   changeDetection: ChangeDetectionStrategy.OnPush,
 })
 export class AuthSessionLabPage {
+  readonly showTokenDiagnostics = signal(isDevMode());
   readonly desktopAvailable = signal(!!getDesktopApi());
   readonly signInPending = signal(false);
   readonly refreshPending = signal(false);
@@ -35,6 +41,17 @@ export class AuthSessionLabPage {
   readonly statusText = signal('Idle.');
   readonly statusTone = signal<StatusTone>('info');
   readonly summary = signal<AuthSessionSummary | null>(null);
+  readonly tokenDiagnostics = signal<AuthGetTokenDiagnosticsResponse | null>(
+    null,
+  );
+  readonly tokenDiagnosticsJson = computed(() => {
+    const diagnostics = this.tokenDiagnostics();
+    if (!diagnostics) {
+      return '';
+    }
+
+    return JSON.stringify(diagnostics, null, 2);
+  });
   readonly isActive = computed(() => this.summary()?.state === 'active');
   readonly scopes = computed(() => this.summary()?.scopes ?? []);
   readonly entitlements = computed(() => this.summary()?.entitlements ?? []);
@@ -49,16 +66,28 @@ export class AuthSessionLabPage {
 
     this.refreshPending.set(true);
     try {
-      const result = await desktop.auth.getSessionSummary();
-      if (!result.ok) {
-        this.statusText.set(result.error.message);
+      const [summaryResult, diagnosticsResult] = await Promise.all([
+        desktop.auth.getSessionSummary(),
+        this.showTokenDiagnostics()
+          ? desktop.auth.getTokenDiagnostics()
+          : Promise.resolve(null),
+      ]);
+      if (!summaryResult.ok) {
+        this.statusText.set(summaryResult.error.message);
         this.statusTone.set('error');
         return;
       }
 
-      this.summary.set(result.data);
-      this.statusText.set(`Session state: ${result.data.state}`);
-      this.statusTone.set(result.data.state === 'active' ? 'success' : 'info');
+      this.summary.set(summaryResult.data);
+      if (diagnosticsResult && diagnosticsResult.ok) {
+        this.tokenDiagnostics.set(diagnosticsResult.data);
+      } else {
+        this.tokenDiagnostics.set(null);
+      }
+      this.statusText.set(`Session state: ${summaryResult.data.state}`);
+      this.statusTone.set(
+        summaryResult.data.state === 'active' ? 'success' : 'info',
+      );
     } finally {
       this.refreshPending.set(false);
     }
@@ -78,9 +107,34 @@ export class AuthSessionLabPage {
       return;
     }
 
+    if (this.signInPending()) {
+      this.statusText.set(
+        'Sign-in is already in progress. Complete it in the browser window or retry shortly.',
+      );
+      this.statusTone.set('info');
+      return;
+    }
+
     this.signInPending.set(true);
+    let uiPendingReleased = false;
+    const releaseUiPending = () => {
+      if (uiPendingReleased) {
+        return;
+      }
+      uiPendingReleased = true;
+      this.signInPending.set(false);
+    };
+    const uiTimeoutHandle = setTimeout(() => {
+      releaseUiPending();
+      this.statusText.set(
+        'Continue sign-in in the browser window. You can retry now or refresh summary after completion.',
+      );
+      this.statusTone.set('info');
+    }, signInUiPendingMaxMs);
+
     try {
       const result = await desktop.auth.signIn();
+      clearTimeout(uiTimeoutHandle);
       if (!result.ok) {
         this.statusText.set(result.error.message);
         this.statusTone.set('error');
@@ -95,7 +149,8 @@ export class AuthSessionLabPage {
       this.statusTone.set(result.data.initiated ? 'success' : 'info');
       await this.refreshSummary();
     } finally {
-      this.signInPending.set(false);
+      clearTimeout(uiTimeoutHandle);
+      releaseUiPending();
     }
   }
 
diff --git a/libs/platform/desktop-api/src/lib/desktop-api.ts b/libs/platform/desktop-api/src/lib/desktop-api.ts
index ad7391f..f331992 100644
--- a/libs/platform/desktop-api/src/lib/desktop-api.ts
+++ b/libs/platform/desktop-api/src/lib/desktop-api.ts
@@ -1,5 +1,6 @@
 import type {
   ApiOperationId,
+  AuthGetTokenDiagnosticsResponse,
   AuthSessionSummary,
   ContractVersion,
   DesktopResult,
@@ -23,6 +24,9 @@ export interface DesktopAuthApi {
   signIn: () => Promise<DesktopResult<{ initiated: boolean }>>;
   signOut: () => Promise<DesktopResult<{ signedOut: boolean }>>;
   getSessionSummary: () => Promise<DesktopResult<AuthSessionSummary>>;
+  getTokenDiagnostics: () => Promise<
+    DesktopResult<AuthGetTokenDiagnosticsResponse>
+  >;
 }
 
 export interface DesktopFsApi {
diff --git a/libs/shared/contracts/src/lib/auth.contract.ts b/libs/shared/contracts/src/lib/auth.contract.ts
index f524353..c96bc26 100644
--- a/libs/shared/contracts/src/lib/auth.contract.ts
+++ b/libs/shared/contracts/src/lib/auth.contract.ts
@@ -38,6 +38,44 @@ export const authGetSessionSummaryRequestSchema =
   requestEnvelope(emptyPayloadSchema);
 export const authGetSessionSummaryResponseSchema = authSessionSummarySchema;
 
+const authTokenAudienceSchema = z.union([
+  z.string().min(1),
+  z.array(z.string().min(1)),
+]);
+
+const authTokenClaimsSchema = z
+  .object({
+    iss: z.string().min(1).optional(),
+    sub: z.string().min(1).optional(),
+    aud: authTokenAudienceSchema.optional(),
+    azp: z.string().min(1).optional(),
+    scope: z.string().min(1).optional(),
+    exp: z.number().int().optional(),
+    iat: z.number().int().optional(),
+    token_use: z.string().min(1).optional(),
+  })
+  .strict();
+
+const authTokenDiagnosticSchema = z
+  .object({
+    present: z.boolean(),
+    format: z.enum(['absent', 'jwt', 'opaque']),
+    claims: authTokenClaimsSchema.nullable(),
+  })
+  .strict();
+
+export const authGetTokenDiagnosticsRequestSchema =
+  requestEnvelope(emptyPayloadSchema);
+export const authGetTokenDiagnosticsResponseSchema = z
+  .object({
+    sessionState: authSessionStateSchema,
+    bearerSource: z.enum(['access_token', 'id_token']),
+    expectedAudience: z.string().min(1).optional(),
+    accessToken: authTokenDiagnosticSchema,
+    idToken: authTokenDiagnosticSchema,
+  })
+  .strict();
+
 export type AuthSessionState = z.infer<typeof authSessionStateSchema>;
 export type AuthSessionSummary = z.infer<typeof authSessionSummarySchema>;
 export type AuthSignInRequest = z.infer<typeof authSignInRequestSchema>;
@@ -50,3 +88,9 @@ export type AuthGetSessionSummaryRequest = z.infer<
 export type AuthGetSessionSummaryResponse = z.infer<
   typeof authGetSessionSummaryResponseSchema
 >;
+export type AuthGetTokenDiagnosticsRequest = z.infer<
+  typeof authGetTokenDiagnosticsRequestSchema
+>;
+export type AuthGetTokenDiagnosticsResponse = z.infer<
+  typeof authGetTokenDiagnosticsResponseSchema
+>;
diff --git a/libs/shared/contracts/src/lib/channels.ts b/libs/shared/contracts/src/lib/channels.ts
index e41044b..674d124 100644
--- a/libs/shared/contracts/src/lib/channels.ts
+++ b/libs/shared/contracts/src/lib/channels.ts
@@ -4,6 +4,7 @@ export const IPC_CHANNELS = {
   authSignIn: 'auth:sign-in',
   authSignOut: 'auth:sign-out',
   authGetSessionSummary: 'auth:get-session-summary',
+  authGetTokenDiagnostics: 'auth:get-token-diagnostics',
   dialogOpenFile: 'dialog:open-file',
   fsReadTextFile: 'fs:read-text-file',
   storageSetItem: 'storage:set-item',
diff --git a/libs/shared/contracts/src/lib/contracts.spec.ts b/libs/shared/contracts/src/lib/contracts.spec.ts
index 35f1bf6..1e54a63 100644
--- a/libs/shared/contracts/src/lib/contracts.spec.ts
+++ b/libs/shared/contracts/src/lib/contracts.spec.ts
@@ -2,6 +2,7 @@ import { z } from 'zod';
 import { parseOrFailure } from './contracts';
 import { apiInvokeRequestSchema } from './api.contract';
 import {
+  authGetTokenDiagnosticsResponseSchema,
   authGetSessionSummaryResponseSchema,
   authSignInRequestSchema,
 } from './auth.contract';
@@ -173,4 +174,32 @@ describe('auth contracts', () => {
 
     expect(parsed.success).toBe(false);
   });
+
+  it('accepts token diagnostics payloads', () => {
+    const parsed = authGetTokenDiagnosticsResponseSchema.safeParse({
+      sessionState: 'active',
+      bearerSource: 'access_token',
+      expectedAudience: 'api.adopa.uk',
+      accessToken: {
+        present: true,
+        format: 'jwt',
+        claims: {
+          iss: 'https://willing-elephant-20.clerk.accounts.dev',
+          sub: 'user_abc',
+          aud: ['api.adopa.uk'],
+          exp: 1770903664,
+          iat: 1770900000,
+        },
+      },
+      idToken: {
+        present: true,
+        format: 'jwt',
+        claims: {
+          aud: 'TOtjISa3Sgz2sDi2',
+        },
+      },
+    });
+
+    expect(parsed.success).toBe(true);
+  });
 });

From daedb847d834904aa591d1429d53f1e44c22dd25 Mon Sep 17 00:00:00 2001
From: Simon Hagger <simon.hagger@gmail.com>
Date: Thu, 12 Feb 2026 14:56:18 +0000
Subject: [PATCH 14/24] docs(security): track temporary audience compatibility
 and sanitize identifiers

---
 .env.example                            |   6 +-
 README.md                               |   8 +
 docs/05-governance/backlog.md           |  30 ++--
 docs/05-governance/oidc-auth-backlog.md | 226 ++++++++++++++++++++++++
 4 files changed, 254 insertions(+), 16 deletions(-)
 create mode 100644 docs/05-governance/oidc-auth-backlog.md

diff --git a/.env.example b/.env.example
index cbab68f..465af3c 100644
--- a/.env.example
+++ b/.env.example
@@ -4,6 +4,8 @@ OIDC_ISSUER=https://your-issuer.example.com
 OIDC_CLIENT_ID=your-client-id
 OIDC_REDIRECT_URI=http://127.0.0.1:42813/callback
 OIDC_SCOPES=openid profile email offline_access
+OIDC_AUDIENCE=your-api-audience
 # Optional:
-# OIDC_AUDIENCE=your-api-audience
-# OIDC_ALLOW_INSECURE_TOKEN_STORAGE=1
+# OIDC_SEND_AUDIENCE_IN_AUTHORIZE=1
+# OIDC_API_BEARER_TOKEN_SOURCE=access_token
+# OIDC_ALLOW_INSECURE_TOKEN_STORAGE=1
\ No newline at end of file
diff --git a/README.md b/README.md
index 6b136ab..b1203e3 100644
--- a/README.md
+++ b/README.md
@@ -119,6 +119,14 @@ Runtime behavior:
 - Renderer can only call `desktop.auth.signIn()`, `desktop.auth.signOut()`, and `desktop.auth.getSessionSummary()`.
 - Access token attachment for secured API operations occurs in main process only.
 
+Temporary compatibility note:
+
+- Current Clerk OAuth flow may issue JWT access tokens without API `aud` claim in this tenant.
+- AWS JWT authorizer is temporarily configured to accept both:
+  - API audience (`YOUR_API_AUDIENCE`)
+  - OAuth client id (`YOUR_OAUTH_CLIENT_ID`)
+- This is tracked for removal in `docs/05-governance/backlog.md` (`BL-014`) and `docs/05-governance/oidc-auth-backlog.md`.
+
 ## Repository Layout
 
 Top-level:
diff --git a/docs/05-governance/backlog.md b/docs/05-governance/backlog.md
index 43690a4..4ad352c 100644
--- a/docs/05-governance/backlog.md
+++ b/docs/05-governance/backlog.md
@@ -4,20 +4,22 @@ Owner: Platform Engineering
 Review cadence: Weekly  
 Last reviewed: 2026-02-08
 
-| ID     | Title                                             | Status   | Priority | Area                    | Source        | Owner    | Notes                                                                                        |
-| ------ | ------------------------------------------------- | -------- | -------- | ----------------------- | ------------- | -------- | -------------------------------------------------------------------------------------------- |
-| BL-001 | Linux packaging strategy for desktop              | Deferred | Low      | Delivery + Packaging    | FEEDBACK.md   | Platform | Add Electron Forge Linux makers and release notes once Linux is in scope.                    |
-| BL-002 | Enforce handshake contract-version mismatch path  | Planned  | Medium   | IPC Contracts           | FEEDBACK.md   | Platform | Main process currently validates schema but does not return a dedicated mismatch error.      |
-| BL-003 | API operation compile-time typing hardening       | Planned  | Medium   | Platform API            | FR-APIs.md    | Platform | Move from mostly string-based operation references to stricter compile-time typing.          |
-| BL-004 | Enterprise proxy/TLS support matrix documentation | Deferred | Low      | Security + Networking   | FR-APIs.md    | Platform | Document expected behaviors for proxy auth, TLS interception, and certificate errors.        |
-| BL-005 | Offline API queue/replay capability               | Proposed | Medium   | Platform API            | FR-APIs.md    | Platform | Current behavior is fail-fast + retry classification; queue/replay not implemented.          |
-| BL-006 | Storage capability-scoped authorization model     | Proposed | Medium   | Storage + Security      | FR-Storage.md | Platform | Add explicit capability/role rules per storage operation.                                    |
-| BL-007 | Expanded data-classification tiers                | Deferred | Low      | Storage + Governance    | FR-Storage.md | Platform | Add `public`, `secret`, and `high-value secret` tiers beyond current baseline.               |
-| BL-008 | Local Vault phase-2 implementation                | Proposed | Medium   | Storage + Security      | FR-Storage.md | Platform | Separate higher-assurance vault capability remains unimplemented.                            |
-| BL-009 | Storage recovery UX flows                         | Proposed | Medium   | UX + Reliability        | FR-Storage.md | Frontend | Build user-facing reset/repair/recovery workflow for storage failures.                       |
-| BL-010 | Renderer structured logging adoption              | Proposed | Medium   | Observability           | TASK.md       | Frontend | Apply shared structured logs in renderer with IPC correlation IDs for key user flows.        |
-| BL-011 | Failure UX pattern implementation                 | Planned  | Medium   | UX + Reliability        | TASK.md       | Frontend | Implement documented toast/dialog/inline/offline patterns consistently across features.      |
-| BL-012 | IPC real-handler contract harness expansion       | Proposed | Medium   | Testing + IPC Contracts | TASK.md       | Platform | Extend contract tests to execute preload/main handlers incl. timeout and correlation checks. |
+| ID     | Title                                                            | Status   | Priority | Area                    | Source           | Owner               | Notes                                                                                                                                                                                                       |
+| ------ | ---------------------------------------------------------------- | -------- | -------- | ----------------------- | ---------------- | ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| BL-001 | Linux packaging strategy for desktop                             | Deferred | Low      | Delivery + Packaging    | FEEDBACK.md      | Platform            | Add Electron Forge Linux makers and release notes once Linux is in scope.                                                                                                                                   |
+| BL-002 | Enforce handshake contract-version mismatch path                 | Planned  | Medium   | IPC Contracts           | FEEDBACK.md      | Platform            | Main process currently validates schema but does not return a dedicated mismatch error.                                                                                                                     |
+| BL-003 | API operation compile-time typing hardening                      | Planned  | Medium   | Platform API            | FR-APIs.md       | Platform            | Move from mostly string-based operation references to stricter compile-time typing.                                                                                                                         |
+| BL-004 | Enterprise proxy/TLS support matrix documentation                | Deferred | Low      | Security + Networking   | FR-APIs.md       | Platform            | Document expected behaviors for proxy auth, TLS interception, and certificate errors.                                                                                                                       |
+| BL-005 | Offline API queue/replay capability                              | Proposed | Medium   | Platform API            | FR-APIs.md       | Platform            | Current behavior is fail-fast + retry classification; queue/replay not implemented.                                                                                                                         |
+| BL-006 | Storage capability-scoped authorization model                    | Proposed | Medium   | Storage + Security      | FR-Storage.md    | Platform            | Add explicit capability/role rules per storage operation.                                                                                                                                                   |
+| BL-007 | Expanded data-classification tiers                               | Deferred | Low      | Storage + Governance    | FR-Storage.md    | Platform            | Add `public`, `secret`, and `high-value secret` tiers beyond current baseline.                                                                                                                              |
+| BL-008 | Local Vault phase-2 implementation                               | Proposed | Medium   | Storage + Security      | FR-Storage.md    | Platform            | Separate higher-assurance vault capability remains unimplemented.                                                                                                                                           |
+| BL-009 | Storage recovery UX flows                                        | Proposed | Medium   | UX + Reliability        | FR-Storage.md    | Frontend            | Build user-facing reset/repair/recovery workflow for storage failures.                                                                                                                                      |
+| BL-010 | Renderer structured logging adoption                             | Proposed | Medium   | Observability           | TASK.md          | Frontend            | Apply shared structured logs in renderer with IPC correlation IDs for key user flows.                                                                                                                       |
+| BL-011 | Failure UX pattern implementation                                | Planned  | Medium   | UX + Reliability        | TASK.md          | Frontend            | Implement documented toast/dialog/inline/offline patterns consistently across features.                                                                                                                     |
+| BL-012 | IPC real-handler contract harness expansion                      | Proposed | Medium   | Testing + IPC Contracts | TASK.md          | Platform            | Extend contract tests to execute preload/main handlers incl. timeout and correlation checks.                                                                                                                |
+| BL-013 | OIDC auth platform (desktop PKCE + secure IPC)                   | Planned  | High     | Security + Identity     | TASK.md          | Platform            | Phased backlog and acceptance tests tracked in `docs/05-governance/oidc-auth-backlog.md`.                                                                                                                   |
+| BL-014 | Remove temporary JWT-authorizer client-id audience compatibility | Planned  | High     | Security + Identity     | OIDC integration | Platform + Security | Clerk OAuth access token currently omits `aud`; AWS authorizer temporarily allows both `YOUR_API_AUDIENCE` and OAuth client id. Remove client-id audience once Clerk emits API audience/scopes as required. |
 
 ## Status Definitions
 
diff --git a/docs/05-governance/oidc-auth-backlog.md b/docs/05-governance/oidc-auth-backlog.md
new file mode 100644
index 0000000..9e01394
--- /dev/null
+++ b/docs/05-governance/oidc-auth-backlog.md
@@ -0,0 +1,226 @@
+# OIDC Authentication Backlog (Desktop)
+
+Owner: Platform Engineering + Security  
+Review cadence: Weekly  
+Last reviewed: 2026-02-12  
+Source: `TASK.md`
+
+## Objective
+
+Implement OpenID Connect authentication for the Electron desktop app using Authorization Code + PKCE, with secure token handling in main process and a minimized renderer API surface.
+
+## Scope
+
+In scope:
+
+- Desktop-side OIDC flow, token lifecycle, secure storage, and IPC/preload contracts.
+- Renderer session summary and entitlement-aware UX.
+- Config-driven IdP swap support (Clerk now, Cognito-ready).
+
+Out of scope in this repo:
+
+- Backend JWT verification implementation details (tracked in backend repo/workstream).
+
+## Architecture Constraints
+
+- Refresh tokens must never be exposed to renderer.
+- PKCE and token exchange run in main process only.
+- Renderer receives session summary and entitlement view, not raw secrets.
+- Access tokens are attached in main-process API proxy by default.
+
+## Phased Plan
+
+## Phase 0: Design Decisions and Threat Model
+
+Status: Planned  
+Priority: High
+
+Tasks:
+
+- Confirm redirect strategy (`loopback` preferred, `custom protocol` fallback).
+- Define auth state machine (signed-out, signing-in, active, refresh-failed, signed-out-expired).
+- Document token data classification and retention periods.
+- Record ADR for OIDC integration boundaries and IdP abstraction.
+
+Acceptance tests:
+
+- ADR merged and linked from decision log.
+- Threat model delta documented for auth/refresh/IPC abuse cases.
+- Security sign-off recorded in PR checklist.
+
+## Phase 1: Contracts and IPC Surface
+
+Status: Planned  
+Priority: High
+
+Tasks:
+
+- Add `auth` request/response contracts in `libs/shared/contracts`.
+- Add IPC channels for:
+  - `auth.signIn`
+  - `auth.signOut`
+  - `auth.getSessionSummary`
+- Add preload bridge methods under `desktop.auth.*` with strict schema validation.
+
+Acceptance tests:
+
+- Contract unit tests pass for valid/invalid payloads.
+- Main rejects unauthorized sender and malformed auth envelopes.
+- Preload rejects schema-invalid payloads/responses.
+
+### Phase 1 PR-Sized Execution Plan
+
+| Ticket ID | Scope                                                                                                                                                       | Depends On         | Validation                                                          |
+| --------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ | ------------------------------------------------------------------- |
+| OIDC-001  | Add `auth.contract.ts` schemas and export wiring in `libs/shared/contracts` (requests, responses, session summary)                                          | None               | `pnpm nx test shared-contracts` and `pnpm nx lint shared-contracts` |
+| OIDC-002  | Add IPC channel constants and main handler stubs (`authSignIn`, `authSignOut`, `authGetSessionSummary`) returning deterministic `NOT_IMPLEMENTED` envelopes | OIDC-001           | `pnpm nx test desktop-main` and `pnpm nx lint desktop-main`         |
+| OIDC-003  | Add preload bridge API `desktop.auth.*` with Zod validation and typed invoke wrappers                                                                       | OIDC-001, OIDC-002 | `pnpm nx test desktop-preload` and `pnpm nx lint desktop-preload`   |
+| OIDC-004  | Add renderer-side typed auth facade service (no UI yet), consuming only `desktop.auth.*`                                                                    | OIDC-003           | `pnpm nx test renderer` and `pnpm nx lint renderer`                 |
+| OIDC-005  | Add integration tests for unauthorized sender rejection and schema-invalid payload rejection across preload/main boundary                                   | OIDC-002, OIDC-003 | `pnpm nx run-many -t test --projects=desktop-main,desktop-preload`  |
+| OIDC-006  | Add temporary diagnostics page route for manual auth stub verification (calls sign in/out/get summary and surfaces envelopes)                               | OIDC-004           | `pnpm nx run renderer:build` and desktop smoke launch               |
+
+Merge order:
+
+1. OIDC-001
+2. OIDC-002
+3. OIDC-003
+4. OIDC-004
+5. OIDC-005
+6. OIDC-006
+
+Definition of done for Phase 1:
+
+- All six tickets merged through PR workflow.
+- `pnpm ci:local` passes with no new warnings.
+- No raw token fields present in preload/renderer models.
+- Security checklist included in each PR body.
+
+## Phase 2: OIDC Discovery + PKCE Sign-In
+
+Status: Planned  
+Priority: High
+
+Tasks:
+
+- Implement OIDC discovery (`.well-known/openid-configuration`).
+- Implement PKCE verifier/challenge generation and in-memory verifier tracking.
+- Launch system browser for authorization URL.
+- Handle callback and code exchange in main process.
+
+Acceptance tests:
+
+- Discovery fails safely with deterministic error envelope.
+- PKCE values meet RFC constraints (length/entropy/challenge method S256).
+- End-to-end sign-in returns active session summary without exposing tokens to renderer.
+
+## Phase 3: Token Lifecycle + Secure Storage
+
+Status: Planned  
+Priority: High
+
+Tasks:
+
+- Persist refresh token in OS secure storage abstraction (Windows Credential Manager implementation first).
+- Keep access token in memory with expiry metadata.
+- Implement proactive refresh and refresh-failure fallback to signed-out state.
+- Implement sign-out revocation/cleanup behavior where IdP supports it.
+
+Acceptance tests:
+
+- Refresh token not found in renderer memory snapshots or logs.
+- Refresh runs before expiry and updates session summary.
+- Expired/invalid refresh token transitions to signed-out and clears storage.
+
+## Phase 4: API Authorization Path
+
+Status: Planned  
+Priority: High
+
+Tasks:
+
+- Extend main-process API gateway to attach `Authorization: Bearer <access_token>` for secured operations.
+- Classify auth failures (`401/403`) and map to app-level failure policies.
+- Keep renderer direct-token access disabled by default.
+
+Acceptance tests:
+
+- Secured operation includes bearer token only when session is active.
+- Missing/expired token returns auth classification, not generic failure.
+- No token value appears in telemetry/event logs.
+
+## Phase 5: Renderer Session UX
+
+Status: Planned  
+Priority: Medium
+
+Tasks:
+
+- Add session store in renderer (signals-based).
+- Implement sign-in/sign-out controls and session status display.
+- Apply entitlement/claim-driven soft gating in UI.
+- Add user-safe failure messages for auth/network/timeout paths.
+
+Acceptance tests:
+
+- Renderer can render signed-in summary (name/email/expiry) from preload only.
+- UI gates respond to entitlement model without trusting client for enforcement.
+- Auth failure states are recoverable and non-blocking for app shell.
+
+## Phase 6: Config-Driven IdP Swap
+
+Status: Planned  
+Priority: Medium
+
+Tasks:
+
+- Add centralized auth config:
+  - `OIDC_ISSUER`
+  - `OIDC_CLIENT_ID`
+  - `OIDC_REDIRECT_URI`
+  - `OIDC_SCOPES`
+  - `OIDC_AUDIENCE`
+- Validate config on startup with explicit failure classification.
+- Document Clerk baseline and Cognito migration mapping.
+
+Acceptance tests:
+
+- App fails fast with actionable diagnostics for invalid/missing OIDC config.
+- Same code path works with two config fixtures (Clerk-like and Cognito-like metadata).
+- No code changes required to switch provider in local environment.
+
+## Phase 7: Test + CI Hardening
+
+Status: Planned  
+Priority: High
+
+Tasks:
+
+- Add unit tests for OIDC service, token lifecycle, and storage adapter.
+- Add integration tests for preload/main auth IPC handlers.
+- Add runtime smoke route checks for sign-in UI boot path (without live IdP secrets in CI).
+
+Acceptance tests:
+
+- `pnpm ci:local` remains green with new auth tests enabled.
+- CI gate includes auth contract and IPC integration tests.
+- Production package smoke run has no renderer console warnings/errors on auth routes.
+
+## Exit Criteria
+
+- OIDC sign-in and sign-out are functional in packaged desktop build.
+- Refresh token never crosses preload boundary.
+- Main-process proxy path successfully authorizes protected API operations.
+- Auth integration is provider-configurable and migration-ready.
+- Security checklist and threat assessment updates are complete for merge.
+
+## Current Constraint (Clerk OAuth)
+
+- Clerk OAuth access tokens in the current tenant flow do not emit API `aud` claims required by the AWS JWT authorizer (`YOUR_API_AUDIENCE`), even with JWT access tokens enabled.
+- Temporary compatibility control is active in AWS authorizer audience list:
+  - `YOUR_API_AUDIENCE`
+  - OAuth client id (`YOUR_OAUTH_CLIENT_ID`)
+- Temporary control risk: broader acceptance than strict API-audience-only validation.
+- Removal condition:
+  - Clerk issues access tokens with `aud` including `YOUR_API_AUDIENCE` (and required scopes when available).
+  - AWS authorizer audience list is reduced to API audience only.
+  - Desktop flow validation passes with `OIDC_API_BEARER_TOKEN_SOURCE=access_token`.

From 59c01af1bb04c2c47a61862a818b76161883dc85 Mon Sep 17 00:00:00 2001
From: Simon Hagger <simon.hagger@gmail.com>
Date: Thu, 12 Feb 2026 14:56:37 +0000
Subject: [PATCH 15/24] test(security): add API auth regression cases for oidc
 audience validation

---
 apps/desktop-main/src/api-gateway.spec.ts | 192 ++++++++++++++++++++++
 1 file changed, 192 insertions(+)

diff --git a/apps/desktop-main/src/api-gateway.spec.ts b/apps/desktop-main/src/api-gateway.spec.ts
index 44315f8..4428b90 100644
--- a/apps/desktop-main/src/api-gateway.spec.ts
+++ b/apps/desktop-main/src/api-gateway.spec.ts
@@ -10,6 +10,19 @@ import {
   type ApiOperation,
 } from './api-gateway';
 
+const base64UrlEncode = (value: string) =>
+  Buffer.from(value, 'utf8')
+    .toString('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/g, '');
+
+const createJwt = (payload: Record<string, unknown>) => {
+  const header = base64UrlEncode(JSON.stringify({ alg: 'none', typ: 'JWT' }));
+  const body = base64UrlEncode(JSON.stringify(payload));
+  return `${header}.${body}.signature`;
+};
+
 const baseRequest = (
   operationId: ApiOperationId,
   correlationId = 'corr-test',
@@ -255,6 +268,185 @@ describe('invokeApiOperation', () => {
     expect(authHeader).toBe('Bearer oidc-token-123');
   });
 
+  it('returns auth-required when backend rejects wrong-audience oidc token', async () => {
+    const operations: Partial<Record<ApiOperationId, ApiOperation>> = {
+      'portfolio.user': {
+        method: 'GET',
+        url: 'https://api.example.com/users/{{user_id}}/portfolio',
+        auth: {
+          type: 'oidc',
+        },
+      },
+    };
+    setOidcAccessTokenResolver(() =>
+      createJwt({
+        iss: 'https://issuer.example.com',
+        sub: 'user-1',
+        aud: 'wrong-audience',
+      }),
+    );
+
+    const fetchFn: typeof fetch = async (_input, init) => {
+      const authHeader = new Headers(init?.headers).get('Authorization') ?? '';
+      const token = authHeader.replace(/^Bearer\s+/i, '');
+      const payloadSegment = token.split('.')[1] ?? '';
+      const payloadJson = Buffer.from(payloadSegment, 'base64url').toString(
+        'utf8',
+      );
+      const payload = JSON.parse(payloadJson) as { aud?: unknown };
+      const isValidAudience =
+        payload.aud === 'api.adopa.uk' ||
+        (Array.isArray(payload.aud) && payload.aud.includes('api.adopa.uk'));
+
+      if (!isValidAudience) {
+        return new Response(JSON.stringify({ message: 'Unauthorized' }), {
+          status: 401,
+          headers: { 'content-type': 'application/json' },
+        });
+      }
+
+      return new Response(JSON.stringify({ ok: true }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+      });
+    };
+
+    const result = await invokeApiOperation(
+      {
+        contractVersion: '1.0.0',
+        correlationId: 'corr-test',
+        payload: {
+          operationId: 'portfolio.user',
+          params: { user_id: 'user-1' },
+        },
+      },
+      {
+        operations,
+        fetchFn,
+      },
+    );
+
+    const error = expectFailure(result);
+    expect(error.code).toBe('API/AUTH_REQUIRED');
+  });
+
+  it('returns success when backend accepts valid-audience oidc token', async () => {
+    const operations: Partial<Record<ApiOperationId, ApiOperation>> = {
+      'portfolio.user': {
+        method: 'GET',
+        url: 'https://api.example.com/users/{{user_id}}/portfolio',
+        auth: {
+          type: 'oidc',
+        },
+      },
+    };
+    setOidcAccessTokenResolver(() =>
+      createJwt({
+        iss: 'https://issuer.example.com',
+        sub: 'user-1',
+        aud: ['api.adopa.uk'],
+      }),
+    );
+
+    const fetchFn: typeof fetch = async () =>
+      new Response(JSON.stringify({ ok: true }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+      });
+
+    const result = await invokeApiOperation(
+      {
+        contractVersion: '1.0.0',
+        correlationId: 'corr-test',
+        payload: {
+          operationId: 'portfolio.user',
+          params: { user_id: 'user-1' },
+        },
+      },
+      {
+        operations,
+        fetchFn,
+      },
+    );
+
+    expect(result.ok).toBe(true);
+  });
+
+  it('injects path params into operation url and omits them from query string', async () => {
+    const operations: Partial<Record<ApiOperationId, ApiOperation>> = {
+      'portfolio.user': {
+        method: 'GET',
+        url: 'https://api.example.com/users/{{user_id}}/portfolio',
+        auth: {
+          type: 'oidc',
+        },
+      },
+    };
+    setOidcAccessTokenResolver(() => 'oidc-token-123');
+
+    let requestedUrl = '';
+    const fetchFn: typeof fetch = async (input) => {
+      requestedUrl = String(input);
+      return new Response(JSON.stringify({ ok: true }), {
+        status: 200,
+        headers: {
+          'content-type': 'application/json',
+        },
+      });
+    };
+
+    const result = await invokeApiOperation(
+      {
+        contractVersion: '1.0.0',
+        correlationId: 'corr-test',
+        payload: {
+          operationId: 'portfolio.user',
+          params: {
+            user_id: 'user-123',
+            include: 'positions',
+          },
+        },
+      },
+      {
+        operations,
+        fetchFn,
+      },
+    );
+
+    expect(result.ok).toBe(true);
+    expect(requestedUrl).toContain('/users/user-123/portfolio');
+    expect(requestedUrl).toContain('include=positions');
+    expect(requestedUrl).not.toContain('user_id=');
+  });
+
+  it('returns invalid-params when required path placeholders are missing', async () => {
+    const operations: Partial<Record<ApiOperationId, ApiOperation>> = {
+      'portfolio.user': {
+        method: 'GET',
+        url: 'https://api.example.com/users/{{user_id}}/portfolio',
+      },
+    };
+
+    const result = await invokeApiOperation(
+      {
+        contractVersion: '1.0.0',
+        correlationId: 'corr-test',
+        payload: {
+          operationId: 'portfolio.user',
+          params: {
+            include: 'positions',
+          },
+        },
+      },
+      {
+        operations,
+      },
+    );
+
+    const error = expectFailure(result);
+    expect(error.code).toBe('API/INVALID_PARAMS');
+  });
+
   it('retries GET requests for retryable errors', async () => {
     const operations: Partial<Record<ApiOperationId, ApiOperation>> = {
       'status.github': {

From 11d9f7196ae84ab0cdc2298ac679772eb6fcdaf1 Mon Sep 17 00:00:00 2001
From: Simon Hagger <simon.hagger@gmail.com>
Date: Thu, 12 Feb 2026 15:24:32 +0000
Subject: [PATCH 16/24] chore(git): tighten ignore rules for env and test
 artifacts

---
 .gitignore | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/.gitignore b/.gitignore
index 0ecd8f0..94d33df 100644
--- a/.gitignore
+++ b/.gitignore
@@ -39,8 +39,7 @@ testem.log
 .DS_Store
 Thumbs.db
 
-.nx/cache
-.nx/workspace-data
+/.nx/*
 
 .angular
 
@@ -52,6 +51,10 @@ FILE_INDEX.txt
 FEEDBACK.md
 
 # local environment configuration
-.env
-.env.local
-.env.*.local
+.env*
+!.env.example
+!.env.*.example
+
+# e2e and test artifacts
+playwright-report/
+test-results/

From 340a6e423a6319c7eef090e3cae0afb5542d2c7c Mon Sep 17 00:00:00 2001
From: Simon Hagger <simon.hagger@gmail.com>
Date: Thu, 12 Feb 2026 15:26:02 +0000
Subject: [PATCH 17/24] chore(workspace): commit remaining catch-up updates

---
 .../features/auth-signin-bridge/auth-signin-bridge-page.ts    | 4 +++-
 docs/docs-index.md                                            | 1 +
 libs/shared/contracts/src/lib/api.contract.ts                 | 2 +-
 3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/apps/renderer/src/app/features/auth-signin-bridge/auth-signin-bridge-page.ts b/apps/renderer/src/app/features/auth-signin-bridge/auth-signin-bridge-page.ts
index 6f2ed1c..6bcc16b 100644
--- a/apps/renderer/src/app/features/auth-signin-bridge/auth-signin-bridge-page.ts
+++ b/apps/renderer/src/app/features/auth-signin-bridge/auth-signin-bridge-page.ts
@@ -32,7 +32,9 @@ export class AuthSigninBridgePage {
         throw new Error('Only HTTPS redirect URLs are allowed.');
       }
 
-      const signInHost = parsed.hostname;
+      const signInHost = parsed.hostname.endsWith('.clerk.accounts.dev')
+        ? parsed.hostname.replace('.clerk.accounts.dev', '.accounts.dev')
+        : parsed.hostname;
       const hostedSignInUrl = new URL(`https://${signInHost}/sign-in`);
       hostedSignInUrl.searchParams.set('redirect_url', parsed.toString());
 
diff --git a/docs/docs-index.md b/docs/docs-index.md
index 92bc885..54ca8f5 100644
--- a/docs/docs-index.md
+++ b/docs/docs-index.md
@@ -31,3 +31,4 @@ Read these first, in order:
 | `docs/04-delivery/ci-cd-spec.md`                        | Delivery              | Dev Experience                  | Quarterly      |
 | `docs/05-governance/definition-of-done.md`              | Governance            | Platform Engineering            | Quarterly      |
 | `docs/05-governance/backlog.md`                         | Governance Backlog    | Platform Engineering            | Weekly         |
+| `docs/05-governance/oidc-auth-backlog.md`               | Identity Backlog      | Platform Engineering + Security | Weekly         |
diff --git a/libs/shared/contracts/src/lib/api.contract.ts b/libs/shared/contracts/src/lib/api.contract.ts
index 5b7d994..327a914 100644
--- a/libs/shared/contracts/src/lib/api.contract.ts
+++ b/libs/shared/contracts/src/lib/api.contract.ts
@@ -8,7 +8,7 @@ const apiParamValueSchema = z.union([
   z.null(),
 ]);
 
-export const API_OPERATION_IDS = ['status.github'] as const;
+export const API_OPERATION_IDS = ['status.github', 'portfolio.user'] as const;
 export const apiOperationIdSchema = z.enum(API_OPERATION_IDS);
 export type ApiOperationId = z.infer<typeof apiOperationIdSchema>;
 

From 2fb104920d965b0c6e482e0eb4209fe9f872f4de Mon Sep 17 00:00:00 2001
From: Simon Hagger <simon.hagger@gmail.com>
Date: Thu, 12 Feb 2026 15:32:50 +0000
Subject: [PATCH 18/24] docs(governance): add backlog item for IdP global
 sign-out hardening

---
 docs/05-governance/backlog.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/05-governance/backlog.md b/docs/05-governance/backlog.md
index 4ad352c..16ffe93 100644
--- a/docs/05-governance/backlog.md
+++ b/docs/05-governance/backlog.md
@@ -20,6 +20,7 @@ Last reviewed: 2026-02-08
 | BL-012 | IPC real-handler contract harness expansion                      | Proposed | Medium   | Testing + IPC Contracts | TASK.md          | Platform            | Extend contract tests to execute preload/main handlers incl. timeout and correlation checks.                                                                                                                |
 | BL-013 | OIDC auth platform (desktop PKCE + secure IPC)                   | Planned  | High     | Security + Identity     | TASK.md          | Platform            | Phased backlog and acceptance tests tracked in `docs/05-governance/oidc-auth-backlog.md`.                                                                                                                   |
 | BL-014 | Remove temporary JWT-authorizer client-id audience compatibility | Planned  | High     | Security + Identity     | OIDC integration | Platform + Security | Clerk OAuth access token currently omits `aud`; AWS authorizer temporarily allows both `YOUR_API_AUDIENCE` and OAuth client id. Remove client-id audience once Clerk emits API audience/scopes as required. |
+| BL-015 | Add IdP global sign-out and token revocation flow                | Planned  | Medium   | Security + Identity     | OIDC integration | Platform + Security | Current sign-out clears local session only. Add provider logout/end-session and refresh-token revocation (where supported), plus clear UX state for local vs global sign-out.                               |
 
 ## Status Definitions
 

From 623eea6b77d26cea6f04d192aa373208f49d8682 Mon Sep 17 00:00:00 2001
From: Simon Hagger <simon.hagger@gmail.com>
Date: Thu, 12 Feb 2026 15:33:40 +0000
Subject: [PATCH 19/24] fix(auth): dedupe token refresh and revoke refresh
 token on sign-out

---
 apps/desktop-main/src/oidc-service.ts | 59 +++++++++++++++++++++++++--
 1 file changed, 56 insertions(+), 3 deletions(-)

diff --git a/apps/desktop-main/src/oidc-service.ts b/apps/desktop-main/src/oidc-service.ts
index 9b0f1ce..9bc19f3 100644
--- a/apps/desktop-main/src/oidc-service.ts
+++ b/apps/desktop-main/src/oidc-service.ts
@@ -173,6 +173,8 @@ export class OidcService {
   private summary: AuthSessionSummary = buildSignedOutSummary();
   private tokens: ActiveTokens | null = null;
   private refreshTimer: NodeJS.Timeout | null = null;
+  private refreshInFlight: Promise<DesktopResult<AuthSessionSummary>> | null =
+    null;
   private signInInFlight = false;
 
   constructor(options: OidcServiceOptions) {
@@ -298,11 +300,22 @@ export class OidcService {
   }
 
   async signOut(): Promise<DesktopResult<{ signedOut: boolean }>> {
+    const refreshToken =
+      this.tokens?.refreshToken ?? (await this.tokenStore.get());
     this.clearRefreshTimer();
     this.tokens = null;
     this.summary = buildSignedOutSummary();
 
     try {
+      if (refreshToken) {
+        await this.revokeRefreshTokenIfSupported(refreshToken).catch(
+          (error) => {
+            this.logger?.('warn', 'auth.signout.revoke_failed', {
+              message: error instanceof Error ? error.message : String(error),
+            });
+          },
+        );
+      }
       await this.tokenStore.clear();
       return asSuccess({ signedOut: true });
     } catch (error) {
@@ -319,7 +332,7 @@ export class OidcService {
 
   async getSessionSummary(): Promise<DesktopResult<AuthSessionSummary>> {
     if (this.tokens && Date.now() >= this.tokens.accessTokenExpiresAt) {
-      const refreshed = await this.refreshAccessToken();
+      const refreshed = await this.ensureRefreshAccessToken();
       if (!refreshed.ok) {
         return refreshed;
       }
@@ -407,10 +420,24 @@ export class OidcService {
     );
 
     this.refreshTimer = setTimeout(() => {
-      void this.refreshAccessToken();
+      void this.ensureRefreshAccessToken();
     }, msUntilRefresh);
   }
 
+  private async ensureRefreshAccessToken(): Promise<
+    DesktopResult<AuthSessionSummary>
+  > {
+    if (this.refreshInFlight) {
+      return this.refreshInFlight;
+    }
+
+    this.refreshInFlight = this.refreshAccessTokenInternal().finally(() => {
+      this.refreshInFlight = null;
+    });
+
+    return this.refreshInFlight;
+  }
+
   private async getDiscovery(): Promise<DiscoveryDocument> {
     if (this.discoveryCache) {
       return this.discoveryCache;
@@ -495,7 +522,7 @@ export class OidcService {
     });
   }
 
-  private async refreshAccessToken(): Promise<
+  private async refreshAccessTokenInternal(): Promise<
     DesktopResult<AuthSessionSummary>
   > {
     const discovery = await this.getDiscovery();
@@ -562,6 +589,32 @@ export class OidcService {
     return asSuccess(this.summary);
   }
 
+  private async revokeRefreshTokenIfSupported(refreshToken: string) {
+    const discovery = await this.getDiscovery();
+    if (!discovery.revocation_endpoint) {
+      return;
+    }
+
+    const body = new URLSearchParams();
+    body.set('token', refreshToken);
+    body.set('token_type_hint', 'refresh_token');
+    body.set('client_id', this.config.clientId);
+
+    const response = await this.fetchFn(discovery.revocation_endpoint, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/x-www-form-urlencoded',
+      },
+      body: body.toString(),
+    });
+
+    if (!response.ok) {
+      throw new Error(
+        `OIDC token revocation failed (${response.status}): ${await response.text()}`,
+      );
+    }
+  }
+
   private applyTokenResponse(tokenResponse: TokenResponse) {
     const expiresInSeconds =
       typeof tokenResponse.expires_in === 'number' &&

From 7dd8f7eb5bf52bfc2ec9cb8135fb3d2146ca1943 Mon Sep 17 00:00:00 2001
From: Simon Hagger <simon.hagger@gmail.com>
Date: Thu, 12 Feb 2026 15:46:00 +0000
Subject: [PATCH 20/24] feat(diagnostics): expose electron runtime versions in
 IPC diagnostics

---
 apps/desktop-main/src/main.ts                 | 26 +++++++++++++++++++
 apps/desktop-preload/src/main.ts              | 16 ++++++++++++
 .../ipc-diagnostics/ipc-diagnostics-page.ts   | 14 +++++++++-
 .../desktop-api/src/lib/desktop-api.ts        |  3 +++
 libs/shared/contracts/src/lib/app.contract.ts | 16 ++++++++++++
 libs/shared/contracts/src/lib/channels.ts     |  1 +
 6 files changed, 75 insertions(+), 1 deletion(-)

diff --git a/apps/desktop-main/src/main.ts b/apps/desktop-main/src/main.ts
index 578975a..01df690 100644
--- a/apps/desktop-main/src/main.ts
+++ b/apps/desktop-main/src/main.ts
@@ -25,6 +25,7 @@ import {
   authGetTokenDiagnosticsRequestSchema,
   authSignInRequestSchema,
   authSignOutRequestSchema,
+  appRuntimeVersionsRequestSchema,
   appVersionRequestSchema,
   asFailure,
   asSuccess,
@@ -415,6 +416,31 @@ const registerIpcHandlers = () => {
     return asSuccess({ version: app.getVersion() });
   });
 
+  ipcMain.handle(IPC_CHANNELS.appGetRuntimeVersions, (event, payload) => {
+    const correlationId = getCorrelationId(payload);
+    const unauthorized = assertAuthorizedSender(event, correlationId);
+    if (unauthorized) {
+      return unauthorized;
+    }
+
+    const parsed = appRuntimeVersionsRequestSchema.safeParse(payload);
+    if (!parsed.success) {
+      return asFailure(
+        'IPC/VALIDATION_FAILED',
+        'IPC payload failed validation.',
+        parsed.error.flatten(),
+        false,
+        correlationId,
+      );
+    }
+
+    return asSuccess({
+      electron: process.versions.electron,
+      node: process.versions.node,
+      chrome: process.versions.chrome,
+    });
+  });
+
   ipcMain.handle(IPC_CHANNELS.authSignIn, (event, payload) => {
     const correlationId = getCorrelationId(payload);
     const unauthorized = assertAuthorizedSender(event, correlationId);
diff --git a/apps/desktop-preload/src/main.ts b/apps/desktop-preload/src/main.ts
index c193092..2bc0236 100644
--- a/apps/desktop-preload/src/main.ts
+++ b/apps/desktop-preload/src/main.ts
@@ -5,6 +5,8 @@ import { toStructuredLogLine } from '@electron-foundation/common';
 import {
   apiInvokeRequestSchema,
   apiInvokeResponseSchema,
+  appRuntimeVersionsRequestSchema,
+  appRuntimeVersionsResponseSchema,
   authGetSessionSummaryRequestSchema,
   authGetSessionSummaryResponseSchema,
   authGetTokenDiagnosticsRequestSchema,
@@ -199,6 +201,20 @@ const desktopApi: DesktopApi = {
 
       return mapResult(result, (value) => value.version);
     },
+    async getRuntimeVersions() {
+      const correlationId = createCorrelationId();
+      const request = appRuntimeVersionsRequestSchema.parse({
+        contractVersion: CONTRACT_VERSION,
+        correlationId,
+        payload: {},
+      });
+      return invoke(
+        IPC_CHANNELS.appGetRuntimeVersions,
+        request,
+        correlationId,
+        appRuntimeVersionsResponseSchema,
+      );
+    },
   },
   auth: {
     async signIn() {
diff --git a/apps/renderer/src/app/features/ipc-diagnostics/ipc-diagnostics-page.ts b/apps/renderer/src/app/features/ipc-diagnostics/ipc-diagnostics-page.ts
index c696bf1..946a689 100644
--- a/apps/renderer/src/app/features/ipc-diagnostics/ipc-diagnostics-page.ts
+++ b/apps/renderer/src/app/features/ipc-diagnostics/ipc-diagnostics-page.ts
@@ -36,7 +36,7 @@ export class IpcDiagnosticsPage {
     const results: ProbeResult[] = [];
 
     results.push(
-      await this.probe('App Version', async () => {
+      await this.probe('App Metadata Version', async () => {
         const response = await desktop.app.getVersion();
         return response.ok
           ? { ok: true, detail: response.data }
@@ -53,6 +53,18 @@ export class IpcDiagnosticsPage {
       }),
     );
 
+    results.push(
+      await this.probe('Electron Runtime Version', async () => {
+        const response = await desktop.app.getRuntimeVersions();
+        return response.ok
+          ? {
+              ok: true,
+              detail: `electron=${response.data.electron}, node=${response.data.node}, chrome=${response.data.chrome}`,
+            }
+          : { ok: false, detail: response.error.message };
+      }),
+    );
+
     results.push(
       await this.probe('Updates Channel', async () => {
         const response = await desktop.updates.check();
diff --git a/libs/platform/desktop-api/src/lib/desktop-api.ts b/libs/platform/desktop-api/src/lib/desktop-api.ts
index f331992..5efd28f 100644
--- a/libs/platform/desktop-api/src/lib/desktop-api.ts
+++ b/libs/platform/desktop-api/src/lib/desktop-api.ts
@@ -9,6 +9,9 @@ import type {
 export interface DesktopAppApi {
   getContractVersion: () => Promise<DesktopResult<ContractVersion>>;
   getVersion: () => Promise<DesktopResult<string>>;
+  getRuntimeVersions: () => Promise<
+    DesktopResult<{ electron: string; node: string; chrome: string }>
+  >;
 }
 
 export interface DesktopDialogApi {
diff --git a/libs/shared/contracts/src/lib/app.contract.ts b/libs/shared/contracts/src/lib/app.contract.ts
index 609d4f6..b5bce8b 100644
--- a/libs/shared/contracts/src/lib/app.contract.ts
+++ b/libs/shared/contracts/src/lib/app.contract.ts
@@ -12,7 +12,23 @@ export const appVersionResponseSchema = z.object({
   version: z.string().min(1),
 });
 
+export const appRuntimeVersionsRequestSchema =
+  requestEnvelope(emptyPayloadSchema);
+export const appRuntimeVersionsResponseSchema = z
+  .object({
+    electron: z.string().min(1),
+    node: z.string().min(1),
+    chrome: z.string().min(1),
+  })
+  .strict();
+
 export type HandshakeRequest = z.infer<typeof handshakeRequestSchema>;
 export type HandshakeResponse = z.infer<typeof handshakeResponseSchema>;
 export type AppVersionRequest = z.infer<typeof appVersionRequestSchema>;
 export type AppVersionResponse = z.infer<typeof appVersionResponseSchema>;
+export type AppRuntimeVersionsRequest = z.infer<
+  typeof appRuntimeVersionsRequestSchema
+>;
+export type AppRuntimeVersionsResponse = z.infer<
+  typeof appRuntimeVersionsResponseSchema
+>;
diff --git a/libs/shared/contracts/src/lib/channels.ts b/libs/shared/contracts/src/lib/channels.ts
index 674d124..02e3af6 100644
--- a/libs/shared/contracts/src/lib/channels.ts
+++ b/libs/shared/contracts/src/lib/channels.ts
@@ -1,6 +1,7 @@
 export const IPC_CHANNELS = {
   handshake: 'contract:handshake',
   appGetVersion: 'app:get-version',
+  appGetRuntimeVersions: 'app:get-runtime-versions',
   authSignIn: 'auth:sign-in',
   authSignOut: 'auth:sign-out',
   authGetSessionSummary: 'auth:get-session-summary',

From 553e5171659b88c403ff8efe6baafc31a1c6c107 Mon Sep 17 00:00:00 2001
From: Simon Hagger <simon.hagger@gmail.com>
Date: Thu, 12 Feb 2026 15:50:46 +0000
Subject: [PATCH 21/24] fix(diagnostics): source app metadata version from
 package metadata

---
 apps/desktop-main/src/main.ts | 36 +++++++++++++++++++++++++++++++++--
 1 file changed, 34 insertions(+), 2 deletions(-)

diff --git a/apps/desktop-main/src/main.ts b/apps/desktop-main/src/main.ts
index 01df690..753918c 100644
--- a/apps/desktop-main/src/main.ts
+++ b/apps/desktop-main/src/main.ts
@@ -69,6 +69,38 @@ const resolveExistingPath = (
   );
 };
 
+const resolveAppMetadataVersion = (): string => {
+  const envVersion = process.env.npm_package_version?.trim();
+  if (envVersion) {
+    return envVersion;
+  }
+
+  const packageJsonCandidates = [
+    '../../../../package.json',
+    '../../../package.json',
+    '../../package.json',
+    '../package.json',
+  ];
+
+  for (const candidate of packageJsonCandidates) {
+    try {
+      const absolutePath = path.resolve(__dirname, candidate);
+      if (!existsSync(absolutePath)) {
+        continue;
+      }
+
+      const raw = require(absolutePath) as { version?: unknown };
+      if (typeof raw.version === 'string' && raw.version.trim().length > 0) {
+        return raw.version.trim();
+      }
+    } catch {
+      // Ignore and continue fallback chain.
+    }
+  }
+
+  return app.getVersion();
+};
+
 const resolvePreloadPath = (): string =>
   resolveExistingPath('preload script', [
     '../desktop-preload/main.js',
@@ -101,7 +133,7 @@ let tokenCleanupTimer: NodeJS.Timeout | null = null;
 let storageGateway: StorageGateway | null = null;
 let oidcService: OidcService | null = null;
 let mainWindow: BrowserWindow | null = null;
-const APP_VERSION = app.getVersion();
+const APP_VERSION = resolveAppMetadataVersion();
 
 const logEvent = (
   level: 'debug' | 'info' | 'warn' | 'error',
@@ -413,7 +445,7 @@ const registerIpcHandlers = () => {
       );
     }
 
-    return asSuccess({ version: app.getVersion() });
+    return asSuccess({ version: APP_VERSION });
   });
 
   ipcMain.handle(IPC_CHANNELS.appGetRuntimeVersions, (event, payload) => {

From bb6c8f54b244f2b01abee77bdda7d1768116ddcc Mon Sep 17 00:00:00 2001
From: Simon Hagger <simon.hagger@gmail.com>
Date: Thu, 12 Feb 2026 16:02:44 +0000
Subject: [PATCH 22/24] feat(auth): add jwt route guards with safe post-login
 return routing

---
 apps/renderer/src/app/app.routes.ts           | 23 ++++--
 .../api-playground/api-playground-page.ts     | 35 +++++++---
 .../auth-session-lab/auth-session-lab-page.ts | 25 +++++++
 .../src/app/guards/jwt-route.guards.ts        | 70 +++++++++++++++++++
 4 files changed, 140 insertions(+), 13 deletions(-)
 create mode 100644 apps/renderer/src/app/guards/jwt-route.guards.ts

diff --git a/apps/renderer/src/app/app.routes.ts b/apps/renderer/src/app/app.routes.ts
index 76bd181..fc6f75e 100644
--- a/apps/renderer/src/app/app.routes.ts
+++ b/apps/renderer/src/app/app.routes.ts
@@ -1,4 +1,10 @@
 import { Route } from '@angular/router';
+import {
+  jwtCanActivateChildGuard,
+  jwtCanActivateGuard,
+  jwtCanDeactivateGuard,
+  jwtCanMatchGuard,
+} from './guards/jwt-route.guards';
 
 export const appRoutes: Route[] = [
   {
@@ -92,10 +98,19 @@ export const appRoutes: Route[] = [
   },
   {
     path: 'api-playground',
-    loadComponent: () =>
-      import('./features/api-playground/api-playground-page').then(
-        (m) => m.ApiPlaygroundPage,
-      ),
+    canMatch: [jwtCanMatchGuard],
+    canActivate: [jwtCanActivateGuard],
+    canActivateChild: [jwtCanActivateChildGuard],
+    children: [
+      {
+        path: '',
+        canDeactivate: [jwtCanDeactivateGuard],
+        loadComponent: () =>
+          import('./features/api-playground/api-playground-page').then(
+            (m) => m.ApiPlaygroundPage,
+          ),
+      },
+    ],
   },
   {
     path: 'updates-release',
diff --git a/apps/renderer/src/app/features/api-playground/api-playground-page.ts b/apps/renderer/src/app/features/api-playground/api-playground-page.ts
index a6ea38a..29b38aa 100644
--- a/apps/renderer/src/app/features/api-playground/api-playground-page.ts
+++ b/apps/renderer/src/app/features/api-playground/api-playground-page.ts
@@ -12,6 +12,7 @@ import {
   type ApiOperationId,
 } from '@electron-foundation/contracts';
 import { getDesktopApi } from '@electron-foundation/desktop-api';
+import type { JwtProtectedRouteComponent } from '../../guards/jwt-route.guards';
 
 @Component({
   selector: 'app-api-playground-page',
@@ -29,12 +30,13 @@ import { getDesktopApi } from '@electron-foundation/desktop-api';
   styleUrl: './api-playground-page.css',
   changeDetection: ChangeDetectionStrategy.OnPush,
 })
-export class ApiPlaygroundPage {
+export class ApiPlaygroundPage implements JwtProtectedRouteComponent {
   readonly desktopAvailable = signal(!!getDesktopApi());
   readonly operations = API_OPERATION_IDS;
   readonly operation = signal<ApiOperationId>('portfolio.user');
   readonly paramsText = signal('{\n  "user_id": "me"\n}');
   readonly requestState = signal('Idle.');
+  readonly requestPending = signal(false);
   readonly responseStatus = signal<number | null>(null);
   readonly responseBody = signal('');
 
@@ -54,19 +56,34 @@ export class ApiPlaygroundPage {
     }
 
     this.requestState.set('Calling operation...');
+    this.requestPending.set(true);
     this.responseStatus.set(null);
     this.responseBody.set('');
 
-    const response = await desktop.api.invoke(this.operation(), parsedParams);
-    if (!response.ok) {
-      this.requestState.set(response.error.message);
-      this.responseBody.set(this.pretty(response.error.details ?? {}));
-      return;
+    try {
+      const response = await desktop.api.invoke(this.operation(), parsedParams);
+      if (!response.ok) {
+        this.requestState.set(response.error.message);
+        this.responseBody.set(this.pretty(response.error.details ?? {}));
+        return;
+      }
+
+      this.requestState.set('Request completed.');
+      this.responseStatus.set(response.data.status);
+      this.responseBody.set(this.pretty(response.data.data));
+    } finally {
+      this.requestPending.set(false);
+    }
+  }
+
+  canDeactivateJwt(): boolean {
+    if (!this.requestPending()) {
+      return true;
     }
 
-    this.requestState.set('Request completed.');
-    this.responseStatus.set(response.data.status);
-    this.responseBody.set(this.pretty(response.data.data));
+    return window.confirm(
+      'An API request is still in progress. Leave this page and cancel the current review?',
+    );
   }
 
   private parseParams(
diff --git a/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.ts b/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.ts
index d2776d4..ed61b76 100644
--- a/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.ts
+++ b/apps/renderer/src/app/features/auth-session-lab/auth-session-lab-page.ts
@@ -2,10 +2,12 @@ import {
   ChangeDetectionStrategy,
   Component,
   computed,
+  inject,
   isDevMode,
   signal,
 } from '@angular/core';
 import { CommonModule } from '@angular/common';
+import { ActivatedRoute, Router } from '@angular/router';
 import { MatCardModule } from '@angular/material/card';
 import { MatButtonModule } from '@angular/material/button';
 import { MatChipsModule } from '@angular/material/chips';
@@ -33,6 +35,8 @@ const signInUiPendingMaxMs = 2_000;
   changeDetection: ChangeDetectionStrategy.OnPush,
 })
 export class AuthSessionLabPage {
+  private readonly router = inject(Router);
+  private readonly route = inject(ActivatedRoute);
   readonly showTokenDiagnostics = signal(isDevMode());
   readonly desktopAvailable = signal(!!getDesktopApi());
   readonly signInPending = signal(false);
@@ -53,9 +57,15 @@ export class AuthSessionLabPage {
     return JSON.stringify(diagnostics, null, 2);
   });
   readonly isActive = computed(() => this.summary()?.state === 'active');
+  readonly returnUrl = signal('/');
   readonly scopes = computed(() => this.summary()?.scopes ?? []);
   readonly entitlements = computed(() => this.summary()?.entitlements ?? []);
 
+  constructor() {
+    const queryReturnUrl = this.route.snapshot.queryParamMap.get('returnUrl');
+    this.returnUrl.set(this.toSafeInternalUrl(queryReturnUrl));
+  }
+
   async refreshSummary() {
     const desktop = getDesktopApi();
     if (!desktop) {
@@ -148,6 +158,9 @@ export class AuthSessionLabPage {
       );
       this.statusTone.set(result.data.initiated ? 'success' : 'info');
       await this.refreshSummary();
+      if (this.isActive()) {
+        await this.router.navigateByUrl(this.returnUrl());
+      }
     } finally {
       clearTimeout(uiTimeoutHandle);
       releaseUiPending();
@@ -178,4 +191,16 @@ export class AuthSessionLabPage {
       this.signOutPending.set(false);
     }
   }
+
+  private toSafeInternalUrl(url: string | null): string {
+    if (!url || !url.startsWith('/')) {
+      return '/';
+    }
+
+    if (url.startsWith('//') || /[a-zA-Z][a-zA-Z\d+\-.]*:/.test(url)) {
+      return '/';
+    }
+
+    return url;
+  }
 }
diff --git a/apps/renderer/src/app/guards/jwt-route.guards.ts b/apps/renderer/src/app/guards/jwt-route.guards.ts
new file mode 100644
index 0000000..a36b6db
--- /dev/null
+++ b/apps/renderer/src/app/guards/jwt-route.guards.ts
@@ -0,0 +1,70 @@
+import { inject } from '@angular/core';
+import {
+  type ActivatedRouteSnapshot,
+  type CanActivateChildFn,
+  type CanActivateFn,
+  type CanDeactivateFn,
+  type CanMatchFn,
+  Router,
+  type RouterStateSnapshot,
+  type Route,
+  type UrlSegment,
+  type UrlTree,
+} from '@angular/router';
+import { getDesktopApi } from '@electron-foundation/desktop-api';
+
+export interface JwtProtectedRouteComponent {
+  canDeactivateJwt?: () => boolean | Promise<boolean>;
+}
+
+const buildAuthUrlTree = (router: Router, returnUrl: string): UrlTree =>
+  router.createUrlTree(['/auth-session-lab'], {
+    queryParams: { returnUrl },
+  });
+
+const ensureActiveJwtSession = async (
+  returnUrl: string,
+): Promise<boolean | UrlTree> => {
+  const router = inject(Router);
+  const desktop = getDesktopApi();
+  if (!desktop) {
+    return buildAuthUrlTree(router, returnUrl);
+  }
+
+  const response = await desktop.auth.getSessionSummary();
+  if (!response.ok) {
+    return buildAuthUrlTree(router, returnUrl);
+  }
+
+  return response.data.state === 'active'
+    ? true
+    : buildAuthUrlTree(router, returnUrl);
+};
+
+export const jwtCanActivateGuard: CanActivateFn = (
+  _route: ActivatedRouteSnapshot,
+  state: RouterStateSnapshot,
+) => ensureActiveJwtSession(state.url);
+
+export const jwtCanActivateChildGuard: CanActivateChildFn = (
+  _childRoute: ActivatedRouteSnapshot,
+  state: RouterStateSnapshot,
+) => ensureActiveJwtSession(state.url);
+
+export const jwtCanMatchGuard: CanMatchFn = (
+  _route: Route,
+  segments: UrlSegment[],
+) => {
+  const returnUrl = `/${segments.map((segment) => segment.path).join('/')}`;
+  return ensureActiveJwtSession(returnUrl);
+};
+
+export const jwtCanDeactivateGuard: CanDeactivateFn<
+  JwtProtectedRouteComponent
+> = async (component) => {
+  if (!component.canDeactivateJwt) {
+    return true;
+  }
+
+  return component.canDeactivateJwt();
+};

From d67ae3581147cd395f7521962f791583ba4016b1 Mon Sep 17 00:00:00 2001
From: Simon Hagger <simon.hagger@gmail.com>
Date: Thu, 12 Feb 2026 17:44:37 +0000
Subject: [PATCH 23/24] feat(desktop): add build flavors, labs nav toggle, and
 docs updates

---
 .vscode/settings.json                   |  25 +---
 README.md                               |  54 +++++----
 apps/desktop-main/src/main.ts           | 102 +++++++++++++++-
 apps/renderer/src/app/app.css           |   5 +
 apps/renderer/src/app/app.html          | 150 +++---------------------
 apps/renderer/src/app/app.ts            | 144 +++++++++++++++++++++++
 build/icon.ico                          | Bin 0 -> 130461 bytes
 forge.config.cjs                        |  16 ++-
 package.json                            |   2 +
 tools/scripts/workspace-refresh-win.ps1 |  16 ++-
 10 files changed, 323 insertions(+), 191 deletions(-)
 create mode 100644 build/icon.ico

diff --git a/.vscode/settings.json b/.vscode/settings.json
index 6eb6d05..4b47edd 100644
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -16,30 +16,7 @@
   },
   "chat.mcp.serverSampling": {
     "electron/.vscode/mcp.json: angular-cli": {
-      "allowedModels": [
-        "copilot/claude-sonnet-4.5",
-        "copilot/auto",
-        "copilot/claude-haiku-4.5",
-        "copilot/claude-opus-4.5",
-        "copilot/claude-opus-4.6",
-        "copilot/claude-sonnet-4",
-        "copilot/gemini-2.5-pro",
-        "copilot/gemini-3-flash-preview",
-        "copilot/gemini-3-pro-preview",
-        "copilot/gpt-4.1",
-        "copilot/gpt-4o",
-        "copilot/gpt-5",
-        "copilot/gpt-5-mini",
-        "copilot/gpt-5-codex",
-        "copilot/gpt-5.1",
-        "copilot/gpt-5.1-codex",
-        "copilot/gpt-5.1-codex-max",
-        "copilot/gpt-5.1-codex-mini",
-        "copilot/gpt-5.2",
-        "copilot/gpt-5.2-codex",
-        "copilot/grok-code-fast-1",
-        "copilot/oswe-vscode-prime"
-      ]
+      "allowedModels": []
     },
     "electron/.vscode/mcp.json: chrome-devtools": {
       "allowedModels": [
diff --git a/README.md b/README.md
index b1203e3..1b03c30 100644
--- a/README.md
+++ b/README.md
@@ -41,53 +41,61 @@ pnpm install
 
 ## Common Commands
 
-Quality gates:
+Core workflow:
+
+```bash
+pnpm install
+pnpm desktop:dev:win
+```
+
+Quality and CI-style checks:
 
 ```bash
 pnpm lint
 pnpm unit-test
+pnpm integration-test
+pnpm e2e-smoke
 pnpm build
+pnpm ci:local
 ```
 
-Renderer-only dev:
+Targeted dev commands:
 
 ```bash
 pnpm renderer:serve
+pnpm desktop:serve-all
+pnpm workspace:refresh:win
 ```
 
-Desktop dev (Windows one-command flow):
+Packaging commands:
 
 ```bash
-pnpm desktop:dev:win
+pnpm forge:make
+pnpm forge:make:staging
+pnpm forge:make:production
 ```
 
-Windows packaging (deterministic clean + make):
+Build flavor behavior:
 
-```bash
-pnpm forge:make
-```
+- `forge:make:staging`
+  - sets `APP_ENV=staging`
+  - enables packaged DevTools (`DESKTOP_ENABLE_DEVTOOLS=1`)
+  - outputs a staging executable name (`Angulectron-Staging.exe`)
+- `forge:make:production`
+  - sets `APP_ENV=production`
+  - disables packaged DevTools (`DESKTOP_ENABLE_DEVTOOLS=0`)
+  - outputs locked-down production artifacts
 
 Packaging notes:
 
-- `forge:make` now runs `forge:clean` first to remove stale outputs from `out/`.
+- Packaging runs `forge:clean` first to remove stale outputs from `out/`.
 - Windows distributable is ZIP-based (no interactive installer prompts).
 - Output ZIP location:
   - `out/make/zip/win32/x64/`
   - filename pattern: `@electron-foundation-source-win32-x64-<version>.zip`
-- Extract the ZIP, then run:
-  - `Angulectron.exe`
-
-If local Nx state gets stuck/locked on Windows:
-
-```bash
-pnpm workspace:refresh:win
-```
-
-Then relaunch desktop dev:
-
-```bash
-pnpm desktop:dev:win
-```
+- Extract the ZIP and run the generated executable from the extracted folder.
+- Custom app icon source path:
+  - `build/icon.ico`
 
 ## OIDC Authentication (Desktop)
 
diff --git a/apps/desktop-main/src/main.ts b/apps/desktop-main/src/main.ts
index 753918c..93fd706 100644
--- a/apps/desktop-main/src/main.ts
+++ b/apps/desktop-main/src/main.ts
@@ -3,6 +3,7 @@ import {
   BrowserWindow,
   dialog,
   ipcMain,
+  Menu,
   safeStorage,
   session,
   shell,
@@ -45,6 +46,59 @@ import { toStructuredLogLine } from '@electron-foundation/common';
 
 const runtimeSmokeEnabled = process.env.RUNTIME_SMOKE === '1';
 const isDevelopment = !app.isPackaged && !runtimeSmokeEnabled;
+const resolveAppEnvironment = (): 'development' | 'staging' | 'production' => {
+  const envValue = process.env.APP_ENV?.trim().toLowerCase();
+  if (
+    envValue === 'development' ||
+    envValue === 'staging' ||
+    envValue === 'production'
+  ) {
+    return envValue;
+  }
+
+  const packageJsonCandidates = [
+    '../../../../package.json',
+    '../../../package.json',
+    '../../package.json',
+    '../package.json',
+  ];
+
+  for (const candidate of packageJsonCandidates) {
+    try {
+      const absolutePath = path.resolve(__dirname, candidate);
+      if (!existsSync(absolutePath)) {
+        continue;
+      }
+
+      const raw = require(absolutePath) as { appEnv?: unknown };
+      if (
+        raw.appEnv === 'development' ||
+        raw.appEnv === 'staging' ||
+        raw.appEnv === 'production'
+      ) {
+        return raw.appEnv;
+      }
+    } catch {
+      // Ignore and continue fallback chain.
+    }
+  }
+
+  return app.isPackaged ? 'production' : 'development';
+};
+
+const resolveIsStagingExecutable = (): boolean => {
+  const executableName = path.basename(process.execPath).toLowerCase();
+  return executableName.includes('staging');
+};
+
+const appEnvironment = resolveAppEnvironment();
+const packagedDevToolsOverride = process.env.DESKTOP_ENABLE_DEVTOOLS;
+const allowPackagedDevTools =
+  app.isPackaged &&
+  (appEnvironment === 'staging' || resolveIsStagingExecutable()) &&
+  packagedDevToolsOverride !== '0';
+const shouldOpenDevTools =
+  !runtimeSmokeEnabled && (isDevelopment || allowPackagedDevTools);
 const rendererDevUrl = process.env.RENDERER_DEV_URL ?? 'http://localhost:4200';
 const fileTokenTtlMs = 5 * 60 * 1000;
 const fileTokenCleanupIntervalMs = 60 * 1000;
@@ -122,6 +176,31 @@ const resolveRendererIndexPath = (): string =>
     '../../../renderer/browser/index.html',
   ]);
 
+const resolveWindowIconPath = (): string | undefined => {
+  const appPath = app.getAppPath();
+  const candidates = [
+    path.resolve(process.cwd(), 'build/icon.ico'),
+    path.resolve(process.cwd(), 'apps/renderer/public/favicon.ico'),
+    path.resolve(appPath, 'build/icon.ico'),
+    path.resolve(appPath, 'apps/renderer/public/favicon.ico'),
+    path.resolve(__dirname, '../../../../../build/icon.ico'),
+    path.resolve(__dirname, '../../../../../../build/icon.ico'),
+    path.resolve(__dirname, '../../../../../apps/renderer/public/favicon.ico'),
+    path.resolve(
+      __dirname,
+      '../../../../../../apps/renderer/public/favicon.ico',
+    ),
+  ];
+
+  for (const candidate of candidates) {
+    if (existsSync(candidate)) {
+      return candidate;
+    }
+  }
+
+  return undefined;
+};
+
 type FileSelectionToken = {
   filePath: string;
   expiresAt: number;
@@ -302,6 +381,7 @@ const enableRuntimeSmokeMode = (window: BrowserWindow) => {
 };
 
 const createMainWindow = async (): Promise<BrowserWindow> => {
+  const windowIconPath = resolveWindowIconPath();
   const window = new BrowserWindow({
     width: 1440,
     height: 900,
@@ -309,6 +389,8 @@ const createMainWindow = async (): Promise<BrowserWindow> => {
     minHeight: 680,
     show: false,
     backgroundColor: '#f8f7f1',
+    autoHideMenuBar: true,
+    ...(windowIconPath ? { icon: windowIconPath } : {}),
     webPreferences: {
       preload: resolvePreloadPath(),
       contextIsolation: true,
@@ -320,6 +402,8 @@ const createMainWindow = async (): Promise<BrowserWindow> => {
     },
   });
 
+  window.setMenuBarVisibility(false);
+
   hardenWebContents(window.webContents);
   if (runtimeSmokeEnabled) {
     enableRuntimeSmokeMode(window);
@@ -338,13 +422,14 @@ const createMainWindow = async (): Promise<BrowserWindow> => {
 
   if (isDevelopment) {
     await window.loadURL(resolveRendererDevUrl().toString());
-    if (!runtimeSmokeEnabled) {
-      window.webContents.openDevTools({ mode: 'detach' });
-    }
   } else {
     await window.loadFile(resolveRendererIndexPath());
   }
 
+  if (shouldOpenDevTools) {
+    window.webContents.openDevTools({ mode: 'detach' });
+  }
+
   return window;
 };
 
@@ -906,6 +991,17 @@ const bootstrap = async () => {
   await app.whenReady();
   startFileTokenCleanup();
 
+  logEvent('info', 'app.environment', undefined, {
+    appEnvironment,
+    isPackaged: app.isPackaged,
+    executable: path.basename(process.execPath),
+    shouldOpenDevTools,
+  });
+
+  if (process.platform !== 'darwin') {
+    Menu.setApplicationMenu(null);
+  }
+
   session.defaultSession.setPermissionRequestHandler(
     (_webContents, _permission, callback) => {
       callback(false);
diff --git a/apps/renderer/src/app/app.css b/apps/renderer/src/app/app.css
index 79c444a..37f4189 100644
--- a/apps/renderer/src/app/app.css
+++ b/apps/renderer/src/app/app.css
@@ -65,6 +65,11 @@
 
 .shell-title {
   font-weight: 600;
+  margin-right: auto;
+}
+
+.labs-toggle {
+  border-radius: 0;
 }
 
 .active-link {
diff --git a/apps/renderer/src/app/app.html b/apps/renderer/src/app/app.html
index c0de43b..5f9c696 100644
--- a/apps/renderer/src/app/app.html
+++ b/apps/renderer/src/app/app.html
@@ -13,147 +13,17 @@
       <span>{{ title }}</span>
     </div>
     <mat-nav-list (click)="handleNavListClick($event)">
+      @for (item of visibleNavLinks(); track item.path) {
       <a
         mat-list-item
-        routerLink="/"
+        [routerLink]="item.path"
         routerLinkActive="active-link"
-        [routerLinkActiveOptions]="{ exact: true }"
+        [routerLinkActiveOptions]="{ exact: item.exact === true }"
       >
-        <mat-icon matListItemIcon aria-hidden="true">home</mat-icon>
-        <span matListItemTitle>Home</span>
-      </a>
-      <a
-        mat-list-item
-        routerLink="/material-showcase"
-        routerLinkActive="active-link"
-      >
-        <mat-icon matListItemIcon aria-hidden="true">palette</mat-icon>
-        <span matListItemTitle>Material Showcase</span>
-      </a>
-      <a
-        mat-list-item
-        routerLink="/material-carbon-lab"
-        routerLinkActive="active-link"
-      >
-        <mat-icon matListItemIcon aria-hidden="true">tune</mat-icon>
-        <span matListItemTitle>Material Carbon Lab</span>
-      </a>
-      <a
-        mat-list-item
-        routerLink="/carbon-showcase"
-        routerLinkActive="active-link"
-      >
-        <mat-icon matListItemIcon aria-hidden="true">view_quilt</mat-icon>
-        <span matListItemTitle>Carbon Showcase</span>
-      </a>
-      <a
-        mat-list-item
-        routerLink="/tailwind-showcase"
-        routerLinkActive="active-link"
-      >
-        <mat-icon matListItemIcon aria-hidden="true">waterfall_chart</mat-icon>
-        <span matListItemTitle>Tailwind Showcase</span>
-      </a>
-      <a
-        mat-list-item
-        routerLink="/form-validation-lab"
-        routerLinkActive="active-link"
-      >
-        <mat-icon matListItemIcon aria-hidden="true">fact_check</mat-icon>
-        <span matListItemTitle>Form Validation Lab</span>
-      </a>
-      <a
-        mat-list-item
-        routerLink="/async-validation-lab"
-        routerLinkActive="active-link"
-      >
-        <mat-icon matListItemIcon aria-hidden="true">pending_actions</mat-icon>
-        <span matListItemTitle>Async Validation Lab</span>
-      </a>
-      <a
-        mat-list-item
-        routerLink="/data-table-workbench"
-        routerLinkActive="active-link"
-      >
-        <mat-icon matListItemIcon aria-hidden="true">table_chart</mat-icon>
-        <span matListItemTitle>Data Table Workbench</span>
-      </a>
-      <a
-        mat-list-item
-        routerLink="/theme-tokens-playground"
-        routerLinkActive="active-link"
-      >
-        <mat-icon matListItemIcon aria-hidden="true">format_paint</mat-icon>
-        <span matListItemTitle>Theme Tokens Playground</span>
-      </a>
-      <a
-        mat-list-item
-        routerLink="/offline-retry-simulator"
-        routerLinkActive="active-link"
-      >
-        <mat-icon matListItemIcon aria-hidden="true">wifi_off</mat-icon>
-        <span matListItemTitle>Offline Retry Simulator</span>
-      </a>
-      <a
-        mat-list-item
-        routerLink="/file-workflow-studio"
-        routerLinkActive="active-link"
-      >
-        <mat-icon matListItemIcon aria-hidden="true">schema</mat-icon>
-        <span matListItemTitle>File Workflow Studio</span>
-      </a>
-      <a
-        mat-list-item
-        routerLink="/storage-explorer"
-        routerLinkActive="active-link"
-      >
-        <mat-icon matListItemIcon aria-hidden="true">storage</mat-icon>
-        <span matListItemTitle>Storage Explorer</span>
-      </a>
-      <a
-        mat-list-item
-        routerLink="/api-playground"
-        routerLinkActive="active-link"
-      >
-        <mat-icon matListItemIcon aria-hidden="true">api</mat-icon>
-        <span matListItemTitle>API Playground</span>
-      </a>
-      <a
-        mat-list-item
-        routerLink="/updates-release"
-        routerLinkActive="active-link"
-      >
-        <mat-icon matListItemIcon aria-hidden="true">system_update</mat-icon>
-        <span matListItemTitle>Updates & Release</span>
-      </a>
-      <a
-        mat-list-item
-        routerLink="/telemetry-console"
-        routerLinkActive="active-link"
-      >
-        <mat-icon matListItemIcon aria-hidden="true">analytics</mat-icon>
-        <span matListItemTitle>Telemetry Console</span>
-      </a>
-      <a
-        mat-list-item
-        routerLink="/ipc-diagnostics"
-        routerLinkActive="active-link"
-      >
-        <mat-icon matListItemIcon aria-hidden="true">cable</mat-icon>
-        <span matListItemTitle>IPC Diagnostics</span>
-      </a>
-      <a
-        mat-list-item
-        routerLink="/auth-session-lab"
-        routerLinkActive="active-link"
-      >
-        <mat-icon matListItemIcon aria-hidden="true">badge</mat-icon>
-        <span matListItemTitle>Auth Session Lab</span>
-      </a>
-      <a mat-list-item routerLink="/file-tools" routerLinkActive="active-link">
-        <mat-icon matListItemIcon aria-hidden="true">folder_open</mat-icon>
-        <span matListItemTitle>File Tools</span>
+        <mat-icon matListItemIcon aria-hidden="true">{{ item.icon }}</mat-icon>
+        <span matListItemTitle>{{ item.label }}</span>
       </a>
+      }
     </mat-nav-list>
   </mat-sidenav>
 
@@ -169,6 +39,14 @@
         <mat-icon aria-hidden="true">menu</mat-icon>
       </button>
       <span class="shell-title">{{ title }}</span>
+      <button
+        mat-stroked-button
+        type="button"
+        class="labs-toggle"
+        (click)="toggleLabsMode()"
+      >
+        Labs Mode: {{ labsMode() ? 'On' : 'Off' }}
+      </button>
     </mat-toolbar>
 
     <main class="shell-main" role="main">
diff --git a/apps/renderer/src/app/app.ts b/apps/renderer/src/app/app.ts
index 473f575..64c5dcd 100644
--- a/apps/renderer/src/app/app.ts
+++ b/apps/renderer/src/app/app.ts
@@ -2,6 +2,7 @@ import { BreakpointObserver } from '@angular/cdk/layout';
 import {
   ChangeDetectionStrategy,
   Component,
+  computed,
   DestroyRef,
   inject,
   signal,
@@ -15,6 +16,16 @@ import { MatIconModule } from '@angular/material/icon';
 import { MatButtonModule } from '@angular/material/button';
 import { distinctUntilChanged, map } from 'rxjs';
 
+type NavLink = {
+  path: string;
+  label: string;
+  icon: string;
+  exact?: boolean;
+  lab?: boolean;
+};
+
+const LABS_MODE_STORAGE_KEY = 'angulectron.labsMode';
+
 @Component({
   imports: [
     RouterOutlet,
@@ -34,9 +45,118 @@ import { distinctUntilChanged, map } from 'rxjs';
 export class App {
   private readonly breakpointObserver = inject(BreakpointObserver);
   private readonly destroyRef = inject(DestroyRef);
+  private readonly navLinks: NavLink[] = [
+    { path: '/', label: 'Home', icon: 'home', exact: true },
+    {
+      path: '/material-showcase',
+      label: 'Material Showcase',
+      icon: 'palette',
+      lab: true,
+    },
+    {
+      path: '/material-carbon-lab',
+      label: 'Material Carbon Lab',
+      icon: 'tune',
+      lab: true,
+    },
+    {
+      path: '/carbon-showcase',
+      label: 'Carbon Showcase',
+      icon: 'view_quilt',
+      lab: true,
+    },
+    {
+      path: '/tailwind-showcase',
+      label: 'Tailwind Showcase',
+      icon: 'waterfall_chart',
+      lab: true,
+    },
+    {
+      path: '/form-validation-lab',
+      label: 'Form Validation Lab',
+      icon: 'fact_check',
+      lab: true,
+    },
+    {
+      path: '/async-validation-lab',
+      label: 'Async Validation Lab',
+      icon: 'pending_actions',
+      lab: true,
+    },
+    {
+      path: '/data-table-workbench',
+      label: 'Data Table Workbench',
+      icon: 'table_chart',
+      lab: true,
+    },
+    {
+      path: '/theme-tokens-playground',
+      label: 'Theme Tokens Playground',
+      icon: 'format_paint',
+      lab: true,
+    },
+    {
+      path: '/offline-retry-simulator',
+      label: 'Offline Retry Simulator',
+      icon: 'wifi_off',
+      lab: true,
+    },
+    {
+      path: '/file-workflow-studio',
+      label: 'File Workflow Studio',
+      icon: 'schema',
+      lab: true,
+    },
+    {
+      path: '/storage-explorer',
+      label: 'Storage Explorer',
+      icon: 'storage',
+      lab: true,
+    },
+    {
+      path: '/api-playground',
+      label: 'API Playground',
+      icon: 'api',
+      lab: true,
+    },
+    {
+      path: '/updates-release',
+      label: 'Updates & Release',
+      icon: 'system_update',
+      lab: true,
+    },
+    {
+      path: '/telemetry-console',
+      label: 'Telemetry Console',
+      icon: 'analytics',
+      lab: true,
+    },
+    {
+      path: '/ipc-diagnostics',
+      label: 'IPC Diagnostics',
+      icon: 'cable',
+      lab: true,
+    },
+    {
+      path: '/auth-session-lab',
+      label: 'Auth Session Lab',
+      icon: 'badge',
+      lab: true,
+    },
+    {
+      path: '/file-tools',
+      label: 'File Tools',
+      icon: 'folder_open',
+      lab: true,
+    },
+  ];
   protected readonly title = 'Angulectron';
   protected readonly navOpen = signal(true);
   protected readonly mobileViewport = signal(false);
+  protected readonly labsMode = signal(this.loadLabsModePreference());
+  protected readonly visibleNavLinks = computed(() =>
+    this.navLinks.filter((item) => this.labsMode() || !item.lab),
+  );
 
   constructor() {
     this.breakpointObserver
@@ -76,4 +196,28 @@ export class App {
       this.navOpen.set(false);
     }
   }
+
+  protected toggleLabsMode() {
+    this.labsMode.update((value) => {
+      const next = !value;
+      this.persistLabsModePreference(next);
+      return next;
+    });
+  }
+
+  private loadLabsModePreference(): boolean {
+    if (typeof localStorage === 'undefined') {
+      return false;
+    }
+
+    return localStorage.getItem(LABS_MODE_STORAGE_KEY) === '1';
+  }
+
+  private persistLabsModePreference(enabled: boolean) {
+    if (typeof localStorage === 'undefined') {
+      return;
+    }
+
+    localStorage.setItem(LABS_MODE_STORAGE_KEY, enabled ? '1' : '0');
+  }
 }
diff --git a/build/icon.ico b/build/icon.ico
new file mode 100644
index 0000000000000000000000000000000000000000..2ccabdcf12b9445034b1498124b67d1007cafec7
GIT binary patch
literal 130461
zcmeEP1$Y$K7M>`PO#*=+MdG$`7oZSGaCayK30jJ4DH7a5kkTRr3dJeKS}0H?xU>|v
z0>#~(V)OogHXAmZ-Rvg2p|pMX`)(#PJ9FinE9V{+1QWqh$e&-p)kWxNE(q-fL2z+V
z+%LiN-|;LsIQ`yJ5c)a^LizHFd!Gt|P^z>bBqyieTbT%z2B82XmKW4t5W0>u5qxlu
zqVPoV92Y@Ax!O{MTqcD2*a(q+c5cYMkbg!#k)GG#+7sC|%*RULyQ(SDPbNh8$t>}E
z3*;l=zBaGJe5}PV9~&v-eG$)Jg?d{b4sbJXQP5hjEY8Lu@mpjI{N5k$J&E#n5L+}T
zBc_b%BTkz#OzhL8sTddakr*57DE9iSvDm+R^T+tTAG*SC*k0yF`1VohkV4|r)WPE2
zJ2ypTdiCn1xP9w7@rz!q#9KG7ihup}LLAUD@u9z~NyGGSi{ZM5Z5%tihxp>fbLrCu
z_wR}a59}6C96cbuc>YX${OF<h=Jjjw<;$01_m1_&P;aZ<_^v2&%Wz-Y=XEOiix<xS
zA$|Mj*^^@Dq?+Q#;YGv>(Iv!DL%N8M9^RLJd;aXH*s*0*z{UDGzD-2_marPwr?vRz
z&1>-$${*A>iRFuI6EofsmoAtleb08ZYFti&E1u6m-by%sH8ENG{ra^_Vr{eqZIZs@
zw_)DafMXN!HQImw-W{=NohbZn!{0Y6zPFa(#saQgxhU3(muLCDSLa6f{*`#|?rpJg
ztqA4s{9bDRfL<-7@(JI5-9C}p&$`)uwq@=&6QuSL4#aOb+Kk`X{+5Ja?F7FJ_?<lV
zyV$Z(IWamgzgRlBpxC!-Gx5&t8`Ag0#iwm*p#K^0%fR3Gk-a7S^2Hn1FN<4$StIV=
zu~B^V=mGHeKz#D#kyJ+V=k3K%uMGTUjGr>0PJrVO@%F9jqWJc$^e+EgzI09;+^?;;
zcGW`h{JB#i`uZ@)!vf>So?};tl&g+kd$C#FXmNCMH*v<7BP856s1_o@p>kPQv1&Q@
z#~7#mg51re@vE2vcG=7yYbC5-MaXRrqu<SgJS;6kyz)u&NBIYE7D9b9&0o&hEb}*1
zZT>!R5QH={tS2UltSnF4Rrwyj;kR68T#(BnbN!K0`rKCB=>IodZYzZQ%FF=IQfPY(
z<j;}6LH;2<^M5|8f%T>o`fL^s_#2V}e9Q=YAzUuALb+v;CnFz5eu(@AIb$BB|IcUq
z?GW-L<TAiZK3s(W4~rZ%CBhf|^|UsLklO{|`&r0$kk#wcb$=V*%tRmjgM6$^2t$1m
z#|vQ1G587csjT%X)*jAX^bc)NtV3Df%V_V(2tT`~EHhkgmu(X`XHX{L-5dG7YMHE$
zxh&>l)p8zU-O2%Cwep@~8LaJGv$&q9z8@1<K#UD?#4~$-cMt1k&j`6qK4gt;V7~!(
zGnCOC`H`|LmdjkPYLGZ-+yHUsw)Nt<GbhBWmoJE1&$n&)NgO@2o75%+Ok`r&u)^ZE
zGsa8n%nwUviL<AT6}z^t!!o-Bd*m}?U8*V6$5x05;F@7q2bp-2`oem-ca0d_8Fih)
zKJX@E?NR-Q>+j*;_lR7J`E4D*=Gv7Ds;`Kvf0!pm2RPhBnKh%aK82}_he+TBuy@6`
zzp2(uSby{NXz|&zCz;C9cEi1q`z-eq<(jH|ciF-jO8o3cT`s6c0)aHvy{$}eKLYu!
zvi>N4dvVg(&!s(9S%yAW?$hkMI;`f+N>#3xtYc`HuO;S}En&`i?v3kNW!=Oh_hM<i
zSF7|b*8i(0|CgVC5Est<Qv81LO!4>Mb^=CE)!xi}J8kk%X`H6l@dvJ+$U>yQg!gXv
zU+Oz?UJmp@+NK{f7l6B$fBhw{T0U27R5Ki7yFkX6CoM6kZyWLapQp2YqkJ#{bQ9@;
z^!mA0b&0|_Kz+9O|EKil(mS8EttCEw{80I+bR`Y4Wd7G;xrm~w{m2-nEW1O?DiUlm
zeTW;vZ1})Wxi>58=XEvew!v7C<NrUE^|Sxq&P-7+LOg`=UFBnUB@R`~$@m{*NgO}2
zmq^-9HF17?-ZN3X{<9eOKB%`A@?+M|x=EYu-L*;ebBVqimE2Voei?Nt+pYNCR$2#6
zpFEuDd(u8VIyF$QpX&klvX00v72nIm%4OZeGpCPb`kpinX@_*$Ok>^ro|*Gz<@eua
z`u^F|C!me0tGAzZwgde8<0|cEgdb_V%NNgO`u-f&Ij*^ckFp+ZSGIBbl;N4aCvBS4
ztfG4TZ%|&JO!Z?wsZqg4ymaAgrti=Gaa_W^UiD)femzM+^C}A=ZP}_xc_nSB>_d9}
znc-ilw2OG^L}vWmx^Y#Sb6gj+^;`A%(go9%RZCaSrKC^d)%&l6f5!L&ETsL7dyHx#
z?ay<7+Wg7V7Q%;X0naC@iR-t5HqMy;{5F03sn0)Kan`gks-H{$?@0R@=dI$|jsdO#
zeY-UipFVw@>HC*2{}Ov+Pf%;WH2=_Mu0KC2;Ya$vW2<Tz=OSf6EaS@wgSdyG4O#KP
zy6aX66ptPLRryKAmFv%lL7mm>m)0N57w!R>)?cmx+qSID_+I%B&k7t{@v)_(xyb%7
zOJ~!DWyL)^e^I`g<;pXw%KYVg`;6-^uFC!AOa=@v&N?U6$T-`m7DhN6_;rUkZSpXY
z=M}C?E0@g?uU);U`dXI%S1g?^tqtjQ{DHMk+JCqQhJ!xD^Wn&u_TR72SME9568Bib
zRy~nEy6~ss%&Yuu*Y=Il*v1%__TO-C#r{hoKpXwReUN*BuDw-R2d`W^+hVS9zgJDC
zPaY8~m2u_R*^m9+8GX$l!9qcAYootNUk>}CllaG}BhoomwM^CjNq20=m}y==RyyPM
z>)srEg=^BD%&|lo@#C<<H?fA)jK-J?L!GJ#^FT>|ax7+{KWkR>#o4i|xMA)0BG18G
zqnS@0KPdi$^C$PW3em--{gLZHx$vT5liHD3PrcJ=WZOr0-Uak<7Wz}!4&X*B{mnVY
zxfuhxBcZgj$a6U}|Bu0WoWHSNv|Y;lUqKH`XM}rr-XqeF=b_BBud;6C72oMNf4t)z
zD9V3Vr?PIf>q*=<#o5CG=P6}1*<Qmzj|Y2XoWFRs%=P&T{q+y@%4edE?`#`@A9?<i
z@ZqQT`SUf}nfd%F!5imK@0^`K)!T+MurxM-n^LHQG>dfp#<`B?@8!sZ5$T8;d<SF2
zjNj;!#56Ne6a?|LAe4I{2+j`#!Qp}+<YP_~1hZtY50qKZGb!KaH4SB4NH33Nvkun9
zI$1aQ6v4=?kTduc9=I`bit@7&!n|y7=8)NA{qevx9{6pE+z0nVnDIZ(y|R}0t)ldf
zpUf`A+g9(hyOEnLMEKYV;a;{pBNRaX7;PH>9Irt>j(iLGDKf_$_cLbx&u9GY81ic5
z&oNHQqCfdPee8uGxxKNQnWa4PyZpTKnV`<%sJ|^TdDc8vOLQ)-8S9iD|MMI6XDxCY
zz~Q5CKNIZPR$1yb^nsVV4fY|f!Ls~-8ODa)4rKC!bJE`I-ep<aP<{){QHKbBthL^n
z`5`&&3uqewJQfr1=t5A(B4p`IWyH3t_KW-D0^m0&T+Vem^In?cwqvaV55@v?NF$Vc
z6gh(q%A@wPFRbG*@LWIC+s-1~SHHbUy>F4|J9t{wn48$!?QUe(Uf^BYlSwOcKUciV
zXEs^(Z%ySWzQ?<uPx(FXk*^_t8Y#E2Vq0>O$cu}RTZ7*x>xKGABdFpy<9|gxwqp6n
zVxX@|Q`RG<j_EJ)re;nZDUO63r4!B!RX%o;zG3?`l~p~?8}fsX#fCM)B)W)nJZLhW
zDej;S&|TmU`svpPj(5mUz%P{H46ThmAbb=&0iHi7Z&J#dROx2&R(M7|a%i6<+p1qR
zSP5H2KLBU);#Mu62RY4cNru5Q@$bLx6nQTD=BrVp{cfY*Z9=`V_xfhP_eOZx2vMO0
zc=o7*d{Gmu2y^n7$Wz?ECr$h-UH+v?^J@B^X9Ds+Mh^Z=jEnq88Y{#H`L){kQ#>nB
zPKNi+1D*+G<OPIaEqvN=xhd9OiEl-DB-h6*xMthQr{a0>?wwnjnyK>{<#B6P%opob
z36kh}@-N8W)RcHO;Mhu^Q)#H*g?zmrX9z>o64orV-<C4b@yJ>BBdP5;_spI?R%9Ct
zNgQK`zzgV*SXmr8paW!-n$L1PGgm6(B8@q;iF^3y2!9((^|=u4W+g;Pd}>*FymJ*f
z3+%~vC){&#X4BP2o^3hawI%Xj)p!$^F^<aed>!udP96sQK%Qf3gLco;)OPZ}dVbn4
zlbl#voyzBgG2u!XYHkzH#$1PpdzE(0#=SMNG=c)%EQBb3@CxLzvUumZ%6rl`9D6*E
z5#PEJ&-ABG90EUgn#3<1+%HMukIVwE|F?bH#HUX(^KW#OM_xGP6l!g{it|=1Wud`d
z=Ab2Qg)mR9mv&>--jlu~-*N`la&^AFdfnHqUJ@sd|3a)$(MRG1@!ZM%OtGiQB;E{p
zWyc|(S6yS(%Tc{w{lj<CTBo61BmI0WOhd62fv#aDJ^7pZdtBcrA0po)yF__Wm-cle
zJ`BH6FNgOW1N@D9)NYImeG+v5$QRR4-aeF9jB5^lBcG)*t~?`VdY5&kj_H@}7`_g;
zck57BeT-%*N3~qi6qHjOKl+=_F3bgwNA+8k|L^1fc+TVUk#0N>^Zb$NUACR_Hp=w1
zCC<-D<33mAe`P8|y-ejj@zAGhQ}N-0d)kVYo>Rv{3qDEX^^FO3BAo*o&2F)>Y~_{T
z)dS!1V!DoqrizYYeXb5Z4%a8;clunFu=)9?rJ9PBo^g&)r-t)LOPTXAw;(r_QKyBv
zEt%fqchq~)wq~&WFCi0TThzbR=bqz;x<1<W6Rx|YHL_{{4vhc8>HJRef-<#(>jwFI
zlo4r4)Dh{_x>|PSXDUy<eBzh1k2*h8Sr^A9*Q;#Wk8`xl4e$#?+1S@Ix1aDK{<J0P
zrKHnV*|t-?T;)CSM!Nggy=fY&Am5YtAsm(8s9i6jj6melc&=gJl8Muy52Gz{9j^ra
z7`8*LT)pqf!`-xgg~lo<8|%`pc6RN*3LHjhYd`Tj6}my%($T~Fr9H`z_EXns<GSS<
ztDvlfvVv^juWY}@@x$+^-==M^<epY5-WTxC+1jJT75h!vX4ke28r!c2{H5`e-TbBO
zTN`bA@9r(Jb(1)(&sxW4w&RHXCT&j|UsEEDu8{3&Enhi*ivT7X*H6l3DO=K%xGqso
zkmF1V)0|wnu23%jFkR13y^g<Lyb$~MXp!CeBdwnb9z)jsODQwXj`opchd2x7W)6@p
zr2dSy@%j4ID@nH?oAp!LzsiQWYNQ{qwu;p6)3!bkUQZyurJiU`+fSS|s~dy0U%Org
z%bz&5zqawIpdUh=bkJ|Ml6*;B?}2426Y2d%pegm82ORf2zpq`rNLhr|>+I>{M9{{X
z#%Biori*^&9;L4LpjsjEPx%^oBf9!PxPKg0MB<CQc=1fN7>)l^H;QsC4f9H(pD{*o
zj<gj*b(~+a8>g(8ec<_uvUu`VIA+-wwpWoAYY64or0Kaf>XSIXNCRuY!AO5O&M%NX
z=sZ874fU%9Ym}d>x8XMAnm;U=1^wHm()eb3Iku=bMBM?7HR?p`n|MZ`-izA&%5;9@
zAsAzlS?l?oFr=P=Ha?Add$@K}w}x`m>(?$zI#1fxnYVA>Xg!;fKcSdgnbzpp5x(!v
z?`(glyEXVHIEVRZ=AW?t-0R8vq0W%868psSktUr6)<NE5hr}wXdw|40ArC9UE3=$~
za{+Q(@~_4rYvf;5fS$<0xl=N9<_+lw+rE3pFVJ20lXw)G=ya}o)P+c=fh7J_IQdup
zS$Vno@(;^n?NhfI$Z0=FlWbV`y~G=!-hO-V;WV8kd3G8;u#>a~0H$de2U_`u(mVkF
zHagUi<A~>Zt^8Z^;&^7~`k=0plU-j3bDsBSg0D>7bj~Y|P3nOCwr{)m;K5yKPa|ID
zL4UtD>@O<Dl;k_-(Wdy)^87*w)|~7T*V8aBUHo%9sqTu<X(G>`dlB_upFDmf@hX&a
zl~=Aeq@hkgH-cl2e17(y?FNjbOj@EbcoMCf#!0pi+~4>c*I>Ly`Ji6>b7j9M?~vpk
z3LBVg<rjou>5zgFkB&AV!+>v&FRqv5mr_5HbUbyMY2U#2mF-r&^0{))Q0W`>6S{#$
z!#O?cm{+z})0I5la6cPsoRM|PkJt{<dz@$7yOj0wDz!=FnQEJL{C^E&CRg$!Wq&9;
z3-gBj&d;tP@=@gXE5Gx}z5MQ7A21($D9e0r^3(aic~G#QwMm$sGB0IYwOzfTD-Z*j
zGWw9m@@u;m7>5oLUlX=z#!iGsps$rue;^6ti8eC^>kmNIE9nme`kM%0d7wX_4hKnp
z!#f=x`sr`HLO-d$aT8h6-$0uc`WwKhf8jzxs0WOD{)U7#3UUM+=)%bCfcFgj8T{WH
zd2o8}jkP2Z<1a&hCeX*$BqWDxqNeVNVzP;(sPtA4hERD3%0$k*UVw5DugTCK;*}rc
z4_?EIf&g73Xd4Lv^p5bsyDL72Hj*G*;1wb&<u#4>5F0A5$-JixmX<3Y8#5)dux#o}
z<L@f%yTE&u_AC3P-d`mglyCuvBsgWj?Ls;nm2g$UIUVlQ(<+agjGUpT#Ru;(`4ks~
zg6J#8qG`C?#twV2D`<dFjJG)C+Q<#1>?i#nhx1qnWbv+Hco%Dmsas()!LOw0du*}c
zRY7-Akb7E~M0nZSp+5nbU(K*Kz*a}L6j$=IP9szA<N-2eOU(SA&uBlk3-2z$bvUj~
zk^MpY$pU;VOoCx^_@Sm~KL_q(lzYh0=8kAT`@sG@LCy_*!EYWTQwFgJxjoiapHR6S
z&MEmn5HQ4JY=h4MdJuh%K^w;+A4YzLtdSly;5o}YgghE@;^+uJ=nv&m2g(@0i=aM_
zkCi#_9Rj?hpj~H?d6qPGztziQ9e)7cV^Mb?>~PIO{H%@9CB4chQ@}(BDGT|eudFco
z%`*UTLOMXboq2uFI)4WoK822kQ(TOL;N_TAe@3rP>G@J5Xs}4|#{hTAMiwAv=-vMf
z{a3=5>*qYsGa=!DmZlK_c{3Iwz}tatu_gLm7xnE&&ce(28)3k<?7_NFE7%iy`@Y82
z8RnTcQf_67vDN|goX<@^0XLj~m3&+9M{q9Yv)q)G%{S-J#-u1;Ya5IQJx6u+uc0pN
zYt}N9+a3So?5*ECXWz(sKszL#8?-Z{KMCr1(9VQ<a^wNg=30Uc-qp8k@@4q0DsMxo
z3-Co*&@+?4R?5bP`cH<WXz&9SdKj|LP#@_Noo$r*g1*z9hQ24pjp!w=f_>$lotwaG
zIw<j@sJn3*^1;2kHjA{gqOM(o>Y?D}0v0;pKt9#iunnG)GEkE9_3QqLWdBBA7}P1E
zULJINt^w{HVY6)&1^w{cB<QLNAs&|Wq3{X%okfp86D&BsiD$NH-I~RcZ7*#Rb*1O<
z#c}TJ35gGv2)nrGfc(;2$y5hmN}X2fUXg$I7J8%9<)F-iep={ngmSZeySGTZJnRV<
zu|G8q^0YF`sVxn38HI%6Whg_7Lq49V9U8^}aZa12w#^eH+bZhZ<|a{>?fkjZlD-=4
zw^**SZo;-sWq(Oll3m$^CH3<-AMouF;IFK&ql*w7q#vJ;Z^b}=3UyOo_Ge}N+OBLP
z?H{RAO`R1bk2SkC>iUhc4EkH499m(&so)n<r&g1Vy=r;%BS4$d^!^hDKf<?%GuMKG
zdQ1e&KhQQdlo^dd{!3fG`J8<xubDm%H1X+G+m)ODY1cdgx=LJ2Xg5m#HM(?sDYu93
z2-W_-KwF1{-wNH(?0H|Ifwn>gH|lxIs^Oa}y82FkN^>B~)uzjpn?9?5L%4o7d!nR&
zPoFx}ea|j&?on={f`5(ytOc@4QC@|Fh+rJZwWLUi7imkqi<P?iP8}hx!;~%Lb$W^U
zKz%B0Iwh+0Q$E?U@yF`@Ck(y^{+)2u*!u`?oZImWaNiQ|@I20MG-mF<1EAl)x<0gY
z^ZFIBX>IzY%0f>--Xd#O-8~U!)~tL4%w_6&Q)iL9TaEqZbMDWiUydKqt*5F9Hk3PY
zji$_*KDKCYKwU*c^ubl@`4jqk)DP9rfA(oj`nfIB7zl8&5XyyPZpdW~@J_aJDayd;
zqehqBwQ8IAKV`=I_iUAXSy4xpYddKf?wQn~=iH{<h&H_@_42gcpE`a>@=2kEj=BSy
zpiWGXqY&ctj;|)I`93zFaqYe(j<sd3_uN}3&(t@)g1!-bk<hOhbrxv*PuwVFa*C^s
zq-$Im_DBQ!v=I*<+zX#1n)OR{)k|LvlnJt}TKX{)`sp@G84g&tLNs*@6mlf+6*Tvs
z<xx(bo!*mr+h_ws-y+n(VY%6~DdTs(!|_YHSYI0=)p|*1)5biTx=v!A2e8kya*p)2
z5@IX4bKN7)?zy)96K9l-({G(ViL!k9`XSD>%tdYZk>028f#r+8(W<AYtqs)KAPt^P
z|DOTZNeShO2tlyV!FoVlCGhX;=4$IZ-j`@^bw4rM+Cbfx_0S<#jKeJJu-1O7)=!vK
zkMojj;I!4F={fx!P=AzdRxMBM|5>1?t$0R`lFqlbF8KX`+B+HFllHEaAQ!o|=##il
z)2~BL@vdG!aoDa!r7Zq!vTMU?*!)qCLA@-s`+a~<Nj$^2r%w?X&p9{M-pMF~{rC(z
z2=w`=D{<UUPWd9owiDXw=DCV`CHn4<i@*C?pSrK1|7D2#=-?vsr$U?WY-xR-xAkcQ
z{cBJ!j$=k!pK|h?u&19*+5+j5=>J5?AIYYk=NMZp%Y+n!-#}Ya=t>X6yBcK_9D|%s
zKmWKyXZ1Y$(T@uCQL?E!$G=g>jrxPS64#ySUk=x&eD-xvWRQbNq_3n0GEG~1*?+F5
z<kjd(&!0b){Hho_@73GFHc;P3=~Gr)JE-eM-C*_awcLLh8DL`(?rjIYrrq~i-jVi^
zgji>ZhS659^7-Y9XT?wI#TdNqskepjq(3a`=4Y44YogB^!b`mj4fhLi9<mDakvZZw
ztu#N&A}{8T(?_$bTKer6&II(Iqi6m4v{8D8{clh`M7*TtXHC69<eN~hQNOiEwgx&`
z4)Ett80-Hp8sH<<O*)#qNo}^+s%@a3DIK(z-hEbW58FULb6i`qOZ4eWy+3{CA8@oT
z#LLD}Xa6O>TYyemO}2}?NAg6Bjep{^ChS*f+mu~m|EXimGleSrH2tsazdqxieiTpY
zLHp1jfsV6>&UR^PEAdHr0ePd@C8_@s?@xFCG3L|9zqI}>(^M~?5to!x{I-94c2!Hi
zagU}Qu0G>WTYZ|IvpmuO)UnMj@w_D22I759<)}TA)<1prKic!9ZO-anRJ|=c<I^@y
zpYf;GmTcS0{?q12mrgR*Kl<0!6aG`U|Am460sS`=?a@g8u$`nocplZ2NFUPHJSTnA
z=UvisntUv(w}-U%s3Cgoe;M=->0iu+Z0TRlfw9ATN<QV)>r}rd-(JNxgu$?2-P9@P
zxn5V2;E%J19x%<IfAKE+Umn+N&p+f>>2vny9H32!o?}pFTe<d=@BcuDO*vsh`kOXI
zdeHwF=O2B~zx1<u?8vXWP$2zIf278sgNS?XC-j4(Z=xL(d2BkyK*sr3FaAgR8n9^I
zRK4U|oQISNDP`L_+M=<o>^p7D$QRW`_p8E&HV>3d=%{lRbQ&c7hs6I%(2xH`yLNqf
z{`6(Z_!H~{`=X;gnSST{9K#&<jK7eR#Px^gm2Bz+|I03^V%fq%F!*0e{wLlKK^wE>
zf6~T>zDx8?H((<+V$i1&KJ=r>74!!AH?)z_Mek^82jvo^6|<=i{`F-U{7(u3Km)+v
zihlfW^08^(s&Bdj**s%*(8oN-0M|w0<{f?%|0|!<W{CDJS0T^OO}cXVJZP}c?AG6z
z&{xdhf3yENk$=QvY*Dv?yas&}&!q={+a=PcdLm>V^dm<5OVSmzCFXdgEF=YSN9Yrn
z@}b-&?os3!YT17@%0CDL;Ddgqbj!c6ACVT-br#dqe%jq#1%7A~wsq4Q_{;iEnoqQG
zrH_1lbVW3ktNM)caoYE5>Ayz#7yBOxzfa-3!X5zQG+X&6$MMiFI%e@Xt=f*f_@92c
zNnd1_I4-Av26{KYGUPdu{Ihc7X7u08E@w$mlKk67FZp-*h+^XWIg@g<H)YpuUBB^c
zM_q$&XO7p&hh6;LSDJX>%djRok>{^1g+WKAtczqPN&Saxb)E=c@;VkH#sPgI<Yl7&
zt!0a5Nas-6Oh34vJs+NS@7$|Y#(<>%5aU@$2n*4!|3J7%vQUNo%V@wLTb?+}C#_GM
z<c0nVVM^VSr3<G^wxqNpWDF!-yeRI0^zE45{}<TrhlAH;O`UCBNk#w375)F2b3MDv
zI_NuqK81Mx&&j@^Ys`>_`Z9G8eKksbVO``!??}r^50m!i`IoUw7-vL92ACuLCut1$
zTMPB_C2}p)TmOxETHM3F$2cY3!}jDhk&jMY0mlF0{+NzO2@j<0DU0EFqplBi{>YnO
z0=j<~)@14r(wAd8&LsUexBSJ0m=OK+-<0D+q5qgK$NG=dQKbG6W1rB6JZU9;#sqoy
zq?PtV&xih7=)a47Q0=?&o-$?1qT6Gir>u!{P;u5!=ohDda}n=14yOJiY^QURa;yK!
zy_d8N{a7*99{n|uZstBu87h5D5pT4;{uR$QZ&)eOe2k$(`cK(UUNvR*k98=sI*jlQ
zZG<~Q&Tqv%&5#6r5!!51_d7@W&x$@M^gMW$;h8J}u|h}()26%$V&5tK;Zwc_pLJ4y
zH1tIy3^c(d{TcN3psx%a58NBl^^9-Bpa%{6Q(Nqv?NR3WZ0gRYtqMAy=aP4LQ$Gu6
z#&-_tqyBrFC|@h+zvphuXLMTaANr6D@udBO6mx4o+C-a!Z2J3Ne`8zrV64{63;PEp
zD5Ct~&($9`CLgB#OK?Om?O!z0w#q&jdUc2CU3u6)g(>WxXcuq@`ERv<B3)ZPHb3m2
z$jx{^3HGdjfi>;lf-&w=0E559{*69C=x_D!Nt30xcwz6+{t>XI{bLktimf6MZ{b5p
zQA+z)KbbG~3ED|5MmDPbE9iKiFmF4{NZ$e<O1HDLL)HEnb0Yw-XbL!tz`nE;*WJjc
zk!edr9s_OnnCbV7&j>G7`{yS3-Y?W!CJXYhGzrmiZqL$)59EPQDKnv90r+x;Ej#9@
z9eC|HQ`v@Ky^4chhIjVw(*L&QVH;2TcNe}3n$@(MNeLm`!!l2MgEI;pH6St43$GXG
zSO6)R4jLd-Vf8~q2Ap9S82WL5BL?X;>BThOBPLBUuae6L{-gK|A4;F&Dt(RuBtHkJ
zNqLouLxIZc1%8c!FW?VSzBK6~n5kcr70(&#hAGQc@z{8OlNCi}sYm%dP4Rn{c3x0C
z&!@a9`>DJt;h?-K;iQC{@+$d%09-TRoW_Cycd1|?Oezp~QQ}F7HzgkVqJ&q}<P5x~
z<J||PBqLK0kl`mnk_zzQe<RUi*r%vq;us;Acoz{&0*acN`*~SedwW>Q5R2G8(#_g|
zng9EETFU&rt*nARGBuaun^JWJf#2jU)%D-NLtgf>hzm-G$%8zEek$xu{Jcyp!+os_
zhI`w(;XD=$8BkfQ%~h~A*9Q-<CHAXNVK>(U`%fQS`!eHy`p&^QSoSI2Yl&PB-&Bs0
z+m^vuI|zE@u2{PrQMLu*<Cu5{!VVkrs$j9a?Aiaz)&zkB7&~^yq>LzLZ5H8eZyDij
zYY&>;mA*58zZ#MLw(SwmX(axigS;l4?trbU4EzI$Hlbf9`rM#RgfjD<nZJR4kzI-M
zlhN<fPGrQ#w406bF&z7SJKR@C2Ayi_8sr0CFuo3!QN?Y{oUz!%7S`0_|35PZ1iVUG
z3a+J0O#(~gvy61Lbp*{73OqGJ9t3<WLQX>l&SckdrEePY_+KK^uL$`FTJ@mtn>xRP
z@A4a-e_000VwvE-!S>kCZYwhV#(jbM8epshhkM8hc$KuW^l~#Z@o~;x7GVr{{1?jb
z3laq15WytUJ0H)4MKR~-f4()~o`N&edcYp@TJlHtzWEd!9~>9A&=#%}>u`P@hxW9D
zuhnqaU=)t<w#rx9K`<#@=)Zs|<Mz?l%S`b0G&RK>$Jxq`KJMxPzOY-DZ2+v#A@hv+
zK710XuM67l*%qF4$t&Vm7>RLFJKWFSEy&MK=Id={BKI~oE|C6ZrTIk*!p`Vg@Rw_4
zhW*<S`g`z2B<lotE<iqsOn$=qp6A-|o!xV;3ml(Zo8}?6hhNr^5MNmVA6F|gp&{0^
zh<_RK4Csz0z6}mGM{HhGQ}|$Y1ny%1vp&eHk^e*{O~$=AJD7inzp>4v8Mr2_gq)=Z
z_AK%@^9O~Rngo@#5F+0nTiXB(<;|z=aLVB5hBJ164R~m_4&a-GW6kV|Ilm6@BAxY5
znCtqEJND%Y@Q?F|tSjPchKBms*avyonTCvlKYXlx|E1*WWFa_Mm<fTN7Wr^K_r`wN
z0cWgLfX^ks=>>95Xmx#Y@OQt*KJmPH9%EoR`kDk@ut$K8rKPK2DfrNN?0+C7#ycUV
zyS+JhF+~A~I)KA0z~odqZ2oQ>y|4P8VZ5IJT{|5xs1fC3TR7O+)NDwzfA3+TJjQm(
zq~b!ji?ub@dioX}fV>BICtde%obS5E68nrZgKP(A9`GS;0{z^qt-5q7DHx{N^I<I_
z)#}qtwv*uRL47ToLQ!&AP4s&qGWAe-Zqfy(fBWyG4XD#L7h|C+c#Mv*!M3I*@ai@+
z^~1ttZdwEXqC!ltskyYzOR>eJSk;fv-~ZyA*EW`UR(JsVcPlbw5T20{re@)Jtn-r_
zeCqp+vn#z47J@%2_~7xiiNIQ)iav6m|2NU~+VGj%=dS>#<Dd=3z{hE*zgz}MM@_-U
zuc*FY{~+EgW@9Q)LKY1EUAWvX0W=<UW~c}9|Mgz?e#iO2m~Zot;{se9Y%MSfiaPx>
z_=gd43n9TvFo6sfv4&-h(HHVVx!&h?PW)HDBM%X>NBAWN-4q=rm_*C-R%gi2#UsvJ
zAnr}0{qiB!x@{ZKGh5IH^6&nuI5f21<R5OtJZcWz@4}T`1(S;IhGHpiz8})JnBX67
zff!mgC4hVK?e`*6rfw(<a`!!K6KJ2HE&pxp$~im$L)k9Sg>9q!Y>UOkS(?PapYey3
z%6gax<=g~QjM0zKR_cxu_vCfu4tIKfhqX~*M+7|6PK!SEXs1M58~S!?)ug;g-`ceA
zr+p!>ZE)Yberd`70&Q3LO%%RmTUlOSwOKh15lb|qE@k^wuUhKoJfbd2`$)NUkpS$k
z!QLN+@F3jRLI@ASelN$GFPG$XzoMNlwDiMB@Rdov^l4v2A1aBB%1VB8#v>-dH}I)Q
zpL&cFPv0uEJEPxO`j|R`D}C|O@5YK{vnAg%<6)alTQ1tx(;rYQVihQHWQ;!0=K+0u
zwZ>R%3tw-vC8TW|{f^LXioR!Q*T=rlCXn`Jw0UE!0FD{9A$?qOK0(h~mK5P@T_l7w
zmiymJ4>&nma2Ya*^s_FAcC}KpFOTMZ`rIUZ2s7G4P8ih}KAUGt{>kW5f`0U9PfdG#
z+8xqw4*jarr}Mk~T6)fRXje+V0%uPjlVSqXA18e_(<iEAy9W5D!#>yJmi}VsyODOE
z^p)`I-fhzOqix{N@Fh$COVg$d6UUG21v}49l8+twnrhj&oaA$hJ}+qVn(lj&d%-sF
z3qJ|-wULYk3Rp`xc<<YRTVZl35i`ldHb2_b2ze{;pJ%il=SZWPVUoY;1>a5)55R93
z?TG0c%n+MgNn;v+SO#rx&z?ChZrl8m<ZqI(N8&Knl=F~tF(;XO68&obaq6hnHgX)^
zhu!<l8&^g8_&5h!>px&$d-TwLk$wlchSBD>S=|_Ek3;<mn$X{_PLPkC-Dv0&IJ-K&
zcl?L@SPQ|fX8ABb;?X9`>hlEmT#xG@zRr;T?Id5VXW*~$5#k%?)K9w-&-z@sc5rO%
z+P*;?hj~fA_*{2#x)yNEe)H96_<q;luZ*Vl(U(4b52weL<``uBJj6Y)E9d87VUg1~
zFoq14gld8i=vqjKiLf<?u5B=4OHe<DXVo0d4PEb(CaZ+Ky?e)clD}~JAfWxcG3L4^
z7;Aba*{&lN1Z}+gbZIKlm7LSM+AjT$y`wICJJN5rKK_+8)vtU;zd7^+K)P0C3^Ja<
zoG4%0fH-e+b2*qqpLR0@v-*7-Cbt&6aSp|K#1r*H=TY)6XH;H(nb1Pg{!Uu%=;8hF
z4a52VS_zK#ekDyo-{*|i!kFdpF{N~l0qz-$0dZje4k@OSA&us^SNICa6#sxQzY5;!
z2%HPu!ou^JMCI|huvl@75vVDIds-KSejZ~ao<ugPZWh-#(&MDx?<1DT`<(CD;t2Es
zeYPAz916ySqW?b9=;*)3%yoi(K1i1u+J~oz1;(*Q{}?LspY;;<M=%#V1j%jk3ox54
zh1kk@kv@Vca#XB?;OA?NJ>RYx#vOTkMmy(mzR>T`h{2sD7!%fp!Yx~T=JH4G3G~x5
zf6ipdCpgb)n#KU>b^6HD*RNo9%^|%rHFdD+{;ygm&V{lK;IYRC1=w1a{@77)&V$h8
zp`iEteN4=tyAg=~&POH<qS}sJ|4-c4MQjw(N`x(G;txGNM68@GzpNH}b#5e`5!B|T
zSQ@;gDJg>t@_DC(!NUjlrSk~Sz3TO(<A6FevteWG7g<y=jqo(SE*braM#-(6F!%eQ
zuJgviJ^3T#htLl&<3@dmb6$xD^()Vw2Y%ft`KGTP=dE&1q;Fq0k^b6V=Q7@rYF!*_
z^r1-KXOIPGn`dXR4|K&mEy&o_#!6w(RSzp=FNAu-?#fqI1?xWfkkoP4)(*X&bKVp8
z3$T{*yrqvnDOI?92>&yl)s;(sO1|RQ7o}g=hTuQ{vVMh8=+=Ai2S(lyeQRa|ciO0J
z1#c)m(BI0^qolo1F~RUr5EOuozYysC0GStPzOPY-QPzFpzE-@iH1Drnz4(us_v+)0
zYt{|K=UcUWE@=LENe0m&v5FK+&lu|&{io4CZRwDL+2NnRL5Ik0BI3NdLZMg)g<XZA
zY3ICPAs9Y%QEn2-KaOmavmSkf&6qk8Yd(GI>F;w^9rhp6{figR#NFFBN_#cq72N~h
z#u$mQVS9bnNLpI}|Ln#9adQ}Jbc-Nw8yoQzm^B8ZP*-yyq@;;il-wo=G$v!|7=_2j
zxUZAO4Ul}}8e@JK1IETGgT8)=FUITSS-}{I<@Nlufl>yL9sc<n`NInk14tg}E|^7n
z=1xu+;sU2G(a!K6Y*PT`bwj>@Z1CJK51uIF2#~*>mpoi!!2Lrh<K~SkVy9Nsbm3k3
zJ8=Y?Guw{Py>$o;EiA;)$S#K|(#KMW_JC~9*CrC>{fKPvS)V)+?vFdR{R}zX^A82Q
zAACC~7ozM~%h^wfchxIp#mk|G6XFNoH(>!eI}cW<$iZ?#2=}+ON1feK7VWZB%g@#S
zl!Y>mo<8vw^BO7Kca%A=>oTN#u95U7OL=z=@K5~wiT682dD_c_4Y5MA9L)cq08_!s
zmpUErX{Lx7Zs6RPiS(;Jd|)T>;)OFtITPgsrj#9!r^NUr<STM-W;@RQaa=mPQSM7!
z0PfwC)qF@a3Hb+%(bcSObWZV4U4bRw+xUkR#v0)AE-rL-L!k&%&Fhp!3|-Rva>?J}
zIgBNP_I<AV)Wh15_H(Y|Kj#GB#2;hJGo}E2GE;s>dYp0X$3aJkv9uUZkG#79JzGk#
zr6wZ2<m~BVr5G5L*FSuCPZ}?O_gLV#rS3@6I*~cWKXG;%`uDAZyks`z{fi1NuGwK;
z@mr9qnXv20RQS?@4T{2l0r!$zt@q0Bsv+L-GWfdJ<=;OiIM((q@qYc<MJcY^*OP`y
z`aF#gyN)tD>hzG`$nlst=a<e_)U&BqHBizOB)@$Z&T`~Q{+;}2u33zGK>f5FuK&at
z&ucTV2Dk<X%7rK&-DiPFZ(AX%xEcIG%WC1<gUGp_`)n`uF&Vq_vW^&^+VH9GbI#Md
z;FD~^TxYDnhR_wFERlH53EcQDc~cw<O=?9-dMDeq{DiUl_sAj{gM+eA#*WWPKY%yl
zpSatP?<%>vnV5(8fS0EuVcrYrwi_eyEp-eGn)`Jt2TE&dZerf+i+je#Ieqf56q}5C
zQtx6bXyujb(I<s&G1rV{b)qHy?x_=p-dkK4W#6fLu=<DZBpuRR;Gg}xgFHCI-?|{q
z1KDCf!rf6QY$Y>+j3*S|tVbqKSr1rgeur!AkbdoQ6z5&pZ+)+iAsdzCaL^g3RK`_B
z2BW!6Iq#2R3{f^s-Ox=NR^(Ys7)^a<Y@}riXNc9YhvpLhFCZ6M4IhaCW}pKr#%mq|
z92u3O?1V56D;vm|5&<WJ`8_=EQ5V~gxL=xJqI^cZx*u0AKwPi{ePRRVdK@dq40REy
z6Z+Gt1<>hxpln8-UY|aBB<X&r#Qn)>Kd=YL&OmP8D8S3oszN!Lph-QT3~0m9z(U~n
z*%pOA!xYGR43hJ3?o<Co5j!aNF>|y5m;3RW74yXwI2TJg7~18cIfa+j_c{Nl^COJ`
zjJv#w4W-)WC&2$)oLy+=kd5qDYn#)@F6=Mi6V*pnIJR_QAw+|^a0Fst_!N`$`oi!o
z*M0-+v}K4><t{Elyr!JQ_*Ct8cK>rtT)S$aWJ^JLt8#w6uPbRv+Hw5+;}VIVkX>61
z{f%qfw8_IHTGoL6y@X6?6?p+%{R2Jd89Q@|^tKaXU92tOZ?P%rIc-2)(j4iEI8M}K
zH+JHD;2zu#x|P~=uMBCszTeVrtWDDj;@+K`B|d?%`>8CCJd8=>K9~4s`nFBudvd$u
zSl8?MdFHdg{LYMg-0@k6ueB}KxIy^-mc}ylqy;NRmlS#S))muH*++e^Z@`=T9r`w1
z+Shq6`+fE>z}XgOgP{XDN_!kENc8PSj^5)QGdj5|&NMn>AM08N>3^YbxWBaxboMjh
zzp%n@wMm$ltT@I2_4#wn@8upzUB30udpGu(k8%*&>&3^GL|+X#+ZpR@U?=GTQ+JIq
z`|@H8&^Cy+FI;c3ACEfw^b~u*Z1`X*LgcIR0)yR6VbcLwvD_vWb->0@XIWa?Lj1RA
zP+B~4XrIA$52_P|>;CtPW=iqb$)7Q#jmG?zaT`CW7bC^`Bd^Zbi8hV>x_@E_?Wcql
zc|lu2Lxx3r3uaM1@8kh7(D8~1w9be9p()0QL3=;#q!{1)`qfKD1qJOddf@z>ZU?FC
z(+6>7p9l77BVIUv#;AQ}VbqTz-+}YW2;=rR@LMn3+r|>{F{C}95&nh+T0z#Ek8u$D
zq7Lp8xvGn8B%fp^^ty5qOI;Vx$ls$4WDUlD&t=<k+b4a$BY&2*UdD*^tqPBe7*kzA
z?-&XH@Ifo<8s=?fP5Vuzh?2;$g%BUvsxa_B4gJlvyoYV1t>%^utBj)eOgK<CkTSfU
zof|4_^FL7hmklipxnhzeS60QJq5m`1E_Hv5fq%@MC&2Lp=mr+3992*t-52I-B6Rc<
zfqxrs;C>Y{_laE1f9}hzo5aC>XOGcj=+7|s$^Ycs&uzQj$9L>I>E6v7S78k>79H?b
zJPF;84lSz~1^<A<8;pTvpaETL)~+H1yPF7M*ay6v%uT=>h{o91W(ch4Plaa{%1n)w
zu3fz#e$l%X&ie14&y!PFP}VtqWFN_v-x&R;Op|nU4t2kD&67<S1EC)Wf!B*T$`OdQ
z8D7$XGM`GI4SvsQpH<)gIJ}4y6Z_u1JI3g~wD#}cyA{4LK1QF6LjUN3jX}TDW}WuI
zXW&o77>W329C7*rF~<6@z?Ezt{M*D;2q<h4?e8GKhF^#Zv@`{L8{qdpRPmXk|FQSe
zf6jt$CyS2}8{Qa+`qMn~RfVms0laU6aGE0+VBe&!3H3FMq5DnUzn$CGi_LJpG#>t8
z!{INh9UX3M5*a8HVACZ;dRv=f?zcu?ujaJB%J<p63em+OtDYz6(isE)lzq>D?;Prk
zE9?1?uY^Hm$e_RdCPjSu^s&JpApR-aZd5benD~cW*Y=YzIbw?Y*#P%;LS%6p#JjfZ
zihTk8$a6>gDezxHT)TRaQO-bI`!1gUL(<QqEHSt3df(qsUt}2cTxqjsXreCax;0BA
zy3&aA|0d`>#3W+8d+>eyVcY5AV1sAm`$K0m_xPv2)y8#(`#T}rIQIAL+AOxh-uEH#
z`*gvFvcc{h>r3{m#=!qikaO0l>~GBZ{|LD585v+{5gQ~E2DU8;`#!t;7+<5&w_Nl6
z2^Z?9&}Wh{67j!v(;BgHt?+*o{y9&RKB)*kz*&RAKpJAz_uq;&EBa#nGaCI1{*G)&
zgr|k=suXu&Vs}@b0Slqs6AZyW$9>Z}QIdSl;EtmJ>g<!BR;O|R`u^eY`*qEK;-CIS
zjUoS_?*G#H(<EIAUG?VR_ZMj6$WRX(hXu(Bh44@>n<5w!lTk*l_5G+9!*dFKZ5ktS
z?_0CtI|c2Z%RMOvFfkf^LHtu!fB&8>2J4Me@0|8h+*gg*mlv?>85`<lTVQnO5)uzM
z%)`1EXu>Im<G;L7@xOe@H)6$D-M+Sr2pfapO#IXL1ARyuDi0+7X_FEc1-~E0n*%Qp
z7kzxNhmGT)q>qe<e+RKS<h}>tAIlhtd*4FnkCCTl#J=ZwS;Rm6fNX{ggf?Y{qzwGi
z?@J!y-x%vZY4irwgC&2<hV)taE%8tPIrJ4^#J=ZwS;RkiKs(@L+Gz9N*!Wjj|BXfe
z5l8fCy?e(mN)#G&<^KQU%K6Z*@yc_Y8FPFQ|DV(=E$xHsgCQxe=0Dn)LH`-+{KtM%
z_P>40Izzgg@vU_J`vvDe@V@>@=YPV1y1}$ZVjm1i#Q&TbM&JK4o&U)H2?75H^uJN~
zKlEu%pIC+_!j8NI>XQA_@K2r<ZOh5SG$av@3+GM|6Uw+?4K&*MKNJ5)!T+^32mik-
z)<J{#zx0*9Y|#vn`uT<?>V5DG-Kll;jQAYJT&MG@ERNOBAOoaNGeZ;4|4TB?|3<@q
zCjM_G`HwvJ@*m3Q=;L9&5#@jMdp>gTXU5QdeJ?Zw*M9owq`v+`=<OStRPhg<t+D!$
zS^gu*fAbkG{{{U=`9FOuP-oQ`>E&O4NxFpplrsSFPn*Xzu-7&8>__-z=KmQD|C!{!
z)c=Sm=?MJ~StVqH^gn2K%@{n4Wnqj&`Z*8eAI6$TS;`^)8KdO4ecO%EeMyI4<+3^H
zx^Kq9zih9n{s;BHd<vRU|0fD-OqwD4B5f4tyZr)uI2$98emZ{SH?e(UWn;>}vf#~-
zKC6C99yn!xw0Si~q6~z-YZ_D!F=qcW>3>oGvwsxyKjnt&e{%dYRtjSt7%Pzm7&EM!
z<hw-`)*s^k)Kj6|8{2G*#52$~=n^%7T#c|bLZ7qfe^UQDs%&8az5=QL{Wa<^NdKF<
zT1yv9mtwUT0|ul4wr^bvIdFtA`k!ZIQ1_4Xls=#7v&9&RXP~{%foRdNjIr>aMgQB_
z_8$uRcYslCKX2W<D*5!Gez6heKpvDKlk8E44(MQ1UnkuEen-r>)=lG#h5sz}9~1z^
z2H6OugN<YVMH+y1TJ+~`tVACIE58RF1lrn2>!8uc0QD5;i-bCh#!U1@_bGTFM(X$R
zD7jr-Rr@dEKg7dS2r{DmCw(xH2A~YbSn1NmvyvY%9X{}lj#quw8=iYP_i3wT>_oq5
z-8$4W2L2WHpT1e`Kb@5J-`>Wt|E8_Z3Y=RQx5`-QC46%-c56r2Lj9e7AJoSK^`6=^
zs{nZ)eHt5g?h|&mZd?<4<4k3Q`A=Vfvk^Bmi~Tp(0PvTM=Kq0wz?4zFC4YRz!avJl
z94wBj+LiqNmU*s@d)_mK#iDsrjb`(p4lnu@p#75(WFV6Nhll`cn<zE^4-)><{l7#S
z!T$@}%Glfcc5jhvc+~r3$UXV$V}^E<VkT?C$9sE*^BDJ{A)mLC?0pQC^=N|$`N%1w
z`aln&h+$)1hyNF2`+uS==$o%c8{PLCX$ty)A)n>%qy^{;j&_-(&kfb{(1v?HfAaW|
z1jmF}XW&2AJb+C8pMo^_f6C<lO>VgVH}b-G4xk*|*mHyXEPb+eLu^>uTfDb9pRR+&
zzR{oc`k$5=#m*-?{L}Zra`;fBZjAvnfaL!z%2(zT9pfZK6y%DZIpu}_N7_QsZv*>a
z>_nfE`*v@Yd<=4}F<@@wVEo7s2ij4xai?9*`|ttDv+vJ8E*0zIe3?u9lkPtgju`EM
z@c)<)Cll;5qdwzK>Hifz!;R$sHNWI*{W9XC<wc^5?f2hy!bU7nl06%NM#^?9kpDzl
zpSV}}HZx4WLm!w>2Z%A?$^XnH{$bMt|F3?w{`CJ^L5u%a<sgWJ|K|u_>%x%d8^!-~
zy{bWyPXuG~0#xC~F~AtnlgAH`WDh(W<`Pa?aZevlw85btF6uWj9_#x`lmXE1G<C{y
z*)P5QKXVKi+yDE=VMWBzpw}56FRv2i<Sd{3H~I!t&`PiwGC*cReG9^yydB0~p&bVC
zKzYRbPFF8q$gK|uuKhXk|8DH~59E(Dgg*2}$T9QE53~{=ET8^TrcD_p+2AooH`nZ(
z><fIC-&6;$nZ9gBCwG(LKybaMJofKM<fV6QUl;vw(7Hxxp@DN8{~=TS7sM4uxdz97
zp?@^`u%cdsp*qpJ;Lq}@e?<N>V~&i1KN{}Y)yjKFahll{`V6L=LXitdzGccmc1s$Y
zbUk&>=y!r;F!o+vp6_(^hriR;HRIOMzeWz$G|v6g(CcWKllU*(161Qbp^O#C2H6FZ
zHfP(15ByY;k5R6f*NJCN(oV!5<LA(hb`k7J7zb#|gn?2lD&l$k$X@WTJXBl&JzM${
z|8;MgB)cNN+1TgS-1eEiFK165hxi6AIiUe^75|C&SHyo4)8oHMu^%sD4CHj}$?`te
z)J5~Y6xpBmnMgyC{-i!N{qvEhMn2*V_*T4o=Z56Nn`4FV@ZAqBDdeAXb1MIQ7yoU2
z&f>pu3`F}{3T3?olPI}u1aNP(_>YW>%sEDQ|3B#m0glO?+cu=f0J6<8uQbd}>hLT_
zET0fRSHynv$yxkI;y=V0dO?W)3SV&r;1|Yd@n7R$%Qk9A7x7Xa$Ai)jvU&Fw_YUqo
z)P*#LJp^qb=wCsPGa&bUDgJ8|;=hK47tK}tSB`-o#D5Mz{O3rybrAM&qr`uX@~6*i
z4{`pS$r4?YcNqA4OJ>a8>F`~}*k`9s95%Qy^eIPqgC1uY#%+<}KgW6rrZL{SW4;mB
z+S0!He((=tEd&0I7XO{PavaOc7k>j@is5z=1_Rf~1(05+-Bzu5xmXKv?l)~%Y4F+c
z3V5i4`X=e}fy=pn7&L$LK*WD<->{fAwCeplI0%vfXT*UHka-~{5cNY1iVKAArTvR%
zFX{@fST<XvkNba1VvI}b>~nmR_fa1E-3<7{=9n-f-Nl*qt4Ya_cWIXcW1oHi_)d%n
zuyGZ91tB=tTyH#Udoe5mK7vcZN0@g$OW2B4ft}z^)RAjHF-rXN$}zyWw$$l(-)90t
zaG~v6#ulb*pk<?SQs1~&mko0ghken}V0%DG4v6)VzCg6l0L01G2!C0{kRU4yFK2rp
zK0zB+bN(FufrTi!wG-BsKB(usDjp5_pT7O5FUY-se6GCa4{5`lq0bqoWgX%{B_U3G
zEO<;xm~f1@Ppl+TkJFGu9`}040V~Fo(2Re%-5HFFuA$!61>xT%=LpvEMJW8m`}>%f
zA&y)i`ZgcgDEk26#4*qS@om4x`bJ;xe;1!MH~8V%jI`eOi)X@DVR^`h-{GEpBfUoc
z_W{K4Hk9v0U$E4HX1QwlA=c&Dn4^9X#RSs`&zzt4bf91O2%%%6VjToOUz>apa{H>N
zZwuOBAYbrZKL{tvZN?4n3IFlC5jW2Gx|F%WZ+731hw&%IE5|M6gPiMXc)`6)ic9*#
z(ploOT>6CN7^6Q~$rmW}094Na*z@VnVFRx5!2!0GrOP`C&YA)|>O!y{zZWZxmoT)#
zJ*^5NR!kT4^(69}tbKlm*PQ-V5pkEhwy!Puk)_?o+YgW*$1y=!)4>C~z?bg{-1}t0
ziF%(YTlf+@XMOFW$vfaaNM7abTh}E1_53-LBwq+>HZX+!5y&dr2gz;n3wDA~5`3Gy
zOkr|s!Q0i$1hIrYaUK|l`fnoh+@WFY=k6KhGxVWGJNg5V8Bqr|uk;79o8Ov#BTjDJ
zye@8noma2V8ez>Ul`ZZG7wU^KhL0w@Sf!kTI&Jiue&_ZL@%YgLl5W{|vnEQsGR7HX
zY-6?cg)pbT?%~n?wytH$*qFoy8-L$dA4>_<5I@qjkPs7LYaZoq8;tr%3-H`wH2kwH
zu5pYbNP3DkmGmq5=)wKJZ9O1OLb(BDf)mH~hfY8ly>$;suQM*rO30w@-Mua8jon9#
z1o8*z<C=QX^qW0v+E{V;piiZEFZ3Zte@fZNukQg)bE1501LC~R&HXH_g^pd+v6XlC
zj2{&2YL*XY!g#cUabqZJHtHCltdrv)9&?N_FlKx?LOck4Tb>i%mmUW9-n(~hiobz=
zquh|beMy7!Y@d_<@=U;3#goQ<E>4{|M3OQ0>C!}Oi#Vp_gK&IQD(xcSoBnPUXFRR?
zzNEds$62hLpNEA-SRT;(x<-y?QEWDXsSxUE>j3(r5%ShN83PzogazTv`9OH3j_Hr}
zajAIf_(AbD#)7fqO!BNn8}4&wPDpz%eVTCmv3{=QIl;T?yWH0*fWE01Q%dq{sEBE!
z&@<A3Z`C@Vpv;ZPb%K5E?4~pad(KruKxbVDG{WyrjuL+fw19O%;J+2xv<o@c_T%_g
zwVzr3Cyb~AL%sj1<=iEDD0NIf$=;lH@{E;5yis0Coej!+NjH#|;`+_GtjMpWXT&pU
zc<$-cBfN)ij~)IMu}hbUU#1Qgdv$Ik@$op{6*RZj`Ix1x+WNvi<N(*|<vs(gw+%d=
zPhiJYfGBjdu`mKAb6-TbuZ0j6B$$NDt%~9N*%AHTk8HGap*A@3Ip+`gq16AbUo}|l
z(W!xSex&}_ce5u-dn)5+?ApE&x<}i@qlflO{zPcAK|N0Tsw3}l@qFrqjEC=<o|3I?
zZSd^N!G?`z`JArv*|pce-#D)jn^o2Z`ng3yya00#%iJT*h+me6j49qzFa>|`BaF|_
z(9XTcdA1Iy!tvdFBF*R^(a7W{(FTz=*-f#xQg^m(^LX*oHZ`R9O!Oy1U*#M#j9Cz0
zn(J{9i4UbbTPx;h_Un;qJM#E{=<-N>_x6#%eE@JDY@l4vi0GG!3PB9nz(@;|Fh83T
zI2&>u;22=L)z`51dQW_6%YS#<^sFB+l<fp94Ed{Vv4}WJld!<NKj-CUe8hPRLIPyY
zh$UMT_6CS2B_of}_~(MZc}(evH)D)*1+6EyZ658DuW&W!@+7$D1~c#Pn_xc+!P_4?
zM+zH~#(>pY@Frn@_V=y>|G@gmQ(29Ds4jHy3dTkXCb9k>#(uABG!?TkrHz?Mu)E9-
zwqyyA6)Z+yZXmz@2jamP^EfAEyaJ4_0%r4&;{sjmZ7jfZFH*=%7uY|j-<@4)WLgk<
z12$H$DWeW4;|rZaX8&>mkN?uUudr4g2Ms+2`)6o?pUg@S;shVRq8}7)bJCb7KP&i_
zGKGI>TW_po)Fa)2%>BTqGJ}8kn4%o#0r0*RF!~hqvqx08saZq-(EkrlRqF|Yx!@%D
zdsvx;dD|2Mzqkhax)Av?^8fb(#d=8lin*Yds|NenItGTzOa-B^FeK$4j(nBo+dvJq
zV~dXjxr?<GbVx!#7Yx8!w+H=xi2Pq%3)tuT!1)f$`@V?98tCt8W7V&Viy%{h+rRDK
z7S#(2{(cVT&`~OizSjl}zJVNrbisS!7onaHfu4AVKA*r^KMm*l8c{yBg@c_<%~IP*
zuDSkgD9_R#FXw!qXDx*wFUx!qUEpWe0q|G_dY9`UdB^|8^?-fi7(b5;+Z?;3a37gR
zfTyLUi(o1EP_gDelsx2u;N&I<-T^kIp>kUX_$LX+I@kki!aBg`8uGvCoWQ=o_p03*
z^s#HWpG|0}kBxn}k3IJJZ9>)h{~^SybrmLtLUd^hAw0m;G{oQ95wfiqz^XT3wHjC2
zo|AuQR2?&v_dfOjwwe69GoW)|Lv7y!eToW)o>o|hsfk}%3!%n8gPo&>vAnsJM+w4<
zN=ZV9pOqQLfMb-eT^RO8$`KYIpFk!*?4PhEyi9NFaa`wOoo^Q=w+jjJl@;)DwK5Z`
z2!bzcD*m6eL%`SDOz`nGHHAFc4)F89IH(I)GCuhRWY{)JajHI~vm?hPXnDIc$m=lQ
z;X6rI8+y`ip&s@!KQA*Ae=oyrakNA1-}#GQ5avp-U=reEX%*>XTNLNUNYKo!v4^Gr
z&g%hV&avCb?|WS!EysC&3vD?De6Pbe9gFrPf_D=h>1$Is!aHBS(hlI+7y5VN=6(0d
z%h^(Jbu~2!D4EYP%FWghYXf}L$r=Lwg8+N-lNh_^D4t!%mHRI3p@<`{6Woh)a;D(B
z{D$L-W$;Xb*a;F{dIbM(MV^m!2|Ns0ebgBg=q@YZS<=eV+s(|x7w4P*r@VncC5RQe
z0lX2#tj)r`?JWbnZSBM4wywZUG;mTQ(%-f{=m)O9b8t@@684H*CuCRfKX|NmPm!TV
zCFSS1Dl>HzNNbWO1Ky<UnBrT=;QZ`n0nfuRx7*?W>d<?SjPSR03G}hG3zR!p#+I-#
zEd^F>X@wv4yy^J=OVtR0V(Fq0d4Piu7AQ0E^ES1Fy?ViLA6qy0zX*ctv<&nnD&zlp
z;5D=a9zVrC(jDi`-uNGUH(6i)&u74SC%nToyl#}AZ6$nLIviz$`N&*D<u;CTFH;LI
zH#?I^CnrIG_MP+p*LICK`A{ChWKF2(B?vBc1wmd^FbODTY98QjW##Q^DGT(lu#a}P
zc3=+lw6OPavy=sRSXqUXFf|V?C76@~?EzB<!TUq$Odho(-Nr>Q&1CFy0d`(04_>qK
za_=7C=S(l~RuD3NmtI%-;DO?I2jvTCihDEVz2Y{bfVax~A&M7XDDRyW_vyt6LVAH|
z%HPuqOjh2TDBf4zrdN>OIzAo37cz>+gywxl@#z&@c=x>oleBmDQiaLy?xhOf-3sdW
z1W`us_}&l%c~p6yFji@f)FAbHmF7teyrB9$8mNAsrusV?oSfY~8m#&=A*Obpsrl%D
z`hBMEU<~NG&(uA1Sp7azchO;8_ZKp^*Fo(*pZa~8kSXO;yEilRJ~>nIf|=UA$^Y*&
z0Z1Jl2E#usQ}Kd&dHF76{$1C-&he){KGnyw`n|6Cq5ix2d{e(ypRZZ&lT|y6`JU+>
z>qDCA@3_C9daq%9$<$%2$eB9mob^6ahp^sd>HyZmOby1Z>b<m{CckTtbf5O_URsYY
zyt|jyYn28{8-_{)omsw0gNE>4r9$cU9fYLnR3Ic(r?O$B??)LGI4i!-=;08>eMSZ8
zw@Q$w7nf0BdT|*oET?=wy?~5c1&*Z7DxOJQdiT17M3tZMQkt@|v2|)ywzHvizhGCj
zN<6eR=r77dup)1|dCw*71)<-ws_}6R`u}m~O{bIvH@`kV`pxf;16NmW+y2UyV_W(>
z{d3T(u0J|dE-~!uDg}3zAJJ}mWUGCn0*X$uE;_|E&2rPgkd8$|TbYdN^vT@vX^T4T
zck{I$edM=EKc4&IRp0Z8-*0@jeE*<{WiOqZbJ?L=e4~c_p5DE6YuUKH%U+ueP1!$g
z%)mdR=JcBL<J*bdQ`}QZJg}Tqu;@gWx>lwy`n`>Ly)tmvg!uADPA(ICOg9bh?zrmB
z!4RK*LmeDintXTjcHNZ4ujkvpuDo*Sw?n@${i4*(%0pzmM-6gMeK=xL>!1ro&s%&v
zeXE&xd5CGj+jCz%XjydqBlmg7`qqf)yXNYq`K=GGu6kvOd!-hQ>$s<GytLG|yhq5`
zu}*crieBC3hlt&4FSYwJv2=~k<`=48uG8mloPEUlwqg&bbq9qZCebCj&7VL1a<{Hi
zdkmN-dW4ip*z?u$+pW%;U%qf*-0<(K?jAFK{CvxXm5;|R=~4Hg`O^tW1H&KIxh=o6
zWZT>^E^cm18_r!ePVUyIkl!-v-8(PDN3Nbc&T>qpxnqlZyG|Yv?>I7kmdjy}v8z2Q
z%|115g8NO+kh|uyj_q9Equ;51kBYV&o@5bRV^-N2Z)^A$vTZYKdD{x^bCS$MJjTw9
zwomD^H~Lbc5?>8l;=5#enF@)rn6*<1y5^hNaPQoiaeK#AE4<h3#juTYEuH31c^ki8
zyxUoH{WM{hTa!ugu9d9g%$)AdJF=sSi@faI#fO{@uUK}s&CQ|<k`m60J>2)Zs(X6x
zNIURy?D&;U=1(qo^w%YSESVoZbKK<xL&RsRhZQY+7BIh>cHgAf-s7#>eEZ$e9V=50
zCvL8EwoLxgrSC3@EhYch?c)pcU%2fKn=$bBB>~0ntWPtSI}Hu3($wEGq*(=DQ;WID
zRT3LKp4&7&bnc+yEz0M=DVo=t=UiThzb{U7YgM3Xa`{Pf#`UffYuaUQKu6n!)<@zy
zCZCuvIkwHSgaal`fA-z|Y?b-k0#$sLxkgVOQ+&qLyE_A%);{^Oo8z6noxDojX+HAa
zpR2a6nr6Aj=E8=#=7rKMM;$8q@R-MhnU`xGEWP2@f`Us5@7m~8q(h0xA!}nTr&`EU
z*CttAZne8^wJDX}u9;hGglwEc+d>2DIPa{u)BR1?14lz1d6=|uspkBV>F~-f`GvAO
z&6o8~SbH<gq>_F7Y%{-OyXIXSw{*kgrMu)22R1zYZE4Ta54)5&`TU3Y4I_5`*ktwD
ziM2{yE_S(zNtt|C9{W`}8Mf}&!#@7<B_RuUhIl&FuU2Af+XjmhX2i{iFIur^MPK)3
zmhv0rhhH#TBu>g#s^#0LGA*9}E|@Kxa&^nmLqo<a>S|`wWRmbxz#;RcW_Ag;P5VqW
z8-BX(!*vB)S1#DaV@|m5(Y=Sej!o?|>zv1t=D)9-d3(p(TZ#Qk>=EXC^w#1*{hj7D
z0^iK|X|q|uf~8Y;9rm~!yZgXLjpesa7aI{Xsj1Tpr{hf<TsL1dG_+FavRh_zT;>e(
zUV7na?I-RgwmS#?SgujHX@vq~>kKI0qIL0hEk@R?>RfzD*D7s)?oufHOAni!4=?X@
ztu<@s?psZ|zFyJhd9qk~&nM4sUN~j?Vnz2BW84<_bnISXQdG?vSH@m<O6lR38gbdC
zVf^9-y&Fx9NoYTG*^*R~B)576d=|x(NpTsyczu~~3chJNzgx(dd`q5mwy9I7%FDnV
z!?qWT>s-EOz%SpeS(w^%&%Um)ZTnetXj$^y&+&aWu5<r=ZPDum$NM$AS>eF?R+n41
zyghk$-9H-4AN_M;%^~CZoZb6)_Ra&v&JJ^rwT!j<ZS3^VM>ahaGqmZXWfd&;j$Jmf
zgw41ehhr{o^}F|pRkZ~btd2PSl)69F=9@{)ENwbBIalYalDDUC{PalG0lmMwTVu@1
zPRm=}KR9Yo*~*16*v^!98tBk|+!R0mV&@ClwZ2j5V~hCR7BigOe_ZnW_%$O|387{w
zW=V6~O)6v7GO<toLC(*<vb#O%+0lunt>Vlk+1I&W?%B|qQya#gY|ysm;efSkd>cI<
zRJ`}X#Z@ottoqBbx?7qw-rn(4kv<C^thu+T+r%*27c+Y7J66GZ+??whPj7PXTDO6p
zyoRZFq2I@~wr*$LuGYw^?u8mYT<^T3`0Fye8y|LXvu|!Oq0mv`oW;5PP3ks@yRs;4
z-0HrK-Mj2O)u`?E#6_!%TO_r!+fil1+A?=K$2dl(n!FC3)x`8*<*w%(Crp?(H7s$%
zoy#6c<9_!YU|PBM@L6#&0sGymB^)kOq0yw2TdjY%v-;4Guo1_cOuH9)Sbk7K^|TUu
zJ*QgkZ87ppqgkbI-Rd&Gz32CzZM^!h(uEEc{)q5v_4H0t&(sU|Hn(nha_^=7_1}ip
z_<B<H4jzpUzO)Rmu8}`%{$A@5N8JY4G%;;I)VEd2tHUq1bsCa#e^kEusc%l1yjsw7
zM9l&%>aL%^e@$HDLhB+@pLZ#`cH{UF1Nszu_Q%VTZ{ONZNV0g~GWhm{C)dw7y)JjE
z_k^dRsr#-boVA|%`Ou?H$}a3~*~GE+*Wq)gc^{bg#f~i_rkT4QGK(En%I7oF=gFmq
zovnMkU8{<d&5B#h9^qj%IQ;AGzkIXhRqb*`pS`S%wMDq_Th&8WCkuIWuIAXTWMdEC
zV(s=f37a_m=y$WsVr)0g4K_=u-fULbjqxKdzxr!aaP;AZE)5orTs85=*GrcBoHgw_
zZ_V;kPj?>PytkvD{j8!leHP7MlCSX!yH~NJ?63baWM_fhzsY7ro76R3(IMqw*oyuZ
z?(O$4i3vEd$#wd3^TAe|Mn96@m@=k;XW6ID;m;?I6#u%oZCT}fuGO1`#7x-hzo6k)
z@~Ous6^Ki5YBS!gkwu|=S1*0vsbt*zm^-(NeUy05W$py?3iShDrLO&J*0QkHt^VBZ
zd*Qn=%{?aEJ7|;QekHDX>c~M;gRM%$zA0tpyw|VBm|Nd1nN|Pd%(#`;C;VC9X=KeC
zC8EFX+U0QV{3Ul5NvyVMR^jrehn5dH?z`vV;vZ9Ae%Y#)?W5SeU!*xC_p|uiqREu-
ziQitG{-({b5UWiu-8yx#47LdM-9Dm#@AxW(Ln<XWcIub()3lC1uBg#r-qS}7owl^K
zxnO$f^_eT}%`Vrd{a4p@4SMdH?X=$GLD><`<M%rxHy-L4x4S^kGN0XYPWmaNj%lr}
zYc~oh?x6v0M_rP}v~8Gw^~|E)9cDjDdHT!InNQx%T=dnxd^@&`x;|=J1(TxZD|^I6
z_+j%La^hOalQSaP1QxsVi`#3fi)HJ6?sT}ITd1pB%#|h&CI;I(4Ye9vu6_LqeM(GE
z3m#QvTiwesFB;8iQ)umX<}EB1o1{8K7JC*^X4*GTwpVPpbj#zJNymSUH}UL#J^sqD
zF`HI&uRAp?twcvp&%@D?Pg|Dv$v^)imt)C&8g8(7Wbt6ecTtDihFL9i>i1ppgo!N&
z-n`z<%Jd`m84G)@XzcGa;c~5yR(m@InsgJU4gGwC_0;Xvdz4E|wCc3~gxMOGgjS}9
zV_H=@)G4CpfqnbSKAhF!<knL+SDYQQ`q@bP{9D!srfraW)pyzx^hIL3&nl#R;dmut
z_(12$&f^}~@Bh52Swf8Y^}$8%g(Nl^BZOKN`Z`&DBf3t3keC7~Nhz_rCp4TrW_8H-
z<r0%WDZL}{udr?7=L>@$M@_!kuK(50HNUvGt(IDU#>35L`|s*8yLy`!uG?3-UfVqQ
zP&doT`OF6H>A%4xdGgfm3w?rJs~mSpvV52@tIC?M)*bkK?72UFUUZ_tn+fOBHhfX!
z&F1sN{Th$j{C4rMB9%=xePKQLYM%v@zHC1A`J3NPO~2jWJLO`{0)rFc2Yc-8oaVSU
zy2PuOdy1Od?6TNrnsDUEy)_>_8WTHbS^MTe4~uwzdE@-c7M;Z%qEKSwkiYiqNPJa)
z+xU6H+s#{le=+3k`TXs?Q+_<W@0Uw8#wPtf_Ccguxxz0@wtF5~G&}CEdk>cmNinh9
z6<=(wFldpNkK3hj>zAFFxS_B2HScn@YrWkp*62LsRk!WljYn_3x47rU%0;~2)_d72
z%52&nsm`NgysKR+anW>p=egaidKPQqas1Anh6DG!uv}s>HhJc<6>bB)_U>6WaL%N&
z)dqI(dvdeq)g2>l?s^jN^R&^MZ+P!MyiOSW^nTstZ<4mB+}{}KztLlS>fxxA$@j-U
zFpEp9{M5tEGxflmq%wuuwz9iozTd4u10T2kmh+d~Eihu<ffqeuzC79Lruo?oVRsVB
zg{1yuy0^<4_xe5?OEs<EL)M|h#TFs2i(dJ{=XzDML7%6N6pNm>@AO&uo%KD=I5>V?
z{!yin)GAkA4X)F(i~rAEKRtER{)^4EQ{2B7Y-TL$;oUwg@{?t4e*5d~Sh2WEH?ze<
z<(=NVUA=NhiuXuig-gsN$2tWT_>Zxw)%FMH=oa4l*E-yJzF+iuKJ506#QQ(*K3rG0
zzu9)>x1(1tiynG;{qdW#uGlv0Gi$tQImZ`vlkU5&DIYtoLvZ}%qI>$c**kZo5b8Fy
z?lRxi-;Zfy+UIOyy(K&Qg?9dQtN8V!&iA+9DRDOTqpsTy*Ab=#4ZmJ7DF5n9FBUbQ
zlCm|~Z>9Uo`GW(*&I@E^V^V9rO)AqucFD9<g;Mj9T~{vY)*>n5azd>Y`FC%bcF2Be
zm3hrZPMFYo<*VX7!V9HciH?uxQQ_oM$ND`>#<Wh^6bNt+79QE`?Okr#7iTy1O6f2(
zuGi%1e>7=OXu+hyj$@rVS2%hidC9a>V@p=Qvi;VzRVQChDB8uM`>p4#?lkPU#oMd#
z^X3(I73ftV{?8k>;`8M33r5Upnra~yJy>e^oM9#Em=|j@Yit{{<?$s_c5VEk>WngG
zmsh53E3zZ;@yRy5ozncKxjYV8U$(&3o1fQe&_m`uVedD?Ug!U+UxC0e!Ew#fdZZ+k
zsl9%Xd`*R!o$3{t96z=E@)0L)?n>$Q$?wfa@Bh4sbIpFO!kyB7x$jojbZY$0^>fDV
zNjY5K{?WR+e>IHzv%tll7KER5n9{S<<)Q}*T0V$q=Pb9GQs8*}suq`bwz$2!z`0G;
zOq*}A`t?`fu5s|pyDJ9|dt1EPGlw-RitiiYbuFdI=LIL<H|sXJ=fi2Aj~&@^%drhU
z4q}Iw^|!wMcEF2Yc9d$|Fn`?BdFM-Ae&~`Mw12(*%<(m5#sp7^9=zn&)%Q=vI=}V!
zdh1`9=O<QfPCmSC>G|qI`d*Ls`nczy#ZlK<A8dWKWZag~54^e$3qSCDyUh^!_?KT@
zpJcP;{^xB6I-l$lvb$AEtCVdamXlu{tl6@FPpcnlI)7T#v3j9B@pV&{d9J=$@rO1I
zt4=XLBYyKJ?R?qYCo2rCGSBNq=-$d{ua*ohG5)Om&dB9|rnGk3y!6}irJfCN2#GD6
zc6I!Px7Ej7j}I+9XYt|bUv{@~?^b=lqpkL{;(g`?b*;H|%!MZ-qn+B{v~BtFXdl_t
zHj`KP99zM4;{5^9soS2{Ux@bfYccTPjy|tiu9Vj;QE-H7k12<2D>R!O`9q`8r<!dK
z_DFHN<l&lHa6s!Sg%UhYwE3aU4+#w&ocFx28S&E({bg6fj~pzzVEEyr+8c`8+&60T
z)tx(27nS&Ne#or07@NP`udvwm;jH8yEq<=s<A<25t^TxpY!-j?%a*=qTWZVr2W2MK
zbFIB}(&9<KPCnRfU;EJhiSipOE(a$DhJ}1wX+x7L7Uz2Geev;(<rCfQXKV?5(7cF8
zgv)lH?}|Jbb7@3k{zDztEs6SMXVnV%N0`^0-pry$g`dyNKYsJbz22REYW7pJE`OX0
z+#KwYI={$lkLy(@x6c>9yNX}kk;h7onGoB5UazQQ>*sk`k9l<Omj~M(e3jPGM@YKp
z5q;a@q;<`GAp^FjeUs);zNP!!Ykm`c8?e<q-uz^r2WK1fZ*dX`JlV(B>5>0$wSEi^
zJJ5UW{wq793w~uYvO-`()7_H}wB6e-?8TOoQBUn^iM`CLep}iy>E5(>k4V?l%g4^v
zb{rP$W>uj<MA^T-H2?nQSZ8zB35~|zJvXRPWMtEGXWMk{H*xrY+3mki$X_YGM};XK
zqwj4`tJZ&CNR<MOlE3shF=lt02A<=e9{lEuu`3Vsj~u&nVx`Hqs#qOc`0b#*2crJ$
z+oH#~-K*Ljii&^nahVH`Z+Be&^p^_pfMC*9$1e+BPWh^O%2(B<+E|PmS>mgDV^80#
z+TQ#727C4_O>MYjYV|9<nwB|Oeb2=)B|fh6GBj}X>T(w!?5h}Es7}pqJD0ohyp>RA
zs7KX~{WjhydF=G5Kil`}FztuUgZe&ucKVOg?Y1T^KGE?=$8{b1Z0!Ao$>v}e+59BW
zNp0qu*Lo^;v1oJB({cQo66-GA{&wQd{KMwieia=UH9jfz=iVDzHNTe7KO*44;iwJw
zA3N`x_l;TWr-K~MKYq~Mq1@%LMBg97OYgY3Frje!#WTL0(SA|vwk8W}gnaA$&Av$w
z%a%F0>v8kuCu`Oo@OWS?yM~^(JNOhC|69%4j+F|`PMp|m^R}1QB0HZsv%FiEA2)3N
zwd)VN<9^uoXWWF%%_bz~UvOf?pqrO1N^PIMz1Y-vmqH7?tGS)<Xglt%$E{{1L!Z7l
zR4BP<zO~k4Lf&q_IV<|@ET5I%y&UB9r+HIH`;lUmzh1lDEOsZ_{&bB|r<clqJX-&^
z2Hw-ZscJE}@Bdgh2ll+WZVSgrlQec?t7&Z8w(Z8Y?KF+?#<p$SXl&a$JKuGFK%4!n
zz1CcFj&YAo&9gluDMDR<QXrV6O&59TfkiU?36BiwzNPFdd+MqKJ;Y$_bvaF4923o;
zlDRcM3wCcx6OHJ^39M?1`y+m~PFv65108fURHke)WlSgzd%G>wz3<Fa0B>`aS#zV0
zzPx0&1R?)75mFbXmSqj@u9?nP3&cotBYCS(huDxpka_YwnmTf&tOud%LXj3i(M<(6
zX!bdRA!p+t-?+*j`NyLJV2Qg%<Fa!09v1$Ix3|EG)v)u8o$ZnCEB<GT-rQUnc*-6c
z|EbXPUplBoRImMrsTVml`VKp96yAKgjO@>G2AxcOXQRlr)6;Sr>zcYIxuPYK2*WeS
ze_N#<#a@xm+}M09go&g?QAW9xoYH}!*M84hh)Ea8mp!g6!TCBRsNEbv!a-TN{>C!w
z-XCYG^W`GG?X@Mg@W-A6F<_M0!J<;Rf(wc5Y;>ZNu<g+|7<RI=x*sGYZ^T<T&{NJM
z#$KhnMj08|yKl#d8GPOez>koYlciUsW74HlqTRD!pP}u2Gocr~k~x{=4y$p%=}Re>
zt=21Z+?~|n?XpkQa#dU2SUb$w$XRcK$#Sl?(|1RQb2lv{=U`xyDpBW03ZTzlKb<*t
zI(BMv^5{?&2rglq^Fd<%Zb?oWK2Vywh`%Vpy`8|=O<H1e0;UsZvxMgHALh~qQg~{X
zeB)#G*y9snRu$OO`X*@iC#Kprxh%V@hT@ovg!<M?yy?gQWr>D^VI%z$&n&5$I5P*Y
zjFn?5*`Je++jmrSnH+sBiBi&0D#NB;xJy0UcBP$^K$$E#fj~7v&!sf9w+VSpz2hyn
zv2i@T;89&{DrQM@3Y;evPcYkkjer>t%tF0&Z1>p4t<r1l7A}Yi1FHGzI&;U$v6F=>
zSA83gW+no#wRDk?f*1s_rqAzZ=gp8%LS_sy`%zmF!Hkg$Yudq3Kr$hU3UnDvuLVgy
zFZJX&Keufk^*%zU&f7eFxUSiJQ58gxDb4z|Dh}6&v+R_8r2cGzdH*oTBAHz<i{cpX
zN|u7eFf((%f796TxJRGN=Ir@*hX#}!LEg~AmS6c>zS!WtU6>H{Z8|s=tX!VZZ*Ox`
zPXlIZEgh|c4;Q+nFdm>I$q*+N-OhNES?W8`wjDiHzMnc9?Ox#yB{2C5aTX`Dg%&fU
zL=lDvmd-8@Ru*Y>>xCQEwM}|Pp0=@pqKO_P(XREL9n47{PuLiEXc9adH?-5J>X5wh
z;{@cYAEYNK3r9AceH>yfD*>D7fxb_O*<-E`Z?t}j7!??CnSZG&@b`X?6I0v5y^sW{
z`D4d~U2zS{4<Dvfs&drO52Y4}OlE2CjE9TJ{`$$NlbMquH{peRI}4AC(+}^kLc3xe
zQsa;sUc<oHIRu<6*QLdl8n5J2*9&{w-+_T1?=(dxuJ5mvyNql+6Q`I{w}Uj88focd
z=@Q>ZtNyA7s;vETvz)tdI(h)(?4X-a<&tr9X`4Thad~)L*;q5{QUx}zIJzJoBo1(4
z<8Hd5cIpyg5tbe6`l{66fjj>y`zzJs@%H18^Ci2z<n7~d>YU5d2A0s#46~z-1ZqUn
zSXEgU(np*#&o-;R%OhXJB(5(Ti>8j5Z77(jsM+g-7E><U(84C<x(0T@3t{uo9`{z8
z<S{R3o&_b!iV_nxgQuo{zMuV2Hgl`Lms<%H744S8hITV=(HsTB+iHvJLubeyD8{st
z6Lv5C#J5aJ#!Me<`Eqy}xkT9$C=^Da!HV`7P%yis|1BKXy4rOgOwz5jy}mb#W{TE{
zRIC_w{aqBP=ltEeu1o|En~!gBk3GAB2AAU>hKnWUnH5g*i0R7ud}qUNc<(+F#mfd+
zeYZhe=IgM;Qkg0*HVJC`2=03eBO=<slIr8#xf?fTnv#Kac+*nXem^Rr%i;TXPAYO-
zTJ_bW<-&1nfdHL7=09cHxG58Cnq=T2w3x0|Crlo5c-^1|9;%)bZ^vi#N`jEsm^&7z
z_HcD`(y~#BW2OYBuXec5L-xbnYOTcRVYy)~B@(ieQ#0007LA-1AT?{dIl5-Qt<pVD
zf0WzgqbI&La8|ga>tcE9l=p#32GA0<|1|G2pUqu5C$n$%+)?{b^*S%|z4PkKHhVcH
z4y`D8Rcno*+LwyC%tGDM@xKJGB93C{1?Pea<_1c^WQO|Q`V!qO&8BB4LHj#Yl`i|(
z+c?^QApVpyFd$jcAIUrM#2WI76)5K@k0(x;Ug3ta%fj@=QTp6S3L^g(H)Ve@|82u-
zpZHKNGoMrSd2v&s)nxy_P$PKk%_8+-CIxIG)6&tMfAAC-2kI%ACZ?7NBjNTy;gyz&
zQlLh&)1mm;64NVoFN-@H`R$4Fn>qB1D6R|6n(qT532_-#BHa<TsZ3S{7`r<PH9BR)
zHO0YA<>5~(5?i<%{41Q};!1du(G9C8;6a$!SVm|LC$IXNHusu*?!1ALfg*M5s4Pk5
zwdqL(<|PLXE=9fTj&}RpNhU80(MzAZBsCVEop0KWB~%l4xO1%ZRqu*04om(>h5nq`
zbY2hry%-aC+UiyrdHD*oHIl*H3)c)7W<?ww^}}cLXf4`*=_7#7QFw*~T}$s<@un|6
zQ9a&LN$QO{8=Wx<dC{M1`(<C3;~ujUFyjb!5EOenJ{NLf_ShRJyOOCbuG-#T{B()i
zXW?YJT`7f$x@~S*YLi)o+H~8TlLk0fz;K#%%BV|~IP!!B2kDRsufZ2+gxlHdoGx1S
zUJ(!&nEaeIrd}XipiG+X{y=O0XoUcacEe#xUPda>yK@F_R6uN>QQhXtk0s*d*^`Hs
zE|i9!0j&#J5}wAhG~v`<a*bEgP=QTQ^ax+Iy`lkP`$ji1p{4Gesog2>(9c0J9P39=
zY=@7PjGTXofy}*B5I0rB&ed1d@rcm%zDsZw*razjK1;l>h&<&C=xlBL5F`Po?0dHy
zgJUMJ!Q8O*TzI+c<TVm$rk?O*gkV5F&cQqRxak$G_AA58#Uml=lFxC>TE6l(DVc#i
zZYWUGcd>9LFkDp^ix<*^6z*6CgcE9E{Sk?CokaG!2j)GY?a?;ZRDG`4^!F3ZYCp{K
zKyaa1ZM*x+<9pRN95dzyQwRuePP<L~OQZA)vKgQ@Z&R?U?5@WxeBL^mo)<1V`m8X4
zUBV;7o80Ft%Bt#Ke+A+gzxh}-M1wv^W5T^e22ax3v0<bER+#Ofosxc_w&|HXb~q)E
zN6=@VaoE`dRVi3Dw?CNa+5S0GWPN##>izBv69#%Me2uj0S6{7&C{r12-n+o38g(me
z2s$+g>9(tKg?i29Lynp*fljBn|J@%hpDZ3*RN_g6VK8pWG$pIt;rO4$hWkDGM(Z0a
zaD<FK90I&p9nTK=z_Aipab@oF9)PBMzf)_gg^uP&I<w}_9rowdS3YyyQIk4lNfFp*
zFUb%_h<ri1AO-27wY-%Jq@ZoK0hU<@0|T6e$Zqmc*~tYD<rK->lVd+GIgRHfIq#0C
zJvw*$EOz9j;)<~4M9O4jY>f|}T`brZ+}k<e5L|Qf`8@vIX!Qz5b*xh!C1XrAvz6=|
z$7<FAwiNbeA49-lOQ^M&tLl<DvlgiyiSTR_G3>MUXcjZ+HUXimp+|?GY*q3i1h=mI
zTpR*!DkvT3DRJvQyMcb>YmI$ao>}!`k!R6l76hSOl5YLs5985ZGUS%1T1r7(F_|YB
zO$bIlrit__?Y*T9&(OyWugpZa+fWhGq25m~pn5W4%hHZ-Ke&Hannc~79Oax?%uDh+
zW&Z=~PCiJzSDX4@k<nMrNZiZb>(h2aPC_iAq9fQ0Uuz?+{rH}rslZp+;XviRuu#Ni
zzIROJ=eijj2tIsJ%=Xc{=TJ0Cd?A7Cj(W#UUouR%&wzrJlFg)~veE41zxlT9`F8TS
zVQOl56Q_TRHH9e}RGw{MV9Kci0<RuH+jLPm{k;=M=8@;J8oW-M7M?{mFRhYA*3de^
zORLaXf!P@{E>hH3E4s}><-u}9HTK`1Bp2xSiOnFskKLl$jiMqDVSO9i<M5F|Ga3X3
zP2mlGH*j^rpZ9p!;f%mIXqu8)eluy6{Ct1eHP%+8XX@f{(vlw+bA3<mz0r4k0#T*Y
z&W|JlVIYna0(5mV#}D|h#n>dquXKKg?m`XAXa#Gh3bxD^jjM9A_w1DDy3!go#_M4#
zW1fi}7f)_VQ(3jR%vq}**=b;u(kkJqm*Lm7*h9Bw3Uoy6vZIlz?rFZKZN$+yW+|Cj
zd*@?SSErl4p_d)k)If=S`iMUg_SueC)qeq|fa{k5I0%D(6c`Gujjl&`9-)7M*R$uy
zF*r(A`(dX8qEfJa?l5gGZ`&ZA6?HQPiU-c|^Qx5iN3Kn@Xx`AI>9FUfujR2{5y>Ca
z-TKexE<(@k+*2H?$nAXUWMvK#^I+tYO9H2|30c{jm*CsChuF?3t}4BQ{(rc^+84{4
z1VmWK4lT5iw~iJFIt_f|!Wx^ag=?pHe=XI9XlTdB<*5(sGq<VzK+iqO*4-7!Nx>5Y
z8elU}jYSOBzvp%2W0F5yzVjK9msPhtW-h%tq47JTw5!iQVM}Cii2TaYMl!*lCrI*H
z_P?3}e(PWX+}rBo=6*+$u9<~Ph&HPy?HdUUi6B+>?tCwIuYRY%C>zoMRgDdAx{-rn
zz;i0LWH8tyy%me{v6Cm2l|z|K1~&tGT8=T2hVouQP8kPF`hVG{_mi~bd(@nquv>%Q
z8H?zeV@Cc|jAHw%`OU%X5|S9byk-rZ88`fTyS&PC-88m0eNlfB!zC8vO*XN&`TMvb
z&0f63Va}|m+skgyu4wAu6(!jcc8T~4Dkp6=yn$=I4`chX--~nyR7HUYuH1^&%4X-n
zEKqy7?cK?Ipex;OQb*eNK~U^n5!Bw)U#d6@Gvz#14&P(TRz6dO8l&0ig88dJ_*^ai
z$k5d!W!lS`VZcWWG|g6ujC|WVXFI-|_yopg;Lc}CQ~~a-$v7sq(sx4rI+5Ep4G{X`
z??|Q!lQgxtF^+PP`v|wT4cDaaS8ZKxJA7A}Xnt%ALbV-H($bzg?5N!u{!$6Dmp>W6
zdJ!Mlrow|cHoVVOHau^gfxd<K71weg_WEw?>-ye}mcsP=^XzJ56$&(Ev=b8#r%)lU
z-lc*_qTY=;8*@3Yto+#9L4=qUc6hrB*fb%vb+{=?Rq^m5pzL(pW}mPWdI>vE>We#5
zR1V+bmGYT~N#bwiELwGd`NQopddclJ364r>+}`3cKFA0jn93u~WP#=lI8H!+abP;T
z8f_q?qV%wB^LWY$()AO98BUtYL9|@gLA<fHPzh1f)8OWVPYD+@f#Mb>OB*!94UXeJ
zi{6zAwM{vC7+XMBAeCgo2%*EuRNj!2g`uaQuE_ndVJw5AMYu)XjoN!>2nzvs$iT2%
zkSLi%7Daog=dptqdiSbR%_^ywApZ;!blX**-2-a}j7$Lo$z5cNj#|s(W*y&Bu%BA*
zt&HMjk3tp1X0R`S!5s7q%nqM@=zY%jh<;Fh{E)-ZA-;)DZ!gKw3>ZqpcJkQ=T?3aW
z_OZy+t&Sf&oIH7YDJ8K3vp0rb^L6SE{nK;*ITozR6QN8~M8oi=#(n@7L`<kz`7URa
zgyxweLJG-mbF9|OY!o*SpuxRe4R&n59{o~YsP^z<DK13%{Tg2tVvW4mD32iyT$-ec
z*0`h<ctx;;;V2_14<S8g=Zbd*Y7$3W{JZXg2wr|)rFX3yK4Pw3bU}S*ijgT4xns5y
z%o&HddoC+nFi292SBkv-YTOQGvvL%v4MNmO8KvQIlv@Q>3l`5I?*i!Y?(qgJ&R^mV
z<~oq%$zo7(&RHvDLn))O4~`K7cL-<fgOmu(aQ{ghKY#dMZ5M@w`)!``;S+35hMZuk
zA894$+vR02NHB))GnZ&ERz*p!BHldHQeYlDZ~Ulo__(72+8ymBJRjv7DkJ(c#dC0q
z7yVN_gueRFk`mQ6p$t;?K?&%;cM|drEATDW4{^Kn9kGF+1yBr#@H9MwB*+5{&<#+~
z_fYFOkF>Nj;0Y>D`0Qr5m2Cyax1U}wOT-PnWC2s1_XKY)usJSqAMh^0-D7!-(14dJ
z!a44Ebk=DhRWkK<$6TeuKGjy$H9C7HEs4l79?Sy{U-;nC%9B=s5v|&0>r?17AKpM}
z&k0$ye(E4E1+59F#k<Xbid0Qf8#h+)ez!9Iu5i#P#hX~5PKhh~3*U|if7hUx+8$-j
z(sh<2OrgK&H>4Ll%oePo%8XJ(M#GWLeINN7sbT3RY5naJ!BYiV_dJ1D_k|aNP72Fn
zHl@LMLRd!ppMJtA7?`fp)^X`V+D_XJkMP?fS$bWnUECgn484%j!rcmM&VI%iqqK9@
zbgs64TAN!Nt590Nz|@BKB^w)h2=Hg9=dzoupF>g!1S4}~s2s5)be`_K;$!m(5oJ>c
zI@ELnGvqB36Yb<AJr|2aNy^Y;yAWrUQD@L=wd%LrIQj_uWQaWpeZK%gN7enP;thFJ
zTZe5+sYN!_Pc`4rtw(~-K72jUuxcgrerK7<3gc*oIYKjjS%<DQ+hVSs<JWhfG28l@
zl7P)D9TUrk=`d^--4CeRxhs}+dU9jZR?$#guPlp=jm=GsJtu?YYo5?ftvbND3Fd`C
zq`2Aeg&$;rm-a@2U^q6f@M0C>&6cA0h*1NsQd4^u@`~m%RqV3-KAyo*6Ukt~(Vg1_
zM=}I<IL%DDbDL!Ph-~!CuDHRK!RTcr>I@W`CO8F`F4U0qt;bJ$PPr`x^yyt1zXFjk
z&MnNS-4^sXkvOJagAL#2UR(G9uNWpNxOV4f6x&XR_{7NDy%@KiSQ%OYv>EfJm32P-
z-;R-ORzJ$Et!rEA`X)C(J)s*yMU}n}+G#CRA#8bF=^m+N5fayPBIx!F+;T5AHMY3B
zCOMQ0?>%8T&M6(=Wu{{PJupqp%reeZ1ZH3PVKaNYNAb-|ijYFopoa&mv!xRY^sTzF
z$~z8lW8LXFnA<^DHg;!XVNZqx|5G-C(?DS1Gkl<Jyoj425y$iMDL%jDjK)duM#H2=
zO^q8TU3Pp>Uv@m>9Li-Imn(DDQY4lps7p1i8CluJYCWp9xSS$1T~^e#wyY2csN}6!
z&wa<omwnzE`~lzKM!H8M=XXb1$2x&jzorw1Q<<1x6Qd>>rA7_Ro=jXUBfaCyK=*QN
zH(vlbT7Z)3BQ!ad4}(S)Mf|0Ya23xS^GdP$5`J%%^UpwG_qYE$BMDCZZIk%vDg{;_
z<743yG1X&$y+s--2|Fl}vM!H)Y06m#&}@tTVz^yaEV;k$xEGe8im5(TG(ZT5cPtoM
znZ?qu*<SaUsXaZ7vH()OMFW?xy)Z6CD8<_xuN4&2O?|dxm~!~q@74}Ftv1hp+Ae@-
z3XCRzIP}%~9XqvVXlk<W9XRS>9-4$B7o!X?G?+$u)QKR4Ox?69vGM0eowO4dA$8I(
z>d53$It`lL*?S@p$bk;KPqUE;_1$OYn~NL@U?5|I<9To_`Ym1d9w*X{ODj<$v{1Z#
zV}QAF_5?lETGMWEPmitg=}G$0)Ld6P_^{!_7rpfOE8BnTv$mmxI$krE9aNCB1OJ@&
z{{G?v)KzWiX(PSrdUS;ea5IX)`Cg1>^_(b6c4T*6!DX^qc9ibL>ue(<#$QlO6ZN}(
z_*^-@Hrx9Rp>71@-+7QzNldnm=VU0(4EStMP2YY1a(KathHjUef9gn{#!33!m^k7I
zkdSX`_Sj|ZdU~VI*6A7<9W>=MqLU3L57lUT+`9WmDslASA*>)=wr<*`$~P{l&Fvil
zR2m0BoHqQ=@0J)--y$vkTkcUAL$Vnhv<bX{#I#b(Oi6yqrM+oMbYjE5=IdyJD|OiJ
z39W<-=YD(12o1Eopki5)G_x=#KH`#RK2<t<OZzM-GdU%^A3s`fu5ATzhnQD?vo^Xk
zySoOL0WbFXK3%)3WBlcTZo-9=#un{Iin7usTU2g+DSi0L3ZK5CXR>CVL<TACq^uHM
z5`x8|9y6)xw}3d=qSs7vTt3hsW)MDT2Uv#4!CM4Ut+STJhFB)Ctr}9Y#3}v2N*ZGH
zxWs_TK=_6;HBhlH4{o4E1L%VceLNz(cwLQIR|u!oY#W>FS_g~tv=95HDjnV@8EH<_
z0Z#xX*Gcn&67~}WT!}4$n6=3j(3WuL({bm2%;S9j5*~o10yIPky4Rh1L*U+rB$`kS
zC5*ynL3q;;K=RUuSBE(KgWQp<(nMZK;B5v;IOx}F^_lqjUGHuEv!w`Om)avi0qe4W
zim3mtA0l}&<KS*qu(f5++`6*fy&rJW)OB@s-(&f9<u*U#^t7J?G&^RdcKIq?W)EFu
z0ITrCskyCjQuo|%e}QGO$raEmafj%cG|1AiKdxem!u!dc0`Vtgxz53q#~jhV3$O&z
zhuig%D$evfJ5o%}GIWVg?CA+gJxHPZX-3*>w|o%1$7*NNCaX9#>OC=yz|_CBR`%`n
zW0}d)0<-1%VGzMXX(x86cU{+lsr&EfY@a(S--n)GPkWK4*5_v^BG)kTCEOedq#V|~
zC-=QRassPTaR{23#Mxs8<H()E(E1exOK|3mYmY@Bd{a`W*Z$N;--3_(<J;P-_>Kt;
zB@*;J0=)9za)=>}lFAthsjI~~_l%CXKV`Gwd|Eksde7hi>qLkm$W1$6hQ!&Xs{H0w
zj_;6yz^A`x$+otkO)7&_O!JALKZoz*;)F9GpH7ZXypf(wh&P=J1@<*Pj`Xh$(zLZR
zOdm|cOM91K^89xI*xDf6HKcJidH)fK>=TX@3(As19DaEqoPx3d86*+Hy)Py_Y{oRM
zN}-;XZer>XV93koBsgp<xJsV@cpCQalR7>R*F|s7&;<7H4|pyQ2r#`@8cDGT-@_Z2
zx$uBzL>WYmARgReM}VtidhZO#tAH#o6zFy-Vxn!DfQ%>}hoQwz87*$Y6DN~@xa*|l
zdx?$>d80n!h&$a`SqBTTKu^V_ymR~%iu!=tO@hUo$~?Gvu9H?PbK5vd&KZ>GJ($GT
z``143n(Z_AO5i=3l-{&bwUBLc{xoe+QLu1qXZsu6cbbhb0A^fTCSlAtwj4#iyOc~8
zC079F>Y2h4@(Oaal<^nwT&Mj7#7&^)=u{ij+niYE^(lJyK2MytKt*6d5PcwhUR?Zt
zu)dNH3Yl2DfRwAv=^7GVGb#?9R4<2NKW%PzfAIU`Eim@!nIhZX=$X#5fz#lL7K$$x
zqrAb%gXgc>BE8{krz*uh@l~k>#g0PoYCUW<W>EiB6T+52m>`A$hOuZcah+AjK}C=u
zlq$h{VU-F<>hrgqXmkc2aw$p`eFP^Q<Kh|L<E3}Gm{@y5gRJLN3)trw{Np5bsfv}Y
z!5bZ)j}f!>&k-{(`%_k+GaPZ<jpk!Sk}v|9P)%QZoLxV1$DdpHcGH4uQWUn!F2?v4
zubwUoZpr#B;L5!alprV$>YxbSR32~4*zi}4Kn91irdC-t_l=C6qct79y*o<PDZ4JI
zi9)8V<EJLNlX;6T(f5yNwb5}|8Ac9XQ6jcg_fJrnyVXTj0<Rl)kDJYwF@cKf_Od}y
zFx4c{vVjUun*TlB%fNS4wkGoiF7MmtFo7h}7z<~hsGQyf6bV9pkRpNV{gF_}ge2EV
zq~dIzEb#s0dtYVqj^1k@YWv*q4fz&PiF$%X4=0UnTpZ0uHB&S-^2|Y(#XE3kjP4p#
z_5tO7?NK*Sv5)Tav4UQ?sUa)plips<`^mPE{PETfsNrujaz2A{d@n&s(K4+aTjJEh
zWfmt)oM+(r>X5ZIzF3#I!x<hISTXjWPn*2=4YqFeV9nK2wt!Gc<iNlP%J`kJuq2$J
zes|GX2bjst<ml|T$1MuU2SYi(J*4L>&K|q8xF6CH`1mAQHT_*#sY34boB6PfB$X&;
zOVe(#PnYX#o;>%Yng8+q4B06hC4KrBk~wX{hkOWOEQx_SK_msqU=WLms32Dh%^waE
z|2;(PgSBmFKKnDd_y>oj6K;wiqL}yh{naQ2K+^&mg$zyYy}e#sqy5?8w9n&|qqvDo
z9o|ll=-4W4BS+6rLU_d22R+mLN`+NEU&m+sC7YjhjSVut*gaJF6Y?WERc#-zQ$iYj
zh#IEHa+JV!ci3e^`2qw#;%(jX@AjtJM>Y?th$ME1qG&W#C>itT^i=F|g-TM)EPVbB
zv{;Z+@5dLuz~+Umzk7E!cVuMQ(a->v#r$f#&h2f;gFB+?BHQ!ZpiJeuuBn;tXWZaf
zarY`|1^7`cZ4>8w16)bDs*1BTs`Kp|#vVET^G+z<(Z}G~8|Ei}L;>WGIz>^4gb4X7
z0cU;YDJKGObrq~&m+tO9Vf&^;hv`KM=(**s>@0Su_<Y!>U6eg??ZzywJXkY?#ao|W
z*zXViE;TY5mzLe}JmybUz<PL=!HTOVUt~m~mO}aiMqgrC#>${kT7~oRhNu+d=QI=g
z%U2zAe5!yiFC-jJiDRibF>F#&^Oa9|akD3GN|4ugS(P(FOX&4GFCeLU-3&PMKHWJ2
zKkyh|VD7=4U*%h0-1)i=Z<|lxwPdO`xzOMgy(-mq41LX5PAwBmFLR~Q&nZ9HH!Zr-
zP2zIth~X%TkrZi%>2&ooq7~&Ef-N{Nbx^mYyP}aF_v-<i(vkGhisaux5cW^d?4p2?
z#mJ>}RK0|`mgiHo;qp=M@atYYxZ$ykK9EYh^hKcrZbJ=Sts-SwV44|ma?TLs<+}M}
z7+6@;hqASO>ITXPW7J(wm?-E1$A;Of7X2sG%VQUvK^M85K@3+3A`@T+R$sWDuKv@G
zKWveXinjl_lQ1n3HA1^fX2`j1b!VHf_jTHbdpM0ISz6?R7q*wKnAy2l6&($&u8}BO
z`*Ez!uL)J|jj~Y033Jz`j|4Lw7!#NZR^>OrKKO$5TK$jPDeB;+B%_Q$G`E^^QI;A_
zB;?<-88F;_d6gyM-z0;3hf_lWi$6~e$d_z3w}Fb*`1p`L5I2m8p@3G~=G)z{HkP58
zayY*O26!m{iZwyOsjEMb{vwZ^dlXZJ|967(6K&@xPO0#|I}*PZ<PQWHs39~Zp`uK>
zZ;19=;x#r+Qt`uzsaU+8EII(^u>HNX-<{-XbbWl?Ln3LQ62)Pysb9tWtG3kQb4X_u
z2-}0)0H#b7Wyra%+XYs=3B`;vItu!;lrh{=fyF`D=uRrIpCEzM%BVbAVrN?5x4^W(
zov%5DA4srv3}Bc8B9_<GkE9=ONadQqUu(M9FmiW}_Ne1HBg5mMw0OD8+1T26f%+Ol
zT;+ePm{N&^=Z48PrBnO)yx0o66iKbNXf>2VMq))??V}VxqjlTvW}2gHOhjm&<~9ad
zHcY+paYGV*iFXc$8NlEBfI)c16|MzlN}zYMzBnu7_}rcQ3`Y_{Uh{m_ZmSy~Tx89(
zab><NpjH4NtH4)j{ycEC;M@pRWZ13dnMuw<_K)ev3mT9b=Fb(0dZVbo<N<M!VCo}z
z9T3vrAfs;hsmNrpVLK`B9)U^sKLL@pm@Qp+yXN^bKP(~T{2ja!DER9Q-w|GL!}DDD
zlIqcyHSt)sq3s}U2vLdA@F<)T7dtI{uk`qg1vdFsrj~j%6^yj);EDl;A4bC|?2Hd4
z*efP=gxZlwiA3$4&D^@Bt+D4<rMAg$N1A9|zSth5Uz7>`v(^pjYyS*Q91}C&y~!yC
zum2&Fc+Wu3`YHTb1dWOzw&RBbQwg@8A7SD-Mq)<qDlV@8N7MxA<X?p8bQ7hL7=2aK
z51Zd44%o#4X0BVNIY8Tun}}MhmQ#^Q^;T1T21cw#mq*b>GahQJX=?)JG;8b2>W((K
zHXaYUqyz_CC;&x^)-GL&n?x)RV?<C?uG&dR2k*L>j+~{a0k4S+$J;FaL#hIX?c{dQ
z#qbW#-_j2dTDwU%;^-h2zWCaC3x<F#yPw2j8I56|5cMa4GeSJo#q;d!qOPG$EN>m(
zG;v~yxaKcq4B}Y3m{ssjz#bAc4B74;PkRDZk=;{-kj1EZKxsr+v*Eu0SV$2aY{TJ+
z6sM~p^%h|R2xy;T>JFQ3pNdIfz=~G2BK2O#i=dP=0{y|&#++91;nj;Q31-oSnWG28
zY&grOo(HFhWFN5-g{yg+`Qb}I4f2Zx3gSw+KF5NmrVok5@32)`PMV&N$Ghv^)wuKh
zZmfzW{R_KksPkNgtBjJSJ`yJZCIeR&4dA78=~6U)!x!4m^M;8)8Ti&gn8TL#dm}dh
zJPq@|tvuaT8YewaZo7O0QMRx(%nxpo?sq+^WUQ(`BZsvq2DS0LV8`lJ<W^d1p(?&p
zp5*<JQO&--u85ZN=@ow*eS?B%Gb6Epnc(<7L=^Ht#t!Kw;6NlgG9qka^S@A7evz8o
z+*~?Id?Lgh`u=xofbPTGynQL?$|KWUq@HjItyt%Iu)KFF9%9JCfm(N2w}~|^lPOxm
zEAcE(Yo%J(t+IWOj&bk+5mk1GpdvN=Ck#IVzI%(1tufT&5u-kI&3{w8C+t)#>$(bd
z7Jtp7J%q>dEXMLvXMJTIz##}@^mr4d%)YA}L4h`i2EJ>0_v4hIS^c!n$lrWFf&>*-
zq~S%}E4R`))u_4fmf9zR<5y6g7a5L>JJkXa3S<ZY?hC+Qd=!htC5}J^>IHN(d4-Fa
zvP?J0cNM^csd1GzGy5cT1`p{d4qX(}Bl@oCFJ|HFR|;AS>mI$Zpf0leYQ=qbz3+ov
zmk7(JF$>%MUn>Z}foRilDW1_s7$!Phtamf>#C-5^Ikob*JRkxL5(T`FC=ELOjoqJ4
zZY}37+#FtIkOP6gghGFnLE)2J%(lRcnRqMNIG=sdJPd|`J>~OrKY$P8-3(l%U_oM+
z7F=<`NaS@HNjQpMHAy=SnIFI1)4RmOb*l?zE6u52UNru{A&{ter$6&B7GA(Vk+tYj
zWo5H);e1cM8gg5$UIY#^V6(_d2*w<p`TZxr5N7IU4Q!F1PCvLh-<2Vk0pxzQ_zXcP
zCv)bl=_U|u#LdSmQFCkMlVm7hI$h=}zK7O?_f+{s2T++SHjeVP!1j0zR2Dl7i5>0q
zy4#tLn|(Hs&aISCmUj5u!1hxlGQH)~KozS9#eVu^oF^g#5rqfV$g7b69P7ZaGl)Ir
z_|5}Zo*kpbY_o_Sy9Gk{<9o1NWXlefb0)A@Frp(hqI|})M1=eMd4@q-k*j21xR*}}
z_r`AF9@HT@ZuAN2C)mkqlAne_+N@GU**`dlk;*L4)iX#*>ag{kmIc;38b}O4iwg%N
z1<;TOzp09qVB3K(5Oxx3u<U3VWxOZFZoht#Ppg4gHGM=425>H_$yIn1w-zJltVY3L
zPf_f?9`7w9D}t2%C6&+}1<mgB!{-$h8=Y0$a-w~LG4qcKD2hX7F5@{3e{J3NeRZAv
z4C)L=Z^>O`Cw3dQ^8_K}Ig4hnK(gCQ^COHwZSC;0`Nd8L;z1`4siz_)`7MVE?_b!G
zA527ESP?Ou(W9Iq_*L>!&rY}@u0Z?UV_%|gyc0^?rF-+mwDSx}oaKjXkx<(lSw!sX
zXEw)6rmF$gJ^Dp8rV{}eiAkmp<Z%ZhVdYFegX~>3SV|_evxu^tvOSjnUG|~-7w)+v
zBpL@r8)F3Qc0jOX$IpDZ!$b{Gk-`$GZ`BE)C*_cB^MRv$kILFDVIg}@0DF2RUZzA+
zu|mSm{|M0l3u1s8a;Bd&UjX6H?r7A5`giOkR?hnl8T7Ac%cfz?DR%j48rcs-bb<4P
zeemECHQ*oLF{)Vg;87eG$bWK>rnmsX$&#1&$tRo*M+YP5VZhHQh-dkWI0*Dr5yv$=
z*PL|4U-SocF^&pNL=xY$P*)D(X--&FK;KWlQ%>MuWE~oYoW^@WO12VJG#t~10k>_c
zkb?40dz2#B$EPe`&tlj`*u|UBcfIvXC}Srq84-vn=V22@w@Ri21`v{fT~3QQhyGf$
zU#zno^Z^x3V&L8iI8KXEXOrmhA4bbG?(?gPaAe6731g;L88f&lAH==z4+GbDzSQi>
zAid_-=R9Ew+DTYF&iK_JqW1B>VE)|k+vy}r4-OIZfHH^;5+DC^lyCn4VUrJ_FRo=D
zWa|m*amLdg8i*?1@rsY51_`w$pCdqG^x9PsFFC~<>fwO3$q6%zGKBA1|6F)i;R-h_
zM`t!bYsGn?r76v;P6;J~A540F>I^js$zpe}`R_4!;`SdhHJn^Uchu!}o9;;#yr+a-
zm#RpA1QvSK$NtAV6Ns-C`mTv`|FVzKtGpR5W!y6Jxsh0HpP*ed(dnzPw=d~XQkOXr
zGA@H#Oyq7#{FSN*K06HeFP%A<@>68_?uZoOg#I+y*DF44zX|6!broC`2GWRC16>Kp
zCfu2e2bkU&i+3-iz#5Ynj!7_XPs#uQcmVpZsLNPs-!SCBU3M%ZsQQ<v!ifmT1o5cv
z16<lUpihDB^upB3!ZVcK*H?7Cr3IKF%v!%awqb56;IM|a-0`yx3qCf@Ek7`!3?Vij
zDbeBf7*mn2TjqqiZ`)^nXun)B5+xlkM<g!qNx||9+jXc9EDI;Wm=xm<Stij(&HBR$
zuq$d`P5)AMz-3H@Uy&ximxyKQt`pi^z46W#^l_pEiFfi)VNDzi5UtTIKok*&h!$ok
zEJUR73$E)DbeBOvl_V7<7B&<Pu^fUQCTQ)z?;s?V5DkPd1Yxki(02k;{6(id6nB5g
zBor+>E`p%bqaY>43qphR4I<)>)QUKoui<UT7xQQc1SkD>JzhzWENSN*5-~y@Xy4lU
zVj-Ts09FF&x4|e_rs}O0`~fe2LtZvT)JQ$%e3k#`TC_vFc#~zraEO9EeW~*53Pb<H
zfI;^#WMMW;3@=~<Oi#2UEs%-Ev9nKW0aOO$zxd{eVOTEAd3v_lq!?U+=h?&nqLNx7
z3kY#C6qvEog<dnjng(lU8S*BZf`oMBgc1&i)u{4;kbVCM=FdTrF#N54w}tot!(I+9
z&-zK&zsIb=%zq39IxKGmcIR(KV*E}*j0VSnacIiUzz1ZaqE1^$8X5H9VdAd60Gv2U
z5qSwO6WN{-2C5C=qPR7HIuy2>6GcmGo>LDS;YGlgwYr#)K^!wlca?~F@BTDr+`)<2
zPh3*<%Q5{oj<#!rUb`|b4pFGf90v2O9dhCpToQiGyv$0B!;j>(1f0OQ>yG$hS+9QL
zpW-01sAS0AZj8h4+c^hU$Ru|!vHwx~{ed7Rh9S;n$0kCbCeZqOO||D>%;dv|&W`ir
zHaGyLMLXu?i5=h+pDti(gdW{#@P@DjmLSAs%*v*PjwJco9>pPZpyqQd#nD>%5wS|)
z^cQB&A%T0SmlCHXf*)Yw_*B4JtWEo+1Y+@pXBF2J|LX?8e`RN|&0Db({B$3s6r&8E
z<eg!ncz^C6;RDF@diJ2=(Vz3*!W1|yaQQ>i{F+$tx>t@}=1Qtbia=)7yPcc^!X-`i
zi08%d2ERNLw}SC;W0nRGQFF<9+y}5HH{C7-edfOp-NXZ6JpM7wD3LVO7bIwY5-8Gt
ziX{?;bMS=Q-a&e&b5y_O{c)j*5mNxg8k8i%I515~%jmw30r!_f6@`Dc{u?ftIuZ^G
zyrU_+lm3^`nM=qkfUtLcZS~D}@w2oXaP_YYm$4?!Bkv?AYv#k(hLi|AuZeKtZ;K%B
zy@CxuBa=Yc`Cv{_09qu&nr^__8M(Iin#v<#bf_Fv2xbsu$j(!wRvg|3u<MgnwAp~_
zP){I69v<NWzv`mg$=G+{U%l@K%WtH@35$1e3k46ksL8qR=hBqi3eu-NPNM&E+zree
z|I@{2Cn+=K#c(Tk74d!;wQ>rS$Yb$<o(@rZE%iByHewPA98=CJ)G*|}=%Zc9g9@t)
zN-+0|=GKc8M8mVeU{QPn5KCaxV%DsP|Iud>1)!z{$KA(N<U>QlCNXpVa^S>*tmy^@
zHX*2Rj><zc-Vsj*RcHPz3DhM(9Y&Nzc!Cv!N-O-x&r@CfFO5>3XkM%z1kC;@yv(1y
zMi9=tfCaQq2ulQ*M(kXjqbJUFTG#PM!dk#A{%`_5E@=@4CIF8%S28I^oD>TPU-85O
zQ5(R;15gWNLu+dY^s@ZD>KF+#%jh@<5B+e4+}{iN3vda=b5iw~|6<QKtHAA0?TpIP
zgD}>V&8Z>0Y4j<@cY*>v0xL4TAFP}`wvWCCiAM%70*u5B;Af7@$|l@0<yj)&e`6n%
zr`=0U&)NZ4+&ZO1G`Q!P_M)5VSmeOL9GyR$l5^ylVZ|k^EpjjpdIce{JY_*RCDV#C
zoYSUZJfNycgzy%wtrk{xSpSg>BmJ2$258Uidnruz8hWvof4?+%2Ae|S7C!*Z)A3>t
z1&(R%PoxMgQ$jGS#Yy{=GPj{+cf#V$yb3$WZwcktV;g>TKCc;XNV_~RwnJr`WFz{Y
zIU$yK3%Z|uAtCe;<}RE-rQb2Grv?M{ngYn03?_=d?2d-v$0O9wXEo?or1St^XQGjo
zz26XtnUbDLoPHhJQ7*RQ^UE*twE0oTZ)Q2?+q8l)B0GNq!dlxmuJ0z^yH_HQ=zcho
zzRuVqTIu5dgc``J;bt#<m*w?UEE=_d07y-1jYJb>R2nEq{_~b1!&E9N9FQN#Q>2T|
znc`f<lJ}KUrq1AV4rtPC83qW<6=~CDsn=G>M^DgNAiBj-uPAC5NFGry@Tg)z7EZu5
z@J-9@(G|ZohhX_XU-5dyUcMD2269np)Oemh7(&v}rPLL&$rbC~z=#ghYe$+o77a7t
z^+ldI9-m<!6cr7dyeW`JU{MuYc3o2p0oX18ucoG!0*6RUH69@)LWcs+kjpSk#3FnY
zU-C!7a(dcOBLcq1j8GZtj(&fSeLF;aBXJwOHYA8-(VCH&Z8o4da;{&9BkZCf*QUZ#
z92~OyzCci5DAMRVEnA8H2(-7`O+xunN<Hl375}5Zd7Mh=@d}I23y$<>9nSJ^6sQnj
z(BtGLXl=7#$?-#voE3GJo8#Y_CY418?mo{3ob<M~`ShOw`piXrtuaC^>iYIBAzu)+
zjNG<o-f>q94z3a9!7X4S-j22~0Xv>Bc_PLM*JQf<50KND!fVj=gUBb#^$e>QeiQB&
z+1uW_6N1fIi#~E8;jEySm~T{GM#t`iLlQ-fR!#4C#{u#$z%A8~X939`(+8BCFGJAO
zA|9|lZi<$xiTLT#O<X)8#ttV7>E_3oSEBf4VL@IxK(ewCpg7vo;`xJ?3wv#%ESeS?
z@SKm2`e3*I^Tj)W-lbHinjN%vS&+vh!#YR;5DDD5<9k3AuJ`1TEFjKHF=ra2=U|u|
zV4~1iTm6zX11NJBE|7+VD#~yqV5sUY039LuSH`}lZTld=G}VfcMiLWakzg6Uyn_Um
z;ov|q>*K|N&tK$7{6M96Kpyi@4}p5_X*P&Xx0M)N5nKkv$*&jOkgt@5uwrqBM6d)h
zY6;g2S7KA`ti%8T{1utlofTnqeW<o<sjHRDTNotIQyFHq#u@^^3&)Fj6kEN{{x24m
zgO|6~ze|j$V8M0R*b8?En>D%v3{>)aJf4aR%dzuxt4OV$`*k0zejI^vgRDiB)q$z&
zLQ1p`y`5|jtdKki7%A(2>&LY<bwU+0q&VAi%1EOF!~pY83<KuTfnVVgs*8lOeAO)7
zjA#VNgMSkv;o6@^0ovIuD|iL)JpRSAzZ0}0Y~Ic)TxSWPja(IKe2bVBT~=DC5SRJ6
z+{ELe_A^$#6!BAZj=Jq_^XbyOtOa9;{J69lu2l*L9(Q$821TlF-N4%_6sT|X5n`Hg
z+EXT8<-IG36wOW#%oK-*l;}4kj5DTBal8eqXUa)SbXmKZYQO9c`cVK_aF~JSTfm$x
z90oQci*_1`ZQfag!4$hh?0VT>f=^cUbYA>!5?7<c#i2Lvk8daJ$fN#*Z3%_op+;R1
zaire>3je<1w+kY|(Y>gh@iI7;9h9t0lq0|!>vlP1F-b*6sf@mNJ|tt7MlcAL$ZyT2
zG6A^(GP(@jiTQrF(Nd>=!UR)4uV0yHJjVM4{BQ<p!U+8g*EpXrt*^0O*Ll0<9n@TW
zA5C!`1mwgIAboU#iOQgqQ!C%abwH%r)=Yrp+<gV!gCz?9)9*RvrBmZDH)Qa*2gp`U
zS>)KAUcfep8trlZ$i|E^qTF-%I#U2b&;o=q>XcL%eN36TPC7wn3AD1tj6-A)EAz42
zpoU|Jq0>l5z<g0xG4Y>6#Ay6ZQQx-tpnR4hM;;#-tif3X1Z6gF|1H#)q68rW&X}vJ
zDzL!@=ldbBHwjiyou?N$xp*Wjv0?2E!*f&EV*rJK<o5tKTz<pHSJ&r$n-tmpx@rQ1
zloF>7WAd+rEYIC5lc7M@o#f9P`N)*i6~3dbs4Xj6JvOXFtd*j59vt|{ke_?=K6QOO
zR;S7tdQ}~$uS2-duA-3kA)$f5V+D9<w{?uajWYuRAP_+mRR!$^m(+KFJ**W%3ULbb
z)5WrL{hg^x@9}eT>P7c!5#F104}ZOn#<KgKKqM(1i>G}cYHOq+oXNo?Y+LxL$8%PH
zYo$`qCaJl$ee3$$_3&NKaVcGRUt~x3`#r96xiY`000#dkW4RNdUm>@Duvb<=i^f4A
z#fYgWmzkG3!@={DcO;nvZKlmvIBF<w!0E0W2y?R6)ej?X_yp>CUgCX`)g>oS!_u$b
ziU1}AU_&j=kN961k=Ol`DR;S2K}-Y4cs-D8VFORHaL<{ZB)$dn^GTA;yM_klo)=zm
zh2Q3$*jA57tVk<R2mZK1iXebTtNEMN#igaGvuE)FACTg`Z0?lAvMy`rndbPe=PbmC
zdrt;2DlnJvkdSXyXyF{0+8+<B0CaWZU_y<Kkx7H+rWcWl!JLzvJJCT9;n<wCVqpbi
z8KNYZ=Uan`wU_O#)#ly(fRkEj&LP^RNAK}EIh|JbU;b|TL&#DT5r(!`=zq<g$#YV0
zz^*s0)5t(p1F?vgUp>uIjl)i0|A_<0in$Be6QV_zV8}$tBX))c0I2Gg`M>pO_lge&
zf@LYA$e2D@PLK~P{wC&U-PF@cCa5#N{mHqCXlGEE7yZg&z2=r^K;D(MvIAr-_cDIB
zRsU9ALS8K<_hTwAjxH@wwY586WR!Arq_Wss#xe~G5%t0o4icmr8VTm$ULuMy0+Mi!
zco&tnK*UrRONw83_=PtTSc%sctG9#Lt|_f#Isk$Yp-bk;Dt^1m$<NUJ-eXgIB5Rz8
z@S+s_35)f*%Jz{kEQJWdfb3&2iY3NqSPW){R6@9O&EgC(wQIRcN+f|oJwOcnr(&bY
zxcv~oEm~l>U42XjBh=bKXu=ml@&gkH6ly0Mc6Ps=F>m^we)oBQy}WrSOHN5o1NZ{`
z@XO<CLcnNVY-(z0@rqrT_=!`2aeW&NdZ*;;0sV9f(Sd?;ezKt%gpksMA8mV9gsj5Y
zp!q8mcT>qo)n7&bFEavt{q%1%k@+7oz|PXp*gSIGKv%qICb6sK9wq?ndjOkbP2|0(
ztSBNa?${b$fW;y)_R0n_X0mkS*Q)?geU-@u+#iq!g++Set9Q)bj}q>^waqABe?eKo
zl$Dm3IOxmNJ+f!L{6g1ffKqnf{k;3E@$|i(f@FXcKJdd<Y%?s@mLWbiE&C%05THyv
z8Uv62Na}i^&ikIVV<c<DTh!Ud&GS*?QObcdBQf->TGfD~&gj6GhOf=*8$!_a%KE>6
z$;-ekVEQFYnd-JLn)?&NudMNX87;0$YzUqzS?R>`=Y;=+_ArZmNF{1@HQhRvIvmko
z7~h=jI=2D9ve6+>-AF7Rms-UiQXdCfm(|awm`ouO`HP4)a0&6E<2th}w{=DL)^*=}
zq{6rXz&<7>7Ks9N>9y9}F!~7bay*yt<E6^YyS%N18ioz;cgC)V4X&>Yz(J;(-uAx{
zG9YkZ92@5OP*Fv26imeB`AS<=X>Vo{9Vi+|>0txQk8I)h55!$Bb1&_F=RJQZDlhup
z)_B^d{O?N+YFu%Dme4xWKNWS%J6w4vY)KhEaZRjw^G5ZR<-NrYbl}|qdWBn-Yd)+L
zR5Sw+yZ#daX<9U^U}Thp0z3~8lQa2k^~HYO@uSXH|H-iA6jqD^;>^JC_7y?(y@BBK
zI+Xchdw>EpI9l*g;_HNVlh}Rd3CcZn%I3+_WTo;4=|8A)!CLEuMR3%i3nTJGd@0a=
zJa8VApHfP-|G+!SdK(E*`Jdf&ulv*x6>ycTn7^!?Xs$<q6s9`36_W(*ey8Txyd5^H
zGp@sqc;=o<Oav%`o9F0s+NyE|+Xf&g#x5I}Be5ysrb|D#)kar&nsDtsI7AKfc3TaR
zhi<pCB6L|i6K{8Dz&RQAhL(ekug4@zzqbE(n1(CG^{Ef;gxyfa8l$;tK^C9rU5@C+
zt(e(BYrerbdxXQb(uhA6P#!QIh=Hxhs_&<Z1b~18U+~lX&R4jNvD4L9Ms~<PrC52`
z%u!mEA|*4;*v2%%s_CM-rmpWoAX+m|pl+dX?mJ8#3|C6>71}N&VoV#W_vnQ+YahTk
zCK?$<#j2!aXC2J0D1BkfbeTLdHF4CNc^;S9XS^f-2}-wtW~W1mBUw_?M9@;Gx&X=b
z@(S+S$4><}Zpa)qKbh}tWHE_eG^d=WFlEKM{3$+XQ|_XGw*WZLd$rhfSsVjEU#iV2
zM3>G}`~EnH1yqc>g>R$5+(pR%ML4naMU+;w(frfUFaWaBfID{*O}?(nk5(ijs>;#;
ztDGH`A_!qde>=(kP8%%7ko`3aNgYnwJ)dC%5o;zco&ja&jPM%RV6Ts1V}mU6y&i1;
zsYEPgQo(x=b#x~t<*sDo(na@2#u4bxvl`wV21r*_pWUiFHr|?VvVMDw{1?R534ftH
z;Tg!xD+=b0Yg=mu0O;bbn)a#x?O*&P#}AUH&e%&&G+1{4R4go0ksY79K6$P?!^N%c
zXqq~BKseRn0$lup<G!3K_}mo2h-ym#Xo>&)1)IC12v)1WV(f>%l1z}W@7;UAHUI`g
zX%&D`$~FN;gA$){;^dK?)?Z5{pM;8{gnS){F_FmbiyizHYgLwk%=k@FCyhyzy<&+E
zi$=cFyV?I-c_Gdz?NJ0w)fij_F1}?z+`!lHfk5$q{p4+N$y6-iZ&A-zro>I%$*Jn=
zhJVyfR{W2Daf)7n%JHC|81T6^%z<upZ1jcvagl9#V?A&E9QX`?0oKfSMNHts3(OV8
z7*^<3KUH6QXqI}Mb+rHgD-H*@K+?MSPvp3q48REb7d&fF@1p?ltv0#T;G-QbrqNyj
z*FC{U48)S->v{L&ts%q-C|8avdItsTijWq=>Ri3S<Mq`OtiB103>6UY%fPPsF{CBZ
z96ik8|BY}g?pQvM-VmS%e>7dz((_FGyW87tzR2qo2>zqrKk{Vkg(#kP4X9E880Fw#
zkQL~Gg9(#+RUJbJBgDCme=eJBGffhKx<g7HVVKbW@S~&_&4B};hp_o3a-KTHfJ8z1
zgd!C>@c9P7!Xr>D7JJX){TY_Om}Z}$jNMyj1Kr5~!%1g`tGIHF-lE3k7ZJRh_9sDS
zG?=`JrQAy9)QZjQ(f;^yV^2$<9ilOEG5t8J0e?lo4+tQK<gkD6)6|SSHB~Y)&}-Az
zz;X&YfK8m>B@1vl`+;k@e8Fd1{)I_`cAb~XqG%1sHsrF)TEQg*d41U~MR8LK!zOcr
zq(-wcKLf&!*;-SQXS)alD3ALuz{^ZE<~I};IvSV0_dl}SuK6YbMD(?h?{X9D#`)X6
z>vqFfoLo5vy^N8DKufe8Mv8G5RZmZ*L_*Mc2Y6?*cj(Cz7La#y%Mx?;ii$cU&{#~Z
z64DeW?W*ssoR1|CejgRI`klsGA8}Z4&~@qIR+*^ki@&QSh>*1BC?AJmPSa`-v<60#
z)+|%mW$0|_zZDp0dvCBw=fTIC^^rkMlX;IIP#d#PeiY11CZ1)W1)4UAsJ^+nU3bcs
znt>(vt}-=L!Tw9e=0yO@X!z;lodH&F6rS5$0e5%JX!`BX0~q|j39}t=N+g=r&|2Eu
zCU|ShBiHTF>f4p3k8ax{U{F1|nZaBIs7aHACRd#d;KOWa+kf~~=B&Hr3#8FGGwH@?
ztlG0D7&%y7#0gJ~^>~>c<hw6F4VR@n{sTfYlaD|Nf2xd)H!~H{n9d?Rg=PDl>zdc-
zc;$NWF7edm2+_c_>2tn$vM@GwY-E|><-l;y#862{=1&!bJ*%J7hg1QAjPR~kCRw7M
z!^u17R*+HKh@0Lr<Q5^0UJiUz<!Nhfs->+{plHo|6*?O7yZj0`ui)K#f23`(trg$<
zYa**Q75FDw^GyZs-H7bTx=uZ3Y{PN2f!I|)J-J1?U3k5e-H~Epsd^dvU>p#Fz2&%B
z5qLS-cZ7_&wkAx70o<gtx3gV24c-51>a4<|`r<WAcS=e~cMHNuw~|A5cXvn)og%HM
zbR&&4NH>UdNjFG0NS)>XoQreE70*0-_UyIx_j|v08Rk7)5Q&G#Bd+0eK|B2k$!b19
z3e%)Bf0v5|<l+XbW3)l!sXN!-3MGGh6};c^+9bV}k@}ji@=*?uoJ)HyewH5{_}}j|
zHO9T)@rnI7Y&$)}6L(5zlAp!mI#D*r>rx|W0$q#fQqtt#pq`bWl*vq&JsMPacMJ>b
zOBB3yTjexdu8CV#&C|x$CA7pkdG5<D9=-ngur)x#nHoHDEPkjJCJe7p!DCdL=a1bL
z#CD*euy4WC6ZV@S4|W|zVWc)CRfQ$mn!3tSxSPv6IbQlP=bL8tn^wNhHrlTiRMN+^
zB)O#d*|#w@KB-=*N=CeWA=nWl?P2eoHCnN>TEpd3^`l<7eBR%7w=rI@tPV(DxX^Yz
z{K8a)f2^goBlQ8s%$6g3zZp7=rjm{Noo>MK)tSsXBn`gzMQ@4V%3W!K@NM?uv4^Do
z?3)ko`S<PIp6^3&7(L+`gQ`VM2gc0d6J}6*<U*($D*%OBV8FiGWIMY$kipy!2VuAP
zT{;c!Y|{Wga!v5SJN=P!l`Vo)Dqp_5N}}Cn;^PUZ!Q0vaLk^c9H^a364Y4ZK+K&``
z2rqS~wJ6CJp!aJlhd53KRKg1RNw(w-KUmBv^mLF4kukUh<*BjgKF!Vyz*6cR$;=x)
zwg~|{nz{3WEf^nEYd{CLrnzl!=@J`&3+N$10-T2QX@iA_4Ro?RjL=!`YH?Ic#753t
z68b^@4|<V@LQt6&VM-$3BMMV<kxveVYb{?EsEvbu=Ea8kM%}DD#QO_G<?}Ase_)(F
zUX+omtKWyD3w>0J@j0q~M#^8iGDN|I4uDK5<JLaZETgsG<w6H9D8QiVxmfr5B0K0J
zm7TuX6(W#EvG9bNDwW{V`mwrUHrio%(~fH;I5YkDTXJ^0vvLa+rbMo4f-kREvqAlO
z%HPvGt7)lfstmzG!=Vh#UIp`c07&VSS_DwpbNnkln3cJeAw@)WUQaqS%r7r(^qq-3
zUOeF5uGX-D9p~iX6>}<v0VE(MqxIoYdTktilMG*YwA<Z~!aRyp14(rLP#jHM8@a7&
z;IblGAUT`T#ZUi>zaXMTW*mY|-K~Je?Z$ag^4xd?`LJP1DJ}bzZs^O0_E#6qtk@W`
zQ-83XI9Iwou|n|;Nq(i9{ZLazgmfG2DntaI%#tZNE$Odql+NCq)Uf%(9*9fH^?}<(
zgQ(wiPNcZHwH?|rnPb2XOWSU+j_?pnNVsfmvp-wvvKL4Dj=QLKL1w0HzEZ2X6!x?h
zNcHIaG+OlisEAnRHubm_l~<Genm%E`2_oCpF~HvS%+_>lZt~u51zBEDdo|l==g-K3
z1@9NW;>~7A5mfEyeE!4G;90JeCVF0!Z{9yf^}aWf>XfAY<};VmlBsjMtN>coOrcYH
z9e~~s4vve?38!CfI-JwQ%1s7k?yvecxUC`;!#8N&C{_z-Y*5N4<6A4U43|P3N1#w@
zP16myk!=Tox#AtSq9amICPgwlb~w?lv0FskRD~>++WGb0hn7Hq1z~xZ9_;mDEm*G>
zI-y7)w)dPDDR%XC3^n$LeGI&u%sQXHBnJ`bIt0e7nWm$VH*fKjt=zKE{aaNYm5gE|
z-!M49D2PeNuzfa5Q(6?|?#u5@r=q6i4%Oj|1(&l;b^X&x^$c=yZq*3-d^LY<0F~g;
z=@?71c6>(jiCAPhvCJ=mDz?lP%sY&~mvsAr1xzlnJM9+^0;A95lE$zRDwdkNvmWkA
z?oXl1JJwWzLmz~^Ul+e>Q!ApOg~&2*y8nbiK|qfV-u_M&*T_F%016a*$y>{RP+9_p
zxAbSe6jQ?wp>#26U2yTmRobLDq`G68HngP4|Kbw$wcCd^dmqgh!U<N6;`=?bDqC{p
zFlH7+eVI1|2^mFWfwP|!KHt9LG{wW0rHSCn1~Km>C{Qlq&zW#NLwSU?&YJ<YuKnhO
z4tBQ2<UbyN(I8})3xRFkt<&d>+W|fssAgnK670EYe+HcGX=sgW$$!t&R%x{&ux7%@
z;I0>G4A}WrdHdzyVBjz)tEYZrRx_i;t`UJ9?WF=4E-7o^YAWzz3dx1k4T51m{@Uic
zq<r|t)A$y&EQJ36?<*X;MI+sfZouP%tJ614-Y~Z~4+hJ{e`fUzXY{@v;(!OhAwF4=
z=-d0}JOPXa&VlwpI92EdQkOA$x^mAdzj(yRCG7|7<N8wwr{x_ckJ8BTrHc|s_f{|Y
zYgN3KEezJx{NBO$jh6H|1Dvg*Nu|-wIe9}=c>zh-zoHh2a+ZacT@rv)51t9rpd8Kv
zq5{Nx70b;dky$Wsjh{k<*h&wk?ZQ-%?#~1R?LShZ0q(k12!Iy(#kY}Gq*z;jQJ|R)
z=om=M3sDBB4@iyUAGX97glJj<D?VEj?E3R#P|K};SP9>!(u?&NBst1iepCDfZqWV@
zisBGjA7U=E)pfS=&N<iI;<CBBcRV1zK^flyG>aV=L$9Byn~0%nfa!Q~gC3ZOobQnc
z+)Q4JZ5B}lbQzV)Hjq&K;(bRk_jo;Z<OM3u8uF);Wvzj3QTdzMD;2c{66UMoGEOnS
zuX+CRWEyT|j~A#m+z$nkJRXPzGAh8lejPGBh5Rh7grkQ))M9+zVl6HDED=2gAy<?o
zao1+k<uB<JI^X(d?pVBFZbfK1c;K6W4|eLt!a)3boA9Q9RO1rawCDFWahAVp2AhDB
z+vPSTP-aBdjc{~v$=p(%Cxdm_tKm)Q0z*u4PQNXZOHaZ%uLW;_T~)uIJ;D^>5w$<o
z-|84c^u^*0VzYgA&T&84F5FQF7gep`UUFmRXGPnU^K|k)%cNSyZ0VsFDVEY|p}3No
zVD$k^dXKAQ%R<4jjoWS4YtD4R!Nm*uTmK{72{B4rEJE9wNlSa{)c8uHe>Iq((aIIG
z0KZ7zn%l50T;>4ev7AXI#0cFHtR(~&3c!#t%<g2q!=e|*wWMqe*=1tAvZ9ErD^^uF
z`7VumY2CbSUCMvFq!3v0drWNiyUx;u!8K;G7p9gRkpz(}8!vZ|X2IlPb$uP^hJh#u
zaALb&e)RmNPIfVih#Ld(=7<5tD|$fH@Zg*A@iHa%ArvaQL!w>ry}n7R<!&j&+m=RK
zv1KV|=?L%A9JM=)dQZB*;FAHrBkCi{hkSA7s?q`MF{ngkxP-TmLCbg^f!LLQ`*DbM
zDcp;(qn*c$hU96nriBUmrbu)7kXXbG-*$Ny`op~xONfcPcdBybo4n~lFgoy7*;xOg
z4g^2kJp8gWS^e%ysi~H4CuuXNvHq<f->U}?{Yn>g+WIdSyc_F&bp5@;0m<rSOZ^}#
zP#u(yXV2K+g(3clra^(1!Iu&=9dw;g?BHrepv|rra$HsK@vqqZx?v$`{kZUi>32tU
zf4sI=OYo#7EYNSe^`OaTZ<Y{1;*>*3G{l-BefqW(`HdEOn5i_FX2jBh+zlX%?3Ly2
zxA*^gRu-ndUr(#$<*}D=pS7_Q2iJX~j<u=(4fY_ehgX!MtzMy}0>@S06CZWLgQA8J
z*UeEEbO>h(6XD7p`|1z2uLR`fB^;u{33=Nsk_~G!?LcIVzeVrjOqqAKGN*3)sl`1E
z8nROe7c!Zw!clxs>-+e(v+zT&CIj0pBqZ{?bP1BImfbpJFMjh#&7N<5e&wGQ2#mD;
zDNcT67?|0ag~)$<w@Y?1lD0M=c{ds9*BS(1NvCDQwLc%y!1DZWS7YhP>$nbn10Fi3
zllT)FG?8Gvw)?;+L3(x(kt@c6vU2v|=|2*KQqX2komG6sYrkb@(VB5{M}qjEzoPwk
z8hP^A4&y9^!Ez?8aBV$Qd-#d_7nbb;dOwuArtnPIMu_eT({Y=h?B^60#$+!$OdMX$
z{a)JmHADv9sQ+zV4h9)OL;$RH*`G&?5CtfA!dYp_6ixmh!<T!dX0(cchQam&RCFU0
zS_vvY86e;y?5F2n)1~-jno>wKIle2B)U%E=37hh8rk4Y1L*vwmT5+fe<_*P9=(Ek_
zV(Xc_mM=J`F=v5I80`Yri=Q6uo#xM88VKT6bUsy9;9177mQ?eE<w9sT#otrY?PCZ>
zNtpga)mjX3$UFftJik;qj(#NYjXr?vCEYeRqlboJXo}U+)$ltIYE_)BS!bOy9S08l
zTSWc+FUde0`R$cH@YU2ZSHD2FpS0^7jOO`g^Wp`$XGA|Xc*6kYrMn|m<HhFgrMk;*
z;%zB3Q?d0Y^xZ7o3v0Ovee7;up{I8L71^g_f*?fg$9Z@C>vN^d$M;WUK~?_5N6QMI
zvmE4jT4G&eNJr=_h+ZaHp+pFp9k_BcQ`pV(gVaLH`Fo3Z$FE0Gu>S&Jy)`f{{oJGn
zECgfU(58D6-MpQ{tIL+_D|?5dBRA)OP++cWg!z5>C$O7a&RKRC$L!uw%OvmR0VBIs
zy^N($GQipTb4Chh+hmcT)ZzG{zB($a01p$Tnk65V8`O_5AvA4?K%BqTp{=RX<;0~8
z4m(c}`1`eULrC|ZQRhVjl}d(0Yew8$$s^*oMt{$d{+=$P%kqibSkgx`#36#_G)dT$
zz7nVpHHwP#f*vmDl%;>p+UU7w2RTNHf()2Zv>mUJ@+QG|)61ddeP&js0-*0wDB@9B
z*}tEg(_&M9>m_!*m)CsdEG`qS7+0|*X)nbTS(&3_4al9|6)aMX-5xG-*mKC4-5tfe
z=wmA@4Anq=dZ8n(MO1gq#Eoj&Bhd=7%wd1uLqYFZeo*H_oMj?{%^_F3Kfw%-SMd|F
zUhovK>lIU<7Ki}b?Q(zlo-td8-%fr4KQnwhQ3c$w=|k;^J8izoWUQj;AnaWZteH$0
z;Z<qdSGCo3FHL)bGSL^1IJ$a$y8XhkZT+8n65uGD$uwz$`9s;pB8=Ao;X7_?p-Rv|
zsW+~Ypu1WLlx(Wj?K38R&RJl(s5Qgi2y~8YU|UUw-No(8n)u)x*sk8WR65<{>0EG(
zqG+Os?7WI0>;fm|LF{h)vd(ya9FWzZ3hOFuHd)cljfMU%g2f?{#>;P4*dPbE>Fx!B
z-6ab6HQpS&CkM&gGo-auXjq4+3&9#<IBwPAnA4AjRyVd8$c#Xwj;bIZa<(0AR@nY9
zrSslJgez|xbw&1zV%&9_l(D=Vq>172Ze~x8Xj^YVup4mS+I9riI&k9w-QGW=g!+pv
zx9Dp5aJOo4&eTr#0RKuV$N?&DmS*BObsYXR^p-mY?ANtgM*6OB8nkCX_H6<7e=YX=
zp!YC-c(scn64Lffj9n53pQid#YbY5gJ@E>?9(3>wp~f2AakH(AC=3xJjm*s4_Wj&i
zrB%(J1AYqbF5+NeSipRnl)nPH-P5*{m}(4o5%}QdwklHM!omrh-2?v`9(W7w09b+c
zw+SYb)?v6xCjl!gF{U?l7Sd~<+@E}&Bc+m!h}Al7=-Aby#nE)zx8SI)BfwLU{T$yP
zp2QM8XF?m{4N8eT1ru2IQ{mqBd(5UO0goWKt8X{|yow1I1}#rTsMeQ~ICV-Y>s+-$
z4R*Bw%fYSh7JnUNLZ7#9CwN?SerrFoA^L`!<t4x3ugM_)tU2SwrB(7n8<z-VZ?>U+
z{x=Z7Et?!?_rc0D)m$!DgfLV}|4j|~8$gMi1k%UNtI3cxvIg09;kN+q{1+TG0LkEv
zLF*>9CjjXmP+fq<b_&<1&lR{(kW9t-s^F5ssL^&sOyGg?masR{H6Hay35f#DO<N`~
z=fqv6k}+4mx_Sv>gAM&d)nSufa@>kN4QDNK{5pr_x%nvMB(4)k;g!M&#E~i6y8c#x
zT)&C4ZD;L{CDfrn!=gm+7eLwomIg>UpsoTbsHEr{nk=T&kySt2pCH;-$EbnXjemwG
zntoU{Yra)S<~y<Mh5$v+_&;68NmaR5M|DGM%V^&(PJ4a*1FES#WQpd^4KPlYOG=!p
z!Ih8(?Crn7k{GX2fd=hH(Y4iTzqcR!p)%8<pyGO)OJta7*kLN?0#`rW-<Y#8yWOH7
zTyr>M*hvDn%*E>maZ$DL_Nv`Caz9&pX03$NdZw`NFG5XM+VJt2?N>SJC*laqzh+u|
z`aqOdjL!pTKGF%4+(bK?$C*?+4vCe9{0yg6J-W;4<INeC%}J}IvaC*bk(X`2_-RsR
zkgGAU(X?kW=~nGB=dum~4l<x4W-*5U=0hQEsuwUzvaZ!0=2NMa2OheIS7_Z)PGbrW
zt4;#1{1y%qODgUxRWt#i|7%%v#H*!}o)U!yZrY=4PCR<PjSZZXkTpYeC6J%=>$Eia
z>qC~#1(V%YGJVR&6XnGzX#!E6lcTERMXCK4@CI#YN5nnuw1crba@^bUZbPI#P>sN#
z6G4|;DgsjUnA4*0;CN?H0adg|`76cPlQ3FH5#9@HmjFqg&f6?H7R(PoHvJOTj`hlN
z6g#i@xKw|gzHsu;RmIsw#W}ytj_^v!*U#qn0%|4|1I4FR7>kRbOHi9Z^bJ-8SNXAa
zIo)?G|JajB`n6E$!`8QX|0i_56z>*$Fx6m(3u2o!xtfL75Mqq6`t}^CjrU7JighM<
z4w&9@1k(|a-ZNr_s71rR#nw7&UxmB?*J8!N0w)rRMHVl;IfniAX(Xo!fC_6n{c?7H
zQ91*th^H$p$YnVgZXJ)-W<OGjZrJ}py)S<6f_j6NcpV%+J<y7_P__7>36jWpbiUBt
zW*A9Ii40feqw`cIsE>0xIuo^7Xh!%}+~LXI0Ac8dxIFcTy}{JS4ABPukynwX7t^!C
zH`3vi_dB8T1*7Wa4=ZU?J)~C!Vl{p@>D+jaWG>okBpstFqWC<+DL;JAlCyfw1fDSN
z^H!*?IR0YDD!>cFxsvQ%`c|9Z2oEmunVF#~Nh9N7K6I>N<|DPCBX$PtuEfL6c9m1|
zET^fEnehs{xP}p^bT61@{`AibwN~NHOh-if>`>16@#kl*5asE+i|HcQ!0V}zL#1WW
zkeW^W_GF2vXt-F~S9gv2d5jFu@T<67q{gl_Z{0O->8qFREHITuF3q-QKYHOm-ZOO@
z9n$eMht#xShPR`f@_8uhUZy1`T!b}p;9V6}HRmsdiqbiZP;7)t!yUlQiU(GF%KA2B
z9X+5&3+wh8?FrMh^g|cD%QLOKwC8EYfXnt`2v8i!Yt?-}iPd}2ESt~vHYiG-^+s3C
zDu*tER=6)Q2)Q|*qg6W?e4sCSqR=T_g_rdo(?z0Oy;hUOLPAS{X`QQg9P%myk5Oz2
zNuWNOufX)^`5Ri-+V?ivDR}RYL9u#F+@lOF?v!sFSDFBhyn{$)Mf(QsBBJ>_kp?g2
zrJ`gWnyLBRegJ!HJu-L4qmqtJP&9&v)O6j*09&KuM$;=*+azLR3vtl6%4hG6FlTUy
zEkeYUMsrNz`1^1#yEU3Y-Nc&l%Zsb{`rtsi%Z$hu{(dkE+ixU3oQ{n;yr9I@E%~|Y
z*+w+PTGi)`G%U&m|1;AF-c2m^)(uY_4&gI7=)>2Jk`g22hv!|96<cu!)AkN47{(k=
z4Hr<dCyTk^hZzVNaR(jVt7g00j_osLt`r9a9_)nrC_OwNXS`VLEg=)`bC(G;%5r+|
zCM7MZaWP7G7yNZsxf9#2bw*jk+55uCC1B1zfR;iR84mC1mzZ|VUB6t50Dg(NzFDo+
zSOuDE`_(Y?7TE%iLRbr_{~ZOhiRxh#R)p6{8>^TSRy&$wBN^Xyn%RBhYaaBpG;q}k
zHr}$qg}myb$My3mJ$JR}@rts2|CT(b)Q0xk$=#wiYTU;T9vJ#mh;#=m&|o$)_a1Aj
zTl!$S$DKc~Y+-GAg#N;R*DKqV4*?e6HLeABDYUn-67Zq=>CD*H<;p@a-!OTuP@KSq
z=Gj$bLh~Y&;00TVx&L$9Y}~ydCpLpOH?O;((pz*1X|6N#a`N*>gIV|C<qzfU@PTKO
zbR73CQ$!tb$HoQM0)eQ0xn=xJ)h(*~Iea{YjI?#IuXvj(_*gHI`{h?j6EFhNrc|}?
zE2!_KxdY=)SawBvUhh6EA0u4_p3K&H-D=*nJneyF3N%j4nBjuH$ZS5{-4$CzRR%hB
zmmPjHE|%LoisHczgTrStLGqkH$laLhP>6#$8MkzB4p4?c)z(tm-_q_Ri+7hBdDl>`
zG?JCRf;{a%Aqw&%Ygb_T9YT@0j{4f+3Qt9NO#9ADI~yC>V+N2z+e&CF;Yom%YtUtd
z7ScD2h}rX1_I4Jp4eoX-H!IIqVcmjbajBf)MPk6KqI-ciyhBe)?_Ak~xXh0$v&)ek
z@bm{AQRBEA%@ry03ndZh@$jc>73z=4ihUA2*Lil&sqjMiH0Q+|;m<_7po9<H)ovVe
zNuG!G<ZD+;I%%F;zm}`CAAX*w9bCn0-hL3^6qM&AkA$IX|2vJP_`lOwCehrpKR$l`
zzL6P1g3Dr<Y8Rw}IHS2m-1TaeSJNqb&<anU?MN1WpGvHq234v@p?dJcaVYk<g{sR6
zf0KKQ56>y#5KHLm_+7Sa5^-gON%6$mC~$PjyNkr_i%GjS#uA~9?-;WhO|%hdIy;&5
zH7yyJZrU5T99Ek6RO>Et_JP~)Tn&Rzv*jd*Iz;0K_Wx`<^`e_D#2kdS&<(X^a}d$0
zN~j-E&_zk$m?QSbtlCK6SBvM%W17AR6Dsx(8-iBfOTT(##&2=hc$X!M*OT#{xE0kG
z?y7(r&S*l(&^0^L<dZU_5RyC`6G!tiG#!5{x63DtH-tUmiqPV<GUW>*EaiK&-P|cc
zt>6W;S(!^gbnhxJI+t9%iFw>4zfyDp-8m|ynM~{G)GmY@j1W<6hrZ5jz?>{<E;g4?
zkj|+lie$r2B&VE3!?MTLbkJj8s#zJ?eEZG;)*q~!CJZt4Es_%7k)FY?(Hp+jUGHnP
z)W16J_JJc=R9yIO;4+C~i&mLF$Z~alFw=f1q2+e>2V&3ai+b^?(*SP`!3D(<r#5UL
zDB_?o!sLcD{RX{+hSoF1GkAg3Ks|9ks?~D3!ka+-O;_fPX}(WgPpDc#DoKAD$^Scs
zsd<JMhk?#&LZ>F^vpP72=@-KLuP7M($QZ(k^1l9JS-2<{g{*ib@|fd@(hbs<GHb*`
zN(q)SvjlIhY5VKfGouqL%mib6S%@AK;x@4Fs5!YVvo20*4+N72A&jXcu1qS1cw2lf
z@@qiNW)i_Co4`~+e;yft&V??S9XWxYQ^=ZT+f=cP-&j6mnBqzFx=M9SE-G|2as%DF
zd9UTkgD=7@79ozPgR9#Dy~#t??K0hY>Jw6V?#uE4xv|NROaxt||2^uevui`AbF%ZP
zy|rfl!#?xI4RFZ*s+cueh?X<!ms3!U5vQhUj394=TgN<6-F>r`3I3dYTdammh!<YW
zXZ!WH&*`vlE7y+Y_Gqsz6Q`OCW=`DxgIwNg61MW~pI@xEeZK6RHhtRrE=Gv}<$=<_
znD@6hS5<*oy!*pXx!o+9v0Sk2jJs;`T`}tMwSgn@u9&Mid13TbsMwA#gGL!nJgU+y
z-|$_B=<b&goM4_t6o%~Tw`luYBT_mTp<KiBxy~F`QPrynoW94$9a;3P*0+WW$Kg|t
zbte~VWtE}xd*fvR@7fC%xn-zi^WMK0wjVyryU$&0k*f4IeAv*Nu3~?0X8EdwbZD8c
zZLcEaR3ut}xF}>Hg4|bk_~bykO8B|IsCCPaVD_f^ZuFbi@1Q3GCun<8Yw;h?gQY}m
zGx{ATf8A~DD0w<|doF#(r82nC;Y1$BJsmcYsth~KL9urZGa^O#(`@5wRI{!nE+nyx
zazuKB;LYG@UNJe3!M}TeZ0MH6$(d0qg#BL7((rX9Rz>sOO*$Oirc{~8D#2j9L_9An
zspjfqfX?<_`pX7SMcc1-?oZX<(%!$ADp)Up`BX+w!P@twVr1%;+0?4_Sj%ag_1ePc
zK6Y1};#ASqhBld2!(&-o<1rL(TE=#2n&b?(bn+3uvSAcP$Rs~Ryi2-{ec|2Go*B(;
zmr*#9ZhKy9Jh{Iv^tzGa`8(q`pAc393z)NQ$5d1T)F*JewvSA8E4A!d-qpM{9X7*s
zRd>;!aeVLCBd{AAF^iNIk|PA|@*$EiFe1qtz1+!4ZdNI)9znY$b&Y+UP#6EhdamJ8
zxI=>cwS%qf2s`xhWQ2Hmln}S|b?AnQc-vQa;mVj&O0)}B8~p_CV>oZc8wk-or}l_#
zvTZ+$?P!xWQg1K@zu{jk@AHI(PxY2w4#%`kH06kF{0w6RDG`!cBW51YAvH4s;`^Na
zMjTC@Ke6e$c{ibshYAO5Ro0QMV}EQbteIFwS^K|_NR*oog?-LwGe5(&f%Wp}aXxBy
zST1OCGK5ZN<?3QBm-sH1%)}(jMC*B@?RV;p&Nt9IqwYoQ9U#MOdFS$5G8$#U8F)>k
zl*C}BV;@pC5P?<6FF)=<j5ql(=rg-$z32gRJ^w`z&7)N`nwQvvcE{Z9o}7jB&T0Ma
z6^qM6BSmEQEuU!Gv=N8D@83rm=+bQF7Wyii34Z{&&T#tCbWi`GFVFMHU^6`yGew$u
zr$~%tjfR^_#I$E=pZNEt!uC5}{S@TRZb|ph!mYmk{;mJ1=tY-q?1OIUXdOl|k9!Zr
z=TK-6U3cOtDQWN<9lBMB5Y_x)F<<f&+XA<vTjn<3HMQ$~$0nk??|6;ZD;<oW$}n>i
z6w@RYcP~QM4YG6SW2b|E{ttKi^}6Y9Jiqum$K8(-B4{G|mKbEKKkx@;8R{JjyMMzu
z!tG;V@ko8iDbPG&wIU)t`R?(Tq>kZcC9@^n#|!yqLLnyGL%zKza$leMYS;mR45jrR
zw>4FwNZf=l(llgNNm)sAQ?RIc#$#gY4ys<=wzWpSQeYR?xp&6=+L+)IYln>6@kj*}
zJwhrRqSB7eDwP^T%@A2%E*W=`=W9RS`!#(gb_TB$<Hekwsy8dC&V}W5Fwq!BWBe2W
z;T%3b7JQyEePdeSFez6^DskI82Jhz{b}He*-9I@rC5f!8KC^9ptFik0<)r6~9vPZ6
z$@lYX$u6!NyLsQ2LZu4d!KU(`7G_;$bx-GOGNU~oEm`1<tlK=TPsbvX(yGVo@V~``
zVT9z-hO3K}P(P#WRQ0NoT2o|csw9<Pd*)^;q(@_d8eHqrLGJyxHN}!CI!w~O)YHvT
zL%}J3QICd(A?Z6gQ*W~;W8$>zIHTKwO{N|ry4g-)OS{2pC7S}g%QszkuU;s33v@M}
z0N+CNrh4vkPt|zOW0i4Zafo`16QKcN7Y5H8c@hMhDZy|gH?1LE%U>}(rF&a;Uw;d;
z>MIZZyoNc$GED<8VZ4OLva9Mw^g23jd*BOK7=gRt|1ll9kFD{ZxzYHZc-e>Cjjr{x
zIhU6oyqM$<8SAP@Wwv*4_iMdeg8f~zT3jjHse!@9Pgs8gqC%`gP+z%FeKx#!uXAR6
a#x?&tn3Q6fni(7f3@0a}EL|aK67oM@WJK2h

literal 0
HcmV?d00001

diff --git a/forge.config.cjs b/forge.config.cjs
index 401fb81..bd0534f 100644
--- a/forge.config.cjs
+++ b/forge.config.cjs
@@ -5,6 +5,10 @@ const {
 
 const APP_NAME = 'Angulectron';
 const APP_BUNDLE_ID = 'com.simonhagger.angulectron';
+const BUILD_ENV = (process.env.APP_ENV ?? 'production').toLowerCase();
+const isStagingBuild = BUILD_ENV === 'staging';
+const PRODUCT_NAME = isStagingBuild ? `${APP_NAME} Staging` : APP_NAME;
+const EXECUTABLE_NAME = isStagingBuild ? `${APP_NAME}-Staging` : APP_NAME;
 
 const hasAppleSigningConfig =
   Boolean(process.env.APPLE_CODESIGN_IDENTITY) &&
@@ -15,15 +19,19 @@ module.exports = {
   packagerConfig: {
     asar: true,
     derefSymlinks: true,
-    executableName: APP_NAME,
+    icon: './build/icon',
+    executableName: EXECUTABLE_NAME,
     appBundleId: APP_BUNDLE_ID,
     appCategoryType: 'public.app-category.developer-tools',
+    extraMetadata: {
+      appEnv: BUILD_ENV,
+    },
     win32metadata: {
       CompanyName: 'Angulectron',
       FileDescription: 'Angulectron Desktop Application',
-      ProductName: APP_NAME,
-      InternalName: APP_NAME,
-      OriginalFilename: `${APP_NAME}.exe`,
+      ProductName: PRODUCT_NAME,
+      InternalName: EXECUTABLE_NAME,
+      OriginalFilename: `${EXECUTABLE_NAME}.exe`,
     },
     osxSign: hasAppleSigningConfig
       ? {
diff --git a/package.json b/package.json
index cc4555d..db17d2d 100644
--- a/package.json
+++ b/package.json
@@ -36,6 +36,8 @@
     "forge:clean": "node ./tools/scripts/clean-forge-output.mjs",
     "forge:start": "pnpm run build-desktop && electron-forge start",
     "forge:make": "pnpm run forge:clean && pnpm run build && electron-forge make",
+    "forge:make:staging": "pnpm run forge:clean && cross-env APP_ENV=staging DESKTOP_ENABLE_DEVTOOLS=1 pnpm run build && cross-env APP_ENV=staging DESKTOP_ENABLE_DEVTOOLS=1 electron-forge make",
+    "forge:make:production": "pnpm run forge:clean && cross-env APP_ENV=production DESKTOP_ENABLE_DEVTOOLS=0 pnpm run build && cross-env APP_ENV=production DESKTOP_ENABLE_DEVTOOLS=0 electron-forge make",
     "forge:publish": "electron-forge publish",
     "changeset": "changeset",
     "version-packages": "changeset version",
diff --git a/tools/scripts/workspace-refresh-win.ps1 b/tools/scripts/workspace-refresh-win.ps1
index 0fda4e6..3c0cf2e 100644
--- a/tools/scripts/workspace-refresh-win.ps1
+++ b/tools/scripts/workspace-refresh-win.ps1
@@ -15,11 +15,13 @@ try {
 
 # 2) Stop node/electron processes tied to this workspace.
 $repoPattern = [Regex]::Escape($repoRoot)
+$mcpProcessPattern = 'nx-mcp|@playwright/mcp|server-filesystem|mcp gateway|\bmcp\b'
 $nodeTargets = Get-CimInstance Win32_Process -Filter "name = 'node.exe'" |
   Where-Object {
     $_.CommandLine -and
     $_.CommandLine -match $repoPattern -and
-    $_.CommandLine -match 'nx|electron|ng\.js|vite|vitest|wait-on|playwright'
+    $_.CommandLine -match 'nx|electron|ng\.js|vite|vitest|wait-on|playwright' -and
+    $_.CommandLine -notmatch $mcpProcessPattern
   }
 
 if ($nodeTargets) {
@@ -32,6 +34,18 @@ if ($nodeTargets) {
   Write-Host 'No workspace Node processes found.'
 }
 
+$mcpTargets = Get-CimInstance Win32_Process -Filter "name = 'node.exe'" |
+  Where-Object {
+    $_.CommandLine -and
+    $_.CommandLine -match $repoPattern -and
+    $_.CommandLine -match $mcpProcessPattern
+  }
+
+if ($mcpTargets) {
+  $mcpPids = @($mcpTargets | Select-Object -ExpandProperty ProcessId)
+  Write-Host ("Preserved MCP Node processes: " + ($mcpPids -join ', '))
+}
+
 $electronTargets = Get-CimInstance Win32_Process -Filter "name = 'electron.exe'" |
   Where-Object { $_.CommandLine -and $_.CommandLine -match $repoPattern }
 

From 4dc791ad458c14d70e355e09d0ebca7861757a85 Mon Sep 17 00:00:00 2001
From: Simon Hagger <simon.hagger@gmail.com>
Date: Thu, 12 Feb 2026 17:49:37 +0000
Subject: [PATCH 24/24] chore(ci): exclude lockfile from prettier format checks

---
 .prettierignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.prettierignore b/.prettierignore
index 113709c..f415dbe 100644
--- a/.prettierignore
+++ b/.prettierignore
@@ -4,3 +4,4 @@
 /.nx/cache
 /.nx/workspace-data
 .angular
+pnpm-lock.yaml