From 6a0a419def26c95ead26bd7dc6f1c8530844d7f0 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Wed, 27 May 2026 00:44:45 -0700
Subject: [PATCH 01/55] [pipeline-manager] Add OIDC workload-identity trust
 relationships

Let a tenant authorize JWT-bearing requests from an external OIDC issuer
(GitHub Actions, AWS, GCP, Auth0) without provisioning a long-lived API key. A
trust registers an issuer plus subject and audience match patterns; a token from
that issuer whose claims satisfy them is authorized, once its signature verifies
against the issuer's JWKS, discovered through OIDC discovery.

Adds the oidc_trust_relationship table, CRUD endpoints under /v0/oidc_trust, the
federated verification path in auth, and a web-console dialog to manage trusts.
fda and the Python SDK gain a bearer-token path, so a short-lived workload token
can stand in for an API key. The manager fetches a discovery document only for
an issuer some trust already names, so an unauthenticated caller cannot steer
its outbound requests.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 crates/fda/src/cli.rs                         |  63 +++-
 crates/fda/src/main.rs                        | 175 ++++++++++-
 .../migrations/V34__oidc_trust.sql            |  18 ++
 crates/pipeline-manager/src/api/endpoints.rs  |   1 +
 .../src/api/endpoints/oidc_trust.rs           | 186 ++++++++++++
 crates/pipeline-manager/src/api/main.rs       |  19 +-
 crates/pipeline-manager/src/auth.rs           | 192 +++++++++++-
 crates/pipeline-manager/src/db/error.rs       |  34 +++
 crates/pipeline-manager/src/db/operations.rs  |   1 +
 .../src/db/operations/oidc_trust.rs           | 185 ++++++++++++
 crates/pipeline-manager/src/db/storage.rs     |  37 +++
 .../src/db/storage_postgres.rs                |  72 +++++
 crates/pipeline-manager/src/db/test.rs        |  47 +++
 crates/pipeline-manager/src/db/types.rs       |   1 +
 .../src/db/types/oidc_trust.rs                | 102 +++++++
 .../lib/components/auth/ProfileButton.svelte  |  11 +
 .../oidcTrust/NewOidcTrustForm.svelte         | 140 +++++++++
 .../lib/components/other/OidcTrustMenu.svelte |  76 +++++
 .../src/lib/services/pipelineManager.ts       |  67 +++++
 openapi.json                                  | 276 ++++++++++++++++++
 python/feldera/rest/_httprequests.py          |  50 +++-
 python/feldera/rest/config.py                 |  12 +-
 python/feldera/rest/feldera_client.py         |  81 ++++-
 23 files changed, 1822 insertions(+), 24 deletions(-)
 create mode 100644 crates/pipeline-manager/migrations/V34__oidc_trust.sql
 create mode 100644 crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
 create mode 100644 crates/pipeline-manager/src/db/operations/oidc_trust.rs
 create mode 100644 crates/pipeline-manager/src/db/types/oidc_trust.rs
 create mode 100644 js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte
 create mode 100644 js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte

diff --git a/crates/fda/src/cli.rs b/crates/fda/src/cli.rs
index 88b0c942e7a..b41546fc851 100644
--- a/crates/fda/src/cli.rs
+++ b/crates/fda/src/cli.rs
@@ -15,8 +15,15 @@ fn pipeline_names(current: &std::ffi::OsStr) -> Vec<CompletionCandidate> {
     // using the `try_parse_from` method.
     let cli = Cli::try_parse_from(["fda", "pipelines"]);
     if let Ok(cli) = cli {
-        let client =
-            make_client(cli.host, cli.insecure, cli.tls_cert, cli.auth, cli.timeout).unwrap();
+        let client = make_client(
+            cli.host,
+            cli.insecure,
+            cli.tls_cert,
+            cli.auth,
+            cli.auth_token_command,
+            cli.timeout,
+        )
+        .unwrap();
 
         let r = futures::executor::block_on(async {
             client
@@ -109,6 +116,20 @@ pub struct Cli {
         help_heading = "Global Options"
     )]
     pub auth: Option<String>,
+    /// Shell command that prints a bearer token on stdout.
+    ///
+    /// Run before every request; the trimmed stdout becomes the
+    /// `Authorization: Bearer <token>` header. Use for OIDC workload-identity
+    /// flows with short-lived tokens — pair with `tsidp-token`,
+    /// `gcloud auth print-access-token`, etc. Conflicts with `--auth`.
+    #[arg(
+        long,
+        env = "FELDERA_AUTH_TOKEN_COMMAND",
+        global = true,
+        help_heading = "Global Options",
+        conflicts_with = "auth"
+    )]
+    pub auth_token_command: Option<String>,
     /// The client timeout for requests in seconds.
     ///
     /// In almost all cases you should not need to set this value, but it can
@@ -205,6 +226,11 @@ pub enum Commands {
         #[command(subcommand)]
         action: ApiKeyActions,
     },
+    /// Manage OIDC trust relationships (workload identity federation).
+    OidcTrust {
+        #[command(subcommand)]
+        action: OidcTrustActions,
+    },
     /// Cluster information and status.
     Cluster {
         #[command(subcommand)]
@@ -234,6 +260,39 @@ pub enum ApiKeyActions {
     },
 }
 
+#[derive(Subcommand)]
+pub enum OidcTrustActions {
+    /// List configured OIDC trust relationships.
+    List,
+    /// Register a new OIDC trust relationship.
+    ///
+    /// JWTs from `--issuer` whose `sub` claim matches `--subject` and (if
+    /// specified) `aud` claim matches `--audience` are authorized as the
+    /// current tenant. `*` is a wildcard.
+    Create {
+        /// Unique name for the trust relationship.
+        name: String,
+        /// OIDC issuer URL (must match the `iss` claim exactly).
+        #[arg(long)]
+        issuer: String,
+        /// Pattern for the `sub` claim. `*` matches any sequence.
+        #[arg(long)]
+        subject: String,
+        /// Pattern for the `aud` claim. `*` matches any sequence. Optional.
+        #[arg(long)]
+        audience: Option<String>,
+        /// Free-text description.
+        #[arg(long)]
+        description: Option<String>,
+    },
+    /// Delete an OIDC trust relationship.
+    #[clap(aliases = &["del"])]
+    Delete {
+        /// Name of the trust relationship to delete.
+        name: String,
+    },
+}
+
 #[derive(Subcommand)]
 pub enum ClusterAction {
     /// Retrieves all cluster events (status only) and prints them.
diff --git a/crates/fda/src/main.rs b/crates/fda/src/main.rs
index ea79334ca40..6285306faf0 100644
--- a/crates/fda/src/main.rs
+++ b/crates/fda/src/main.rs
@@ -84,6 +84,7 @@ pub(crate) fn make_client(
     insecure: bool,
     tls_cert: Option<std::path::PathBuf>,
     auth: Option<String>,
+    auth_token_command: Option<String>,
     timeout: Option<u64>,
 ) -> Result<Client, Box<dyn std::error::Error>> {
     let mut client_builder = reqwest::ClientBuilder::new().danger_accept_invalid_certs(insecure);
@@ -117,9 +118,14 @@ pub(crate) fn make_client(
         }
     }
 
+    let resolved_auth = match auth_token_command {
+        Some(cmd) => Some(run_auth_token_command(&cmd)?),
+        None => auth,
+    };
+
     if host.starts_with("https://") {
-        client_builder = client_builder.default_headers(make_auth_headers(&auth)?);
-    } else if host.starts_with("http://") && auth.is_some() {
+        client_builder = client_builder.default_headers(make_auth_headers(&resolved_auth)?);
+    } else if host.starts_with("http://") && resolved_auth.is_some() {
         warn!(
             "The provided API key is not added to the request because {host} does not use `https`."
         );
@@ -129,6 +135,33 @@ pub(crate) fn make_client(
     Ok(Client::new_with_client(host.as_str(), client))
 }
 
+/// Execute the user-supplied auth-token command via `sh -c` and return
+/// trimmed stdout. Errors if the command fails or prints nothing.
+fn run_auth_token_command(cmd: &str) -> Result<String, Box<dyn std::error::Error>> {
+    let output = std::process::Command::new("sh")
+        .arg("-c")
+        .arg(cmd)
+        .output()
+        .map_err(|e| format!("failed to spawn auth-token-command `{cmd}`: {e}"))?;
+    if !output.status.success() {
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        return Err(format!(
+            "auth-token-command `{cmd}` exited with {}: {}",
+            output.status,
+            stderr.trim()
+        )
+        .into());
+    }
+    let token = String::from_utf8(output.stdout)
+        .map_err(|e| format!("auth-token-command `{cmd}` produced non-UTF-8 output: {e}"))?
+        .trim()
+        .to_string();
+    if token.is_empty() {
+        return Err(format!("auth-token-command `{cmd}` produced empty output").into());
+    }
+    Ok(token)
+}
+
 /// A helper struct that disables the cache for a pipeline.
 struct CacheDisabler {
     name: String,
@@ -378,6 +411,119 @@ async fn api_key_commands(format: OutputFormat, action: ApiKeyActions, client: C
     }
 }
 
+async fn oidc_trust_commands(format: OutputFormat, action: OidcTrustActions, client: Client) {
+    match action {
+        OidcTrustActions::Create {
+            name,
+            issuer,
+            subject,
+            audience,
+            description,
+        } => {
+            debug!("Creating OIDC trust relationship: {name}");
+            let body = NewOidcTrustRequest::builder()
+                .name(name.clone())
+                .issuer(issuer)
+                .subject(subject)
+                .audience(audience)
+                .description(description);
+            let response = client
+                .post_oidc_trust()
+                .body(body)
+                .send()
+                .await
+                .map_err(handle_errors_fatal(
+                    client.baseurl().clone(),
+                    "Failed to create OIDC trust relationship",
+                    1,
+                ))
+                .unwrap();
+            match format {
+                OutputFormat::Text => {
+                    println!(
+                        "OIDC trust '{}' created (id: {})",
+                        response.name, response.id.0
+                    );
+                }
+                OutputFormat::Json => {
+                    println!(
+                        "{}",
+                        serde_json::to_string_pretty(&response.into_inner())
+                            .expect("Failed to serialize OIDC trust response")
+                    );
+                }
+                _ => {
+                    eprintln!("Unsupported output format: {}", format);
+                    std::process::exit(1);
+                }
+            }
+        }
+        OidcTrustActions::Delete { name } => {
+            debug!("Deleting OIDC trust relationship: {name}");
+            client
+                .delete_oidc_trust()
+                .name(name.as_str())
+                .send()
+                .await
+                .map_err(handle_errors_fatal(
+                    client.baseurl().clone(),
+                    "Failed to delete OIDC trust relationship",
+                    1,
+                ))
+                .unwrap();
+            println!("OIDC trust '{name}' deleted");
+        }
+        OidcTrustActions::List => {
+            debug!("Listing OIDC trust relationships");
+            let response = client
+                .list_oidc_trust()
+                .send()
+                .await
+                .map_err(handle_errors_fatal(
+                    client.baseurl().clone(),
+                    "Failed to list OIDC trust relationships",
+                    1,
+                ))
+                .unwrap();
+            match format {
+                OutputFormat::Text => {
+                    let mut rows = vec![[
+                        "name".to_string(),
+                        "issuer".to_string(),
+                        "subject".to_string(),
+                        "audience".to_string(),
+                        "id".to_string(),
+                    ]];
+                    for t in response.iter() {
+                        rows.push([
+                            t.name.clone(),
+                            t.issuer.clone(),
+                            t.subject.clone(),
+                            t.audience.clone().unwrap_or_default(),
+                            t.id.0.to_string(),
+                        ]);
+                    }
+                    println!(
+                        "{}",
+                        Builder::from_iter(rows).build().with(Style::rounded())
+                    );
+                }
+                OutputFormat::Json => {
+                    println!(
+                        "{}",
+                        serde_json::to_string_pretty(&response.into_inner())
+                            .expect("Failed to serialize OIDC trust list")
+                    );
+                }
+                _ => {
+                    eprintln!("Unsupported output format: {}", format);
+                    std::process::exit(1);
+                }
+            }
+        }
+    }
+}
+
 async fn pipelines(format: OutputFormat, client: Client) {
     debug!("Listing pipelines");
     let response = client
@@ -3206,16 +3352,26 @@ fn main() {
             }
 
             let client = || {
-                make_client(cli.host, cli.insecure, cli.tls_cert, cli.auth, cli.timeout)
-                    .map_err(|e| {
-                        eprintln!("Failed to create HTTP client: {}", e);
-                        std::process::exit(1);
-                    })
-                    .unwrap()
+                make_client(
+                    cli.host,
+                    cli.insecure,
+                    cli.tls_cert,
+                    cli.auth,
+                    cli.auth_token_command,
+                    cli.timeout,
+                )
+                .map_err(|e| {
+                    eprintln!("Failed to create HTTP client: {}", e);
+                    std::process::exit(1);
+                })
+                .unwrap()
             };
 
             match cli.command {
                 Commands::Apikey { action } => api_key_commands(cli.format, action, client()).await,
+                Commands::OidcTrust { action } => {
+                    oidc_trust_commands(cli.format, action, client()).await
+                }
                 Commands::Pipelines => pipelines(cli.format, client()).await,
                 Commands::Pipeline(action) => pipeline(cli.format, action, client()).await,
                 Commands::ValidateProgram {
@@ -3279,6 +3435,7 @@ aC3Oy4iVrYGOq9v6uP9iblE=\n\
             Some(missing),
             None,
             None,
+            None,
         )
         .expect_err("non-existent cert path must produce an error");
         let msg = err.to_string();
@@ -3299,6 +3456,7 @@ aC3Oy4iVrYGOq9v6uP9iblE=\n\
             Some(file.path().to_path_buf()),
             None,
             None,
+            None,
         )
         .expect_err("garbage cert contents must produce an error");
         let msg = err.to_string();
@@ -3325,6 +3483,7 @@ aC3Oy4iVrYGOq9v6uP9iblE=\n\
             Some(file.path().to_path_buf()),
             None,
             None,
+            None,
         );
         // Some rustls backends reject the synthetic cert at build time; accept
         // either a successful build or a cert-validation error, but never the
diff --git a/crates/pipeline-manager/migrations/V34__oidc_trust.sql b/crates/pipeline-manager/migrations/V34__oidc_trust.sql
new file mode 100644
index 00000000000..34a90329e0b
--- /dev/null
+++ b/crates/pipeline-manager/migrations/V34__oidc_trust.sql
@@ -0,0 +1,18 @@
+-- Trust relationships for OIDC workload identity federation.
+-- A tenant registers an issuer + subject/audience match pattern; an incoming
+-- JWT whose claims satisfy the pattern is authorized as that tenant with the
+-- recorded scopes, exactly like an API key.
+CREATE TABLE IF NOT EXISTS oidc_trust_relationship (
+    id uuid PRIMARY KEY,
+    tenant_id uuid NOT NULL,
+    name varchar NOT NULL,
+    description varchar,
+    issuer varchar NOT NULL,
+    subject varchar NOT NULL,
+    audience varchar,
+    scopes text[] NOT NULL,
+    CONSTRAINT unique_oidc_trust_name UNIQUE (tenant_id, name),
+    FOREIGN KEY (tenant_id) REFERENCES tenant(id) ON DELETE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS idx_oidc_trust_issuer ON oidc_trust_relationship (issuer);
diff --git a/crates/pipeline-manager/src/api/endpoints.rs b/crates/pipeline-manager/src/api/endpoints.rs
index 356dbb7c27e..f09b3d44054 100644
--- a/crates/pipeline-manager/src/api/endpoints.rs
+++ b/crates/pipeline-manager/src/api/endpoints.rs
@@ -2,5 +2,6 @@ pub mod api_key;
 pub mod cluster;
 pub mod config;
 pub mod metrics;
+pub mod oidc_trust;
 pub mod pipeline_interaction;
 pub mod pipeline_management;
diff --git a/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs b/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
new file mode 100644
index 00000000000..34a6388ec16
--- /dev/null
+++ b/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
@@ -0,0 +1,186 @@
+// OIDC workload identity trust relationships.
+//
+// A trust relationship lets a tenant authorize JWT-bearing requests from an
+// external OIDC issuer (e.g. GitHub Actions, AWS, GCP, Auth0) without
+// provisioning a long-lived Feldera API key. The issuer is verified via OIDC
+// discovery + JWKS; the `subject` and (optional) `audience` claims are matched
+// against patterns recorded on the trust relationship (`*` is a wildcard).
+use crate::api::main::ServerState;
+use crate::api::util::parse_url_parameter;
+use crate::db::storage::Storage;
+use crate::db::types::api_key::ApiPermission;
+use crate::db::types::oidc_trust::OidcTrustId;
+use crate::db::types::tenant::TenantId;
+use crate::error::ManagerError;
+use actix_web::{
+    delete, get,
+    http::header::{CacheControl, CacheDirective},
+    post,
+    web::{self, Data as WebData, ReqData},
+    HttpRequest, HttpResponse,
+};
+use serde::{Deserialize, Serialize};
+use tracing::info;
+use utoipa::ToSchema;
+use uuid::Uuid;
+
+/// Request to create a new OIDC trust relationship.
+#[derive(Debug, Deserialize, ToSchema)]
+pub(crate) struct NewOidcTrustRequest {
+    /// Trust relationship name. Unique within the tenant.
+    #[schema(example = "github-actions-prod")]
+    pub name: String,
+
+    /// Optional human-readable description.
+    #[schema(example = "GitHub Actions deploys from main branch")]
+    #[serde(default)]
+    pub description: Option<String>,
+
+    /// Issuer URL exactly as it appears in the `iss` claim.
+    /// JWKS are discovered at `<issuer>/.well-known/openid-configuration`.
+    #[schema(example = "https://token.actions.githubusercontent.com")]
+    pub issuer: String,
+
+    /// Subject claim pattern. `*` matches any sequence of characters.
+    #[schema(example = "repo:my-org/my-repo:ref:refs/heads/main")]
+    pub subject: String,
+
+    /// Optional audience claim pattern. `*` matches any sequence of characters.
+    /// If omitted, the audience claim is not checked.
+    #[schema(example = "feldera")]
+    #[serde(default)]
+    pub audience: Option<String>,
+}
+
+/// Response to a successful create.
+#[derive(Debug, Serialize, ToSchema)]
+pub(crate) struct NewOidcTrustResponse {
+    #[schema(example = "00000000-0000-0000-0000-000000000000")]
+    pub id: OidcTrustId,
+    pub name: String,
+}
+
+/// List OIDC trust relationships
+#[utoipa::path(
+    context_path = "/v0",
+    security(("JSON web token (JWT) or API key" = [])),
+    responses(
+        (status = OK, description = "Trust relationships retrieved", body = [OidcTrustDescr]),
+        (status = INTERNAL_SERVER_ERROR, body = ErrorResponse)
+    ),
+    tag = "Platform"
+)]
+#[get("/oidc_trust")]
+pub(crate) async fn list_oidc_trust(
+    state: WebData<ServerState>,
+    tenant_id: ReqData<TenantId>,
+) -> Result<HttpResponse, ManagerError> {
+    let items = state.db.lock().await.list_oidc_trust(*tenant_id).await?;
+    Ok(HttpResponse::Ok()
+        .insert_header(CacheControl(vec![CacheDirective::NoCache]))
+        .json(&items))
+}
+
+/// Get OIDC trust relationship
+#[utoipa::path(
+    context_path = "/v0",
+    security(("JSON web token (JWT) or API key" = [])),
+    params(("name" = String, Path, description = "Trust relationship name")),
+    responses(
+        (status = OK, description = "Trust relationship retrieved", body = OidcTrustDescr),
+        (status = NOT_FOUND, description = "No relationship with that name", body = ErrorResponse)
+    ),
+    tag = "Platform"
+)]
+#[get("/oidc_trust/{name}")]
+pub(crate) async fn get_oidc_trust(
+    state: WebData<ServerState>,
+    tenant_id: ReqData<TenantId>,
+    req: HttpRequest,
+) -> Result<HttpResponse, ManagerError> {
+    let name = parse_url_parameter(&req, "name")?;
+    let item = state
+        .db
+        .lock()
+        .await
+        .get_oidc_trust(*tenant_id, &name)
+        .await?;
+    Ok(HttpResponse::Ok()
+        .insert_header(CacheControl(vec![CacheDirective::NoCache]))
+        .json(&item))
+}
+
+/// Create OIDC trust relationship
+#[utoipa::path(
+    context_path = "/v0",
+    security(("JSON web token (JWT) or API key" = [])),
+    request_body = NewOidcTrustRequest,
+    responses(
+        (status = CREATED, description = "Trust relationship created", body = NewOidcTrustResponse),
+        (status = CONFLICT, description = "Name already in use", body = ErrorResponse),
+        (status = BAD_REQUEST, description = "Invalid request", body = ErrorResponse),
+    ),
+    tag = "Platform"
+)]
+#[post("/oidc_trust")]
+pub(crate) async fn post_oidc_trust(
+    state: WebData<ServerState>,
+    tenant_id: ReqData<TenantId>,
+    body: web::Json<NewOidcTrustRequest>,
+) -> Result<HttpResponse, ManagerError> {
+    let new_id = Uuid::now_v7();
+    let body = body.into_inner();
+    state
+        .db
+        .lock()
+        .await
+        .create_oidc_trust(
+            *tenant_id,
+            new_id,
+            &body.name,
+            body.description.as_deref(),
+            &body.issuer,
+            &body.subject,
+            body.audience.as_deref(),
+            vec![ApiPermission::Read, ApiPermission::Write],
+        )
+        .await?;
+    info!(
+        "Created OIDC trust '{}' (tenant: {}, issuer: {})",
+        body.name, *tenant_id, body.issuer
+    );
+    Ok(HttpResponse::Created()
+        .insert_header(CacheControl(vec![CacheDirective::NoCache]))
+        .json(&NewOidcTrustResponse {
+            id: OidcTrustId(new_id),
+            name: body.name,
+        }))
+}
+
+/// Delete OIDC trust relationship
+#[utoipa::path(
+    context_path = "/v0",
+    security(("JSON web token (JWT) or API key" = [])),
+    params(("name" = String, Path, description = "Trust relationship name")),
+    responses(
+        (status = OK, description = "Trust relationship deleted"),
+        (status = NOT_FOUND, description = "No relationship with that name", body = ErrorResponse)
+    ),
+    tag = "Platform"
+)]
+#[delete("/oidc_trust/{name}")]
+pub(crate) async fn delete_oidc_trust(
+    state: WebData<ServerState>,
+    tenant_id: ReqData<TenantId>,
+    req: HttpRequest,
+) -> Result<HttpResponse, ManagerError> {
+    let name = parse_url_parameter(&req, "name")?;
+    state
+        .db
+        .lock()
+        .await
+        .delete_oidc_trust(*tenant_id, &name)
+        .await?;
+    info!("Deleted OIDC trust '{name}' (tenant: {})", *tenant_id);
+    Ok(HttpResponse::Ok().finish())
+}
diff --git a/crates/pipeline-manager/src/api/main.rs b/crates/pipeline-manager/src/api/main.rs
index 30a1b946f28..b205795969b 100644
--- a/crates/pipeline-manager/src/api/main.rs
+++ b/crates/pipeline-manager/src/api/main.rs
@@ -1,7 +1,7 @@
 use crate::api::demo::{read_demos_from_directories, Demo};
 use crate::api::endpoints;
 use crate::api::support_data_collector::SupportDataCollector;
-use crate::auth::JwkCache;
+use crate::auth::{IssuerJwkCache, JwkCache};
 use crate::config::{ApiServerConfig, CommonConfig};
 use crate::db::probe::DbProbe;
 use crate::db::storage_postgres::StoragePostgres;
@@ -243,6 +243,12 @@ It contains the following fields:
         endpoints::api_key::post_api_key,
         endpoints::api_key::delete_api_key,
 
+        // OIDC trust relationships
+        endpoints::oidc_trust::list_oidc_trust,
+        endpoints::oidc_trust::get_oidc_trust,
+        endpoints::oidc_trust::post_oidc_trust,
+        endpoints::oidc_trust::delete_oidc_trust,
+
         // Configuration
         endpoints::config::get_config_authentication,
         endpoints::config::get_config_demos,
@@ -338,6 +344,10 @@ It contains the following fields:
         crate::db::types::api_key::ApiKeyDescr,
         crate::api::endpoints::api_key::NewApiKeyRequest,
         crate::api::endpoints::api_key::NewApiKeyResponse,
+        crate::db::types::oidc_trust::OidcTrustId,
+        crate::db::types::oidc_trust::OidcTrustDescr,
+        crate::api::endpoints::oidc_trust::NewOidcTrustRequest,
+        crate::api::endpoints::oidc_trust::NewOidcTrustResponse,
 
         // Monitor
         crate::db::types::monitor::MonitorStatus,
@@ -718,6 +728,11 @@ fn api_scope() -> Scope {
         .service(endpoints::api_key::get_api_key)
         .service(endpoints::api_key::post_api_key)
         .service(endpoints::api_key::delete_api_key)
+        // OIDC trust relationship endpoints
+        .service(endpoints::oidc_trust::list_oidc_trust)
+        .service(endpoints::oidc_trust::get_oidc_trust)
+        .service(endpoints::oidc_trust::post_oidc_trust)
+        .service(endpoints::oidc_trust::delete_oidc_trust)
         // Configuration endpoints
         .service(endpoints::config::get_config)
         .service(endpoints::config::get_config_demos)
@@ -763,6 +778,7 @@ pub(crate) struct ServerState {
     pub common_config: CommonConfig,
     pub config: ApiServerConfig,
     pub jwk_cache: Arc<Mutex<JwkCache>>,
+    pub issuer_jwk_cache: Arc<Mutex<IssuerJwkCache>>,
     probe: Arc<Mutex<DbProbe>>,
     pub demos: Vec<Demo>,
     pub license_check: Arc<RwLock<Option<LicenseCheck>>>,
@@ -784,6 +800,7 @@ impl ServerState {
             common_config,
             config,
             jwk_cache: Arc::new(Mutex::new(JwkCache::new())),
+            issuer_jwk_cache: Arc::new(Mutex::new(IssuerJwkCache::new())),
             probe: DbProbe::new(db_copy).await,
             demos,
             license_check,
diff --git a/crates/pipeline-manager/src/auth.rs b/crates/pipeline-manager/src/auth.rs
index 83b4c762414..c69c9b528d7 100644
--- a/crates/pipeline-manager/src/auth.rs
+++ b/crates/pipeline-manager/src/auth.rs
@@ -156,16 +156,157 @@ fn create_authz_json_error(message: &str) -> actix_web::Error {
 /// Authorization using a bearer token. Expects to find either a typical
 /// OAuth2/OIDC JWT token or an API key. JWT tokens are expected to be available
 /// as is, whereas API keys are prefix with the string "apikey:".
+///
+/// A JWT may come from either:
+///   1. The configured OIDC login provider (existing browser-driven flow).
+///   2. A foreign issuer authorized by an OIDC trust relationship — the
+///      workload-identity-federation path.
+/// We dispatch on the `iss` claim, peeked unverified, then sign-verify in
+/// the corresponding handler.
 pub(crate) async fn auth_validator(
     req: ServiceRequest,
     credentials: BearerAuth,
 ) -> Result<ServiceRequest, (actix_web::error::Error, ServiceRequest)> {
     let token = credentials.token();
-    // Check if we are using an API key first.
     if token.starts_with(API_KEY_PREFIX) {
         return api_key_auth(req, token).await;
     }
-    bearer_auth(req, token).await
+    let configuration = req.app_data::<AuthConfiguration>().unwrap();
+    match peek_unverified_iss(token) {
+        Some(iss) if iss == configuration.provider.issuer() => bearer_auth(req, token).await,
+        Some(_) => oidc_trust_auth(req, token).await,
+        None => {
+            let config = req.app_data::<Config>().cloned().unwrap_or_default();
+            Err((
+                AuthenticationError::from(config)
+                    .with_error_description("Malformed JWT: missing iss claim")
+                    .into(),
+                req,
+            ))
+        }
+    }
+}
+
+/// Decode the JWT payload without verifying the signature and return the
+/// `iss` claim, if present. Used only to route the token to the right
+/// verification path; the chosen handler performs full signature checks.
+fn peek_unverified_iss(token: &str) -> Option<String> {
+    use base64::Engine;
+    let mut parts = token.split('.');
+    let _header = parts.next()?;
+    let payload_b64 = parts.next()?;
+    let payload = base64::engine::general_purpose::URL_SAFE_NO_PAD
+        .decode(payload_b64.as_bytes())
+        .ok()?;
+    let v: serde_json::Value = serde_json::from_slice(&payload).ok()?;
+    v.get("iss")?.as_str().map(String::from)
+}
+
+/// Extract audiences from an `aud` claim that may be a string or an array.
+fn audiences_from_claim(aud: Option<&serde_json::Value>) -> Vec<String> {
+    match aud {
+        Some(serde_json::Value::String(s)) => vec![s.clone()],
+        Some(serde_json::Value::Array(arr)) => arr
+            .iter()
+            .filter_map(|v| v.as_str().map(String::from))
+            .collect(),
+        _ => vec![],
+    }
+}
+
+/// Verify a JWT against the issuer named in its `iss` claim, then resolve
+/// the request to a tenant via a registered trust relationship.
+async fn oidc_trust_auth(
+    req: ServiceRequest,
+    token: &str,
+) -> Result<ServiceRequest, (actix_web::error::Error, ServiceRequest)> {
+    let unauthorized = |msg: String, req: ServiceRequest| {
+        let config = req.app_data::<Config>().cloned().unwrap_or_default();
+        Err((
+            AuthenticationError::from(config)
+                .with_error_description(msg)
+                .into(),
+            req,
+        ))
+    };
+
+    let header = match decode_header(token) {
+        Ok(h) => h,
+        Err(e) => {
+            debug!("Federated token: bad header: {:?}", e);
+            return unauthorized("Malformed JWT header".to_string(), req);
+        }
+    };
+    if header.alg != Algorithm::RS256 {
+        return unauthorized(format!("Unsupported JWT algorithm {:?}", header.alg), req);
+    }
+    let Some(kid) = header.kid else {
+        return unauthorized("JWT header missing kid".to_string(), req);
+    };
+    let Some(iss) = peek_unverified_iss(token) else {
+        return unauthorized("JWT missing iss".to_string(), req);
+    };
+
+    let state = req.app_data::<Data<ServerState>>().unwrap().clone();
+    let jwk = {
+        let mut cache = state.issuer_jwk_cache.lock().await;
+        match cache.get(&iss, &kid).await {
+            Ok(k) => k,
+            Err(e) => {
+                error!("Federated JWKS fetch for issuer '{iss}' failed: {e}");
+                return unauthorized(format!("JWKS lookup failed: {e}"), req);
+            }
+        }
+    };
+
+    // Verify signature + exp. Issuer/audience are checked against the trust
+    // relationship below, not by the JWT validator itself.
+    let mut validation = Validation::new(Algorithm::RS256);
+    validation.validate_exp = true;
+    validation.validate_aud = false;
+    validation.set_required_spec_claims(&["exp"]);
+    let token_data = match decode::<OidcClaim>(token, &jwk, &validation) {
+        Ok(td) => td,
+        Err(e) => {
+            debug!("Federated token verification failed: {:?}", e.kind());
+            return unauthorized(format!("JWT verification failed: {}", e), req);
+        }
+    };
+    if token_data.claims.iss != iss {
+        return unauthorized("iss mismatch between header peek and body".to_string(), req);
+    }
+
+    let audiences = audiences_from_claim(token_data.claims.aud.as_ref());
+    let lookup = {
+        let db = state.db.lock().await;
+        db.match_oidc_trust(&iss, &token_data.claims.sub, &audiences)
+            .await
+    };
+    match lookup {
+        Ok(Some((tenant_id, scopes))) => {
+            req.extensions_mut().insert(tenant_id);
+            req.extensions_mut().insert(scopes);
+            Ok(req)
+        }
+        Ok(None) => {
+            let ip = req
+                .peer_addr()
+                .map(|a| a.ip().to_string())
+                .unwrap_or_else(|| "<unknown IP>".to_string());
+            error!(
+                "Federated JWT rejected: no trust relationship matches iss='{iss}' sub='{}' from {ip}",
+                token_data.claims.sub
+            );
+            unauthorized(
+                "No OIDC trust relationship matches this token".to_string(),
+                req,
+            )
+        }
+        Err(e) => {
+            error!("Federated trust lookup failed: {e}");
+            unauthorized(format!("Database error: {e}"), req)
+        }
+    }
 }
 
 async fn bearer_auth(
@@ -507,6 +648,17 @@ pub(crate) enum AuthProvider {
     GenericOidc(ProviderGenericOidc),
 }
 
+impl AuthProvider {
+    /// The configured login provider's issuer URL.
+    /// Used to distinguish login JWTs from workload-federation JWTs.
+    pub fn issuer(&self) -> &str {
+        match self {
+            AuthProvider::AwsCognito(p) => &p.issuer,
+            AuthProvider::GenericOidc(p) => &p.issuer,
+        }
+    }
+}
+
 pub(crate) fn aws_auth_config() -> AuthConfiguration {
     let mut validation = Validation::new(Algorithm::RS256);
     let client_id = env::var("FELDERA_AUTH_CLIENT_ID")
@@ -781,8 +933,44 @@ pub struct JwkCache {
     cache: TimedCache<String, DecodingKey>,
 }
 
+/// JWKS cache keyed by (issuer, kid) for federated tokens whose issuer is
+/// dynamically discovered from a registered trust relationship.
+pub struct IssuerJwkCache {
+    cache: TimedCache<(String, String), DecodingKey>,
+}
+
 const DEFAULT_JWK_CACHE_LIFETIME_SECONDS: u64 = 120;
 const DEFAULT_JWK_CACHE_CAPACITY: usize = 10;
+const ISSUER_JWK_CACHE_CAPACITY: usize = 64;
+
+impl IssuerJwkCache {
+    pub(crate) fn new() -> Self {
+        Self {
+            cache: TimedCache::with_lifespan_and_capacity(
+                DEFAULT_JWK_CACHE_LIFETIME_SECONDS,
+                ISSUER_JWK_CACHE_CAPACITY,
+            ),
+        }
+    }
+
+    async fn get(&mut self, issuer: &str, kid: &str) -> Result<DecodingKey, AuthError> {
+        let key = (issuer.to_string(), kid.to_string());
+        if let Some(dk) = self.cache.cache_get(&key) {
+            return Ok(dk.clone());
+        }
+        let jwks_uri = fetch_jwks_uri_from_discovery(issuer)
+            .await
+            .map_err(|e| AuthError::JwkShape(format!("OIDC discovery failed: {e}")))?;
+        let fetched = fetch_jwk_oidc_keys(&jwks_uri).await?;
+        for (k, dk) in fetched {
+            self.cache.cache_set((issuer.to_string(), k), dk);
+        }
+        self.cache
+            .cache_get(&key)
+            .cloned()
+            .ok_or_else(|| AuthError::JwkShape("kid not present in issuer JWKS".to_string()))
+    }
+}
 
 impl JwkCache {
     pub(crate) fn new() -> JwkCache {
diff --git a/crates/pipeline-manager/src/db/error.rs b/crates/pipeline-manager/src/db/error.rs
index d38e7222567..8bfd3ff84d8 100644
--- a/crates/pipeline-manager/src/db/error.rs
+++ b/crates/pipeline-manager/src/db/error.rs
@@ -147,6 +147,17 @@ pub enum DBError {
         name: String,
     },
     InvalidApiKey,
+    // OIDC trust relationship errors
+    UnknownOidcTrust {
+        name: String,
+    },
+    EmptyOidcTrustField {
+        field: String,
+    },
+    InvalidOidcToken {
+        reason: String,
+    },
+    UnauthorizedOidcToken,
     // Pipeline-related errors
     UnknownPipeline {
         pipeline_id: PipelineId,
@@ -583,6 +594,21 @@ impl Display for DBError {
             DBError::InvalidApiKey => {
                 write!(f, "Invalid API key")
             }
+            DBError::UnknownOidcTrust { name } => {
+                write!(f, "Unknown OIDC trust relationship '{name}'")
+            }
+            DBError::EmptyOidcTrustField { field } => {
+                write!(
+                    f,
+                    "OIDC trust relationship field '{field}' must not be empty"
+                )
+            }
+            DBError::InvalidOidcToken { reason } => {
+                write!(f, "Invalid OIDC token: {reason}")
+            }
+            DBError::UnauthorizedOidcToken => {
+                write!(f, "No OIDC trust relationship matches this token")
+            }
             DBError::UnknownPipeline { pipeline_id } => {
                 write!(f, "Unknown pipeline id '{pipeline_id}'")
             }
@@ -877,6 +903,10 @@ impl DetailedError for DBError {
             Self::UnknownTenant { .. } => Cow::from("UnknownTenant"),
             Self::UnknownApiKey { .. } => Cow::from("UnknownApiKey"),
             Self::InvalidApiKey => Cow::from("InvalidApiKey"),
+            Self::UnknownOidcTrust { .. } => Cow::from("UnknownOidcTrust"),
+            Self::EmptyOidcTrustField { .. } => Cow::from("EmptyOidcTrustField"),
+            Self::InvalidOidcToken { .. } => Cow::from("InvalidOidcToken"),
+            Self::UnauthorizedOidcToken => Cow::from("UnauthorizedOidcToken"),
             Self::UnknownPipeline { .. } => Cow::from("UnknownPipeline"),
             Self::UnknownPipelineName { .. } => Cow::from("UnknownPipelineName"),
             Self::UpdateRestrictedToStopped { .. } => Cow::from("UpdateRestrictedToStopped"),
@@ -990,6 +1020,10 @@ impl ResponseError for DBError {
             Self::UnknownTenant { .. } => StatusCode::UNAUTHORIZED, // TODO: should we report not found instead?
             Self::UnknownApiKey { .. } => StatusCode::NOT_FOUND,
             Self::InvalidApiKey => StatusCode::UNAUTHORIZED,
+            Self::UnknownOidcTrust { .. } => StatusCode::NOT_FOUND,
+            Self::EmptyOidcTrustField { .. } => StatusCode::BAD_REQUEST,
+            Self::InvalidOidcToken { .. } => StatusCode::UNAUTHORIZED,
+            Self::UnauthorizedOidcToken => StatusCode::UNAUTHORIZED,
             Self::UnknownPipeline { .. } => StatusCode::NOT_FOUND,
             Self::UnknownPipelineName { .. } => StatusCode::NOT_FOUND,
             Self::UpdateRestrictedToStopped { .. } => StatusCode::BAD_REQUEST,
diff --git a/crates/pipeline-manager/src/db/operations.rs b/crates/pipeline-manager/src/db/operations.rs
index acab3b47409..d546a8b3987 100644
--- a/crates/pipeline-manager/src/db/operations.rs
+++ b/crates/pipeline-manager/src/db/operations.rs
@@ -14,6 +14,7 @@
 pub mod api_key;
 pub mod cluster_monitor;
 pub mod connectivity;
+pub mod oidc_trust;
 pub mod pipeline;
 pub mod pipeline_monitor;
 mod pipeline_parsing;
diff --git a/crates/pipeline-manager/src/db/operations/oidc_trust.rs b/crates/pipeline-manager/src/db/operations/oidc_trust.rs
new file mode 100644
index 00000000000..31403fc27be
--- /dev/null
+++ b/crates/pipeline-manager/src/db/operations/oidc_trust.rs
@@ -0,0 +1,185 @@
+use crate::db::error::DBError;
+use crate::db::operations::utils::{
+    maybe_tenant_id_foreign_key_constraint_err, maybe_unique_violation,
+};
+use crate::db::types::api_key::{ApiPermission, API_PERMISSION_READ, API_PERMISSION_WRITE};
+use crate::db::types::oidc_trust::{claim_matches, OidcTrustDescr, OidcTrustId};
+use crate::db::types::tenant::TenantId;
+use crate::db::types::utils::validate_name;
+use deadpool_postgres::Transaction;
+use std::str::FromStr;
+use uuid::Uuid;
+
+fn row_to_descr(row: &tokio_postgres::Row) -> OidcTrustDescr {
+    let id: Uuid = row.get(0);
+    let name: String = row.get(1);
+    let description: Option<String> = row.get(2);
+    let issuer: String = row.get(3);
+    let subject: String = row.get(4);
+    let audience: Option<String> = row.get(5);
+    let scopes_raw: Vec<String> = row.get(6);
+    let scopes = scopes_raw
+        .iter()
+        .map(|s| ApiPermission::from_str(s).expect("unexpected ApiPermission string in DB"))
+        .collect();
+    OidcTrustDescr {
+        id: OidcTrustId(id),
+        name,
+        description,
+        issuer,
+        subject,
+        audience,
+        scopes,
+    }
+}
+
+pub async fn list_oidc_trust(
+    txn: &Transaction<'_>,
+    tenant_id: TenantId,
+) -> Result<Vec<OidcTrustDescr>, DBError> {
+    let stmt = txn
+        .prepare_cached(
+            "SELECT id, name, description, issuer, subject, audience, scopes \
+             FROM oidc_trust_relationship WHERE tenant_id = $1",
+        )
+        .await?;
+    let rows = txn.query(&stmt, &[&tenant_id.0]).await?;
+    Ok(rows.iter().map(row_to_descr).collect())
+}
+
+pub async fn get_oidc_trust(
+    txn: &Transaction<'_>,
+    tenant_id: TenantId,
+    name: &str,
+) -> Result<OidcTrustDescr, DBError> {
+    let stmt = txn
+        .prepare_cached(
+            "SELECT id, name, description, issuer, subject, audience, scopes \
+             FROM oidc_trust_relationship WHERE tenant_id = $1 AND name = $2",
+        )
+        .await?;
+    let maybe_row = txn.query_opt(&stmt, &[&tenant_id.0, &name]).await?;
+    maybe_row
+        .map(|row| row_to_descr(&row))
+        .ok_or(DBError::UnknownOidcTrust {
+            name: name.to_string(),
+        })
+}
+
+pub async fn delete_oidc_trust(
+    txn: &Transaction<'_>,
+    tenant_id: TenantId,
+    name: &str,
+) -> Result<(), DBError> {
+    let stmt = txn
+        .prepare_cached("DELETE FROM oidc_trust_relationship WHERE tenant_id = $1 AND name = $2")
+        .await?;
+    let res = txn.execute(&stmt, &[&tenant_id.0, &name]).await?;
+    if res > 0 {
+        Ok(())
+    } else {
+        Err(DBError::UnknownOidcTrust {
+            name: name.to_string(),
+        })
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
+pub async fn create_oidc_trust(
+    txn: &Transaction<'_>,
+    tenant_id: TenantId,
+    id: Uuid,
+    name: &str,
+    description: Option<&str>,
+    issuer: &str,
+    subject: &str,
+    audience: Option<&str>,
+    scopes: &[ApiPermission],
+) -> Result<(), DBError> {
+    validate_name(name)?;
+    if issuer.is_empty() {
+        return Err(DBError::EmptyOidcTrustField {
+            field: "issuer".to_string(),
+        });
+    }
+    if subject.is_empty() {
+        return Err(DBError::EmptyOidcTrustField {
+            field: "subject".to_string(),
+        });
+    }
+    let stmt = txn
+        .prepare_cached(
+            "INSERT INTO oidc_trust_relationship \
+             (id, tenant_id, name, description, issuer, subject, audience, scopes) \
+             VALUES ($1, $2, $3, $4, $5, $6, $7, $8)",
+        )
+        .await?;
+    let scopes_str: Vec<&str> = scopes
+        .iter()
+        .map(|s| match s {
+            ApiPermission::Read => API_PERMISSION_READ,
+            ApiPermission::Write => API_PERMISSION_WRITE,
+        })
+        .collect();
+    let res = txn
+        .execute(
+            &stmt,
+            &[
+                &id,
+                &tenant_id.0,
+                &name,
+                &description,
+                &issuer,
+                &subject,
+                &audience,
+                &scopes_str,
+            ],
+        )
+        .await
+        .map_err(maybe_unique_violation)
+        .map_err(|e| maybe_tenant_id_foreign_key_constraint_err(e, tenant_id))?;
+    if res > 0 {
+        Ok(())
+    } else {
+        Err(DBError::duplicate_key())
+    }
+}
+
+/// Look up the trust relationships registered for an `issuer` and return the
+/// first one whose subject pattern matches `sub` and (if present) audience
+/// pattern matches `aud`.
+pub async fn match_oidc_trust(
+    txn: &Transaction<'_>,
+    issuer: &str,
+    subject: &str,
+    audiences: &[String],
+) -> Result<Option<(TenantId, Vec<ApiPermission>)>, DBError> {
+    let stmt = txn
+        .prepare_cached(
+            "SELECT tenant_id, subject, audience, scopes \
+             FROM oidc_trust_relationship WHERE issuer = $1",
+        )
+        .await?;
+    let rows = txn.query(&stmt, &[&issuer]).await?;
+    for row in rows {
+        let tenant_uuid: Uuid = row.get(0);
+        let pattern_subject: String = row.get(1);
+        let pattern_audience: Option<String> = row.get(2);
+        let scopes_raw: Vec<String> = row.get(3);
+
+        if !claim_matches(&pattern_subject, subject) {
+            continue;
+        }
+        if let Some(aud_pattern) = &pattern_audience {
+            if !audiences.iter().any(|a| claim_matches(aud_pattern, a)) {
+                continue;
+            }
+        }
+        let scopes = scopes_raw
+            .iter()
+            .map(|s| ApiPermission::from_str(s).expect("unexpected ApiPermission string in DB"))
+            .collect();
+        return Ok(Some((TenantId(tenant_uuid), scopes)));
+    }
+    Ok(None)
+}
diff --git a/crates/pipeline-manager/src/db/storage.rs b/crates/pipeline-manager/src/db/storage.rs
index 09e6789654c..a92607f7ce5 100644
--- a/crates/pipeline-manager/src/db/storage.rs
+++ b/crates/pipeline-manager/src/db/storage.rs
@@ -6,6 +6,7 @@ use crate::db::types::monitor::{
     ExtendedPipelineMonitorEvent, NewClusterMonitorEvent, PipelineMonitorEvent,
     PipelineMonitorEventId,
 };
+use crate::db::types::oidc_trust::OidcTrustDescr;
 use crate::db::types::pipeline::{
     ExtendedPipelineDescr, ExtendedPipelineDescrMonitoring, PatchClientMetadata, PipelineDescr,
     PipelineId,
@@ -114,6 +115,42 @@ pub(crate) trait Storage {
     /// against the stored value.
     async fn validate_api_key(&self, key: &str) -> Result<(TenantId, Vec<ApiPermission>), DBError>;
 
+    /// Lists all OIDC trust relationships for the tenant.
+    async fn list_oidc_trust(&self, tenant_id: TenantId) -> Result<Vec<OidcTrustDescr>, DBError>;
+
+    /// Retrieves a trust relationship by name.
+    async fn get_oidc_trust(
+        &self,
+        tenant_id: TenantId,
+        name: &str,
+    ) -> Result<OidcTrustDescr, DBError>;
+
+    /// Deletes a trust relationship by name.
+    async fn delete_oidc_trust(&self, tenant_id: TenantId, name: &str) -> Result<(), DBError>;
+
+    /// Persists a new trust relationship.
+    #[allow(clippy::too_many_arguments)]
+    async fn create_oidc_trust(
+        &self,
+        tenant_id: TenantId,
+        id: Uuid,
+        name: &str,
+        description: Option<&str>,
+        issuer: &str,
+        subject: &str,
+        audience: Option<&str>,
+        scopes: Vec<ApiPermission>,
+    ) -> Result<(), DBError>;
+
+    /// Finds the first trust relationship matching the given issuer + claims.
+    /// Returns the owning tenant and scopes if a match is found.
+    async fn match_oidc_trust(
+        &self,
+        issuer: &str,
+        subject: &str,
+        audiences: &[String],
+    ) -> Result<Option<(TenantId, Vec<ApiPermission>)>, DBError>;
+
     /// Retrieves a list of pipelines as extended descriptors.
     async fn list_pipelines(
         &self,
diff --git a/crates/pipeline-manager/src/db/storage_postgres.rs b/crates/pipeline-manager/src/db/storage_postgres.rs
index 40134443f72..e154e20b628 100644
--- a/crates/pipeline-manager/src/db/storage_postgres.rs
+++ b/crates/pipeline-manager/src/db/storage_postgres.rs
@@ -12,6 +12,7 @@ use crate::db::types::monitor::{
     ExtendedPipelineMonitorEvent, NewClusterMonitorEvent, PipelineMonitorEvent,
     PipelineMonitorEventId,
 };
+use crate::db::types::oidc_trust::OidcTrustDescr;
 use crate::db::types::pipeline::{
     ExtendedPipelineDescr, ExtendedPipelineDescrMonitoring, PatchClientMetadata, PipelineDescr,
     PipelineId,
@@ -163,6 +164,77 @@ impl Storage for StoragePostgres {
         Ok(result)
     }
 
+    async fn list_oidc_trust(&self, tenant_id: TenantId) -> Result<Vec<OidcTrustDescr>, DBError> {
+        let mut client = self.pool.get().await?;
+        let txn = client.transaction().await?;
+        let result = operations::oidc_trust::list_oidc_trust(&txn, tenant_id).await?;
+        txn.commit().await?;
+        Ok(result)
+    }
+
+    async fn get_oidc_trust(
+        &self,
+        tenant_id: TenantId,
+        name: &str,
+    ) -> Result<OidcTrustDescr, DBError> {
+        let mut client = self.pool.get().await?;
+        let txn = client.transaction().await?;
+        let result = operations::oidc_trust::get_oidc_trust(&txn, tenant_id, name).await?;
+        txn.commit().await?;
+        Ok(result)
+    }
+
+    async fn delete_oidc_trust(&self, tenant_id: TenantId, name: &str) -> Result<(), DBError> {
+        let mut client = self.pool.get().await?;
+        let txn = client.transaction().await?;
+        let result = operations::oidc_trust::delete_oidc_trust(&txn, tenant_id, name).await?;
+        txn.commit().await?;
+        Ok(result)
+    }
+
+    async fn create_oidc_trust(
+        &self,
+        tenant_id: TenantId,
+        id: Uuid,
+        name: &str,
+        description: Option<&str>,
+        issuer: &str,
+        subject: &str,
+        audience: Option<&str>,
+        scopes: Vec<ApiPermission>,
+    ) -> Result<(), DBError> {
+        let mut client = self.pool.get().await?;
+        let txn = client.transaction().await?;
+        operations::oidc_trust::create_oidc_trust(
+            &txn,
+            tenant_id,
+            id,
+            name,
+            description,
+            issuer,
+            subject,
+            audience,
+            &scopes,
+        )
+        .await?;
+        txn.commit().await?;
+        Ok(())
+    }
+
+    async fn match_oidc_trust(
+        &self,
+        issuer: &str,
+        subject: &str,
+        audiences: &[String],
+    ) -> Result<Option<(TenantId, Vec<ApiPermission>)>, DBError> {
+        let mut client = self.pool.get().await?;
+        let txn = client.transaction().await?;
+        let result =
+            operations::oidc_trust::match_oidc_trust(&txn, issuer, subject, audiences).await?;
+        txn.commit().await?;
+        Ok(result)
+    }
+
     async fn list_pipelines(
         &self,
         tenant_id: TenantId,
diff --git a/crates/pipeline-manager/src/db/test.rs b/crates/pipeline-manager/src/db/test.rs
index e172a0f3a0e..9f2f12ccff5 100644
--- a/crates/pipeline-manager/src/db/test.rs
+++ b/crates/pipeline-manager/src/db/test.rs
@@ -4776,6 +4776,53 @@ impl Storage for Mutex<DbModel> {
         }
     }
 
+    // OIDC trust relationships are not exercised by the proptest model.
+    async fn list_oidc_trust(
+        &self,
+        _tenant_id: TenantId,
+    ) -> DBResult<Vec<crate::db::types::oidc_trust::OidcTrustDescr>> {
+        Ok(vec![])
+    }
+
+    async fn get_oidc_trust(
+        &self,
+        _tenant_id: TenantId,
+        name: &str,
+    ) -> DBResult<crate::db::types::oidc_trust::OidcTrustDescr> {
+        Err(DBError::UnknownOidcTrust {
+            name: name.to_string(),
+        })
+    }
+
+    async fn delete_oidc_trust(&self, _tenant_id: TenantId, name: &str) -> DBResult<()> {
+        Err(DBError::UnknownOidcTrust {
+            name: name.to_string(),
+        })
+    }
+
+    async fn create_oidc_trust(
+        &self,
+        _tenant_id: TenantId,
+        _id: Uuid,
+        _name: &str,
+        _description: Option<&str>,
+        _issuer: &str,
+        _subject: &str,
+        _audience: Option<&str>,
+        _scopes: Vec<ApiPermission>,
+    ) -> DBResult<()> {
+        Ok(())
+    }
+
+    async fn match_oidc_trust(
+        &self,
+        _issuer: &str,
+        _subject: &str,
+        _audiences: &[String],
+    ) -> DBResult<Option<(TenantId, Vec<ApiPermission>)>> {
+        Ok(None)
+    }
+
     async fn list_pipelines(
         &self,
         tenant_id: TenantId,
diff --git a/crates/pipeline-manager/src/db/types.rs b/crates/pipeline-manager/src/db/types.rs
index 2306ee4ab3d..cac2e20f563 100644
--- a/crates/pipeline-manager/src/db/types.rs
+++ b/crates/pipeline-manager/src/db/types.rs
@@ -4,6 +4,7 @@
 pub mod api_key;
 pub mod combined_status;
 pub mod monitor;
+pub mod oidc_trust;
 pub mod pipeline;
 pub mod program;
 pub mod resources_status;
diff --git a/crates/pipeline-manager/src/db/types/oidc_trust.rs b/crates/pipeline-manager/src/db/types/oidc_trust.rs
new file mode 100644
index 00000000000..f4614278a9f
--- /dev/null
+++ b/crates/pipeline-manager/src/db/types/oidc_trust.rs
@@ -0,0 +1,102 @@
+use crate::db::types::api_key::ApiPermission;
+use serde::{Deserialize, Serialize};
+use std::fmt;
+use std::fmt::Display;
+use utoipa::ToSchema;
+use uuid::Uuid;
+
+/// Trust relationship identifier.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Ord, PartialOrd, Serialize, Deserialize, ToSchema)]
+#[cfg_attr(test, derive(proptest_derive::Arbitrary))]
+#[repr(transparent)]
+#[serde(transparent)]
+pub struct OidcTrustId(
+    #[cfg_attr(test, proptest(strategy = "crate::db::test::limited_uuid()"))] pub Uuid,
+);
+
+impl Display for OidcTrustId {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.fmt(f)
+    }
+}
+
+/// Trust relationship descriptor returned to clients.
+///
+/// Wildcards: a `*` in `subject` or `audience` matches any sequence of
+/// characters; all other characters must match exactly.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, ToSchema)]
+pub struct OidcTrustDescr {
+    pub id: OidcTrustId,
+    pub name: String,
+    #[serde(default)]
+    pub description: Option<String>,
+    pub issuer: String,
+    pub subject: String,
+    #[serde(default)]
+    pub audience: Option<String>,
+    pub scopes: Vec<ApiPermission>,
+}
+
+/// Returns true if `pattern` matches `value`, where `*` in `pattern` matches
+/// any sequence of characters and all other characters must match exactly.
+pub fn claim_matches(pattern: &str, value: &str) -> bool {
+    let p = pattern.as_bytes();
+    let v = value.as_bytes();
+    let mut pi = 0usize;
+    let mut vi = 0usize;
+    let mut star_pi: Option<usize> = None;
+    let mut star_vi = 0usize;
+    while vi < v.len() {
+        if pi < p.len() && p[pi] == b'*' {
+            star_pi = Some(pi);
+            star_vi = vi;
+            pi += 1;
+        } else if pi < p.len() && p[pi] == v[vi] {
+            pi += 1;
+            vi += 1;
+        } else if let Some(sp) = star_pi {
+            pi = sp + 1;
+            star_vi += 1;
+            vi = star_vi;
+        } else {
+            return false;
+        }
+    }
+    while pi < p.len() && p[pi] == b'*' {
+        pi += 1;
+    }
+    pi == p.len()
+}
+
+#[cfg(test)]
+mod test {
+    use super::claim_matches;
+
+    #[test]
+    fn exact_match() {
+        assert!(claim_matches("foo", "foo"));
+        assert!(!claim_matches("foo", "bar"));
+        assert!(!claim_matches("foo", "foobar"));
+    }
+
+    #[test]
+    fn star_prefix() {
+        assert!(claim_matches("prefix/*", "prefix/anything"));
+        assert!(claim_matches("prefix/*", "prefix/"));
+        assert!(!claim_matches("prefix/*", "other/x"));
+    }
+
+    #[test]
+    fn star_middle_and_suffix() {
+        assert!(claim_matches("a/*/c", "a/b/c"));
+        assert!(claim_matches("a/*/c", "a/x/y/c"));
+        assert!(!claim_matches("a/*/c", "a/b/d"));
+        assert!(claim_matches("*-prod", "service-prod"));
+    }
+
+    #[test]
+    fn full_wildcard() {
+        assert!(claim_matches("*", ""));
+        assert!(claim_matches("*", "anything-goes"));
+    }
+}
diff --git a/js-packages/web-console/src/lib/components/auth/ProfileButton.svelte b/js-packages/web-console/src/lib/components/auth/ProfileButton.svelte
index ca6e720c69c..3d36be2f1cc 100644
--- a/js-packages/web-console/src/lib/components/auth/ProfileButton.svelte
+++ b/js-packages/web-console/src/lib/components/auth/ProfileButton.svelte
@@ -5,6 +5,7 @@
   import Popup from '$lib/components/common/Popup.svelte'
   import DarkModeSwitch from '$lib/components/layout/userPopup/DarkModeSwitch.svelte'
   import ApiKeyMenu from '$lib/components/other/ApiKeyMenu.svelte'
+  import OidcTrustMenu from '$lib/components/other/OidcTrustMenu.svelte'
   import VersionDisplay from '$lib/components/version/VersionDisplay.svelte'
   import type { ClusterHealthStatus } from '$lib/compositions/health/useClusterHealth.svelte'
   import { useGlobalDialog } from '$lib/compositions/layout/useGlobalDialog.svelte'
@@ -77,11 +78,17 @@
         {#snippet apiKeysIcon()}
           <div class="fd fd-key text-[20px]"></div>
         {/snippet}
+        {#snippet oidcTrustIcon()}
+          <div class="fd fd-user text-[20px]"></div>
+        {/snippet}
 
         {#if typeof auth === 'object' && 'logout' in auth}
           {@render profileItemButton('Manage API keys', apiKeysIcon, {
             onclick: () => (globalDialog.dialog = apiKeyDialog)
           })}
+          {@render profileItemButton('Manage OIDC trust', oidcTrustIcon, {
+            onclick: () => (globalDialog.dialog = oidcTrustDialog)
+          })}
 
           <div class="hr"></div>
         {/if}
@@ -140,3 +147,7 @@
 {#snippet apiKeyDialog()}
   <ApiKeyMenu></ApiKeyMenu>
 {/snippet}
+
+{#snippet oidcTrustDialog()}
+  <OidcTrustMenu></OidcTrustMenu>
+{/snippet}
diff --git a/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte b/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte
new file mode 100644
index 00000000000..7e8487bde79
--- /dev/null
+++ b/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte
@@ -0,0 +1,140 @@
+<script lang="ts">
+  import { Control, Field, FieldErrors, Label } from 'formsnap'
+  import { setError, superForm } from 'sveltekit-superforms'
+  import { valibot } from 'sveltekit-superforms/adapters'
+
+  import * as va from 'valibot'
+  import { postOidcTrust } from '$lib/services/pipelineManager'
+
+  const { onSubmit, onSuccess }: { onSubmit?: () => void; onSuccess?: () => void } = $props()
+
+  const schema = va.object({
+    name: va.pipe(va.string(), va.minLength(1, 'Specify a name')),
+    issuer: va.pipe(va.string(), va.minLength(1, 'Specify the issuer URL')),
+    subject: va.pipe(va.string(), va.minLength(1, 'Specify a subject pattern')),
+    audience: va.string(),
+    description: va.string()
+  })
+
+  const form = superForm(
+    { name: '', issuer: '', subject: '', audience: '', description: '' },
+    {
+      SPA: true,
+      validators: valibot(schema),
+      onUpdate({ form: f }) {
+        if (!f.valid) return
+        onSubmit?.()
+        postOidcTrust({
+          name: f.data.name,
+          issuer: f.data.issuer,
+          subject: f.data.subject,
+          audience: f.data.audience || undefined,
+          description: f.data.description || undefined
+        }).then(
+          () => onSuccess?.(),
+          (e) => setError(f, 'name', 'message' in e ? e.message : String(e))
+        )
+      }
+    }
+  )
+  const { form: formData, enhance, submit } = form
+</script>
+
+<form
+  class="flex flex-col gap-3"
+  use:enhance
+  onkeydown={(event) => {
+    if (event.key === 'Enter') {
+      event.preventDefault()
+      submit()
+    }
+  }}
+>
+  <Field {form} name="name">
+    <Control>
+      {#snippet children(attrs)}
+        <Label>Name</Label>
+        <input
+          placeholder="github-actions-prod"
+          class="input w-full"
+          {...attrs}
+          bind:value={$formData.name}
+        />
+      {/snippet}
+    </Control>
+    <FieldErrors>
+      {#snippet children({ errors, errorProps })}
+        {#each errors as error}
+          <span class="text-error-500" {...errorProps}>{error}</span>
+        {/each}
+      {/snippet}
+    </FieldErrors>
+  </Field>
+
+  <Field {form} name="issuer">
+    <Control>
+      {#snippet children(attrs)}
+        <Label>Issuer URL</Label>
+        <input
+          placeholder="https://token.actions.githubusercontent.com"
+          class="input w-full"
+          {...attrs}
+          bind:value={$formData.issuer}
+        />
+      {/snippet}
+    </Control>
+  </Field>
+
+  <Field {form} name="subject">
+    <Control>
+      {#snippet children(attrs)}
+        <Label>Subject pattern</Label>
+        <input
+          placeholder="repo:my-org/my-repo:ref:refs/heads/main"
+          class="input w-full"
+          {...attrs}
+          bind:value={$formData.subject}
+        />
+      {/snippet}
+    </Control>
+  </Field>
+
+  <Field {form} name="audience">
+    <Control>
+      {#snippet children(attrs)}
+        <Label>Audience pattern (optional)</Label>
+        <input
+          placeholder="feldera"
+          class="input w-full"
+          {...attrs}
+          bind:value={$formData.audience}
+        />
+      {/snippet}
+    </Control>
+  </Field>
+
+  <Field {form} name="description">
+    <Control>
+      {#snippet children(attrs)}
+        <Label>Description (optional)</Label>
+        <input
+          placeholder="What does this trust grant?"
+          class="input w-full"
+          {...attrs}
+          bind:value={$formData.description}
+        />
+      {/snippet}
+    </Control>
+  </Field>
+
+  <p class="text-xs opacity-70">
+    JWTs from <code>Issuer</code> whose <code>sub</code> matches
+    <code>Subject pattern</code> (and, if specified, whose <code>aud</code> matches
+    <code>Audience pattern</code>) authorize requests as this tenant. <code>*</code> is a
+    wildcard.
+  </p>
+
+  <div class="flex justify-end">
+    <button class="btn preset-filled-surface-50-950">Create</button>
+  </div>
+</form>
diff --git a/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte b/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte
new file mode 100644
index 00000000000..1037b683a73
--- /dev/null
+++ b/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte
@@ -0,0 +1,76 @@
+<script lang="ts">
+  import { asyncReadable } from '@square/svelte-store'
+  import NewOidcTrustForm from '$lib/components/oidcTrust/NewOidcTrustForm.svelte'
+  import GenericDialog from '$lib/components/dialogs/GenericDialog.svelte'
+  import { useGlobalDialog } from '$lib/compositions/layout/useGlobalDialog.svelte'
+  import {
+    deleteOidcTrust,
+    getOidcTrustList,
+    type OidcTrustDescr
+  } from '$lib/services/pipelineManager'
+
+  const trusts = asyncReadable<OidcTrustDescr[]>([], getOidcTrustList, { reloadable: true })
+
+  const globalDialog = useGlobalDialog()
+  const thisDialog = globalDialog.dialog
+</script>
+
+<GenericDialog content={{ title: 'Manage OIDC trust relationships' }}>
+  <div class="scrollbar flex max-h-[80vh] flex-col gap-2 overflow-auto">
+    {#each $trusts as trust}
+      {#snippet deleteDialog()}
+        <GenericDialog
+          content={{
+            title: `Delete ${trust.name}?`,
+            description: 'Are you sure? This action is irreversible.',
+            onSuccess: {
+              name: 'Delete',
+              callback: async () => {
+                await deleteOidcTrust(trust.name)
+                globalDialog.dialog = thisDialog
+              },
+              'data-testid': 'button-confirm-delete'
+            },
+            onCancel: {
+              callback: () => {
+                globalDialog.dialog = thisDialog
+              }
+            }
+          }}
+          noclose
+          danger
+        ></GenericDialog>
+      {/snippet}
+      <div class="flex flex-nowrap">
+        <div class="w-full">
+          <div>
+            {trust.name}
+            <span class="text-xs opacity-70">[{trust.scopes.join(', ')}]</span>
+          </div>
+          <div class="text-sm">
+            <code>{trust.issuer}</code> · sub=<code>{trust.subject}</code
+            >{#if trust.audience}
+              · aud=<code>{trust.audience}</code>{/if}
+          </div>
+          {#if trust.description}
+            <div class="text-xs opacity-70">{trust.description}</div>
+          {/if}
+        </div>
+        <button
+          class="fd fd-trash-2 btn-icon text-[20px]"
+          aria-label="Delete {trust.name} trust relationship"
+          onclick={() => {
+            globalDialog.dialog = deleteDialog
+          }}
+        ></button>
+      </div>
+    {:else}
+      No OIDC trust relationships configured
+    {/each}
+  </div>
+  <NewOidcTrustForm
+    onSuccess={() => {
+      trusts.reload?.()
+    }}
+  ></NewOidcTrustForm>
+</GenericDialog>
diff --git a/js-packages/web-console/src/lib/services/pipelineManager.ts b/js-packages/web-console/src/lib/services/pipelineManager.ts
index 4a31885d49a..80cde74deb0 100644
--- a/js-packages/web-console/src/lib/services/pipelineManager.ts
+++ b/js-packages/web-console/src/lib/services/pipelineManager.ts
@@ -605,6 +605,73 @@ export const deleteApiKey = (name: string, options?: FetchOptions) =>
     }
   )
 
+// OIDC trust relationships
+//
+// These wrappers talk to the manager directly instead of going through the
+// generated client because the SDK has not yet been regenerated against the
+// new endpoints. After running `bun run generate-openapi`, these can be
+// replaced with calls to the generated `listOidcTrust` / `postOidcTrust` /
+// `deleteOidcTrust` functions.
+import { getAuthorizationHeaders } from '$lib/services/auth'
+
+export type OidcTrustDescr = {
+  id: string
+  name: string
+  description?: string | null
+  issuer: string
+  subject: string
+  audience?: string | null
+  scopes: ('Read' | 'Write')[]
+}
+
+export type NewOidcTrustRequest = {
+  name: string
+  issuer: string
+  subject: string
+  audience?: string
+  description?: string
+}
+
+const oidcTrustFetch = async (path: string, init?: RequestInit) => {
+  const authHeaders = await getAuthorizationHeaders()
+  const res = await fetch(`${felderaEndpoint}/v0${path}`, {
+    ...init,
+    headers: {
+      Accept: 'application/json',
+      'Content-Type': 'application/json',
+      ...authHeaders,
+      ...(init?.headers ?? {})
+    }
+  })
+  if (!res.ok) {
+    const body = await res.text()
+    let message = `Request to ${path} failed: ${res.status}`
+    try {
+      const parsed = JSON.parse(body)
+      if (parsed?.message) message = parsed.message
+    } catch {
+      // ignore
+    }
+    throw new Error(message)
+  }
+  if (res.status === 204 || res.headers.get('content-length') === '0') return null
+  return res.json()
+}
+
+export const getOidcTrustList = (): Promise<OidcTrustDescr[]> =>
+  oidcTrustFetch('/oidc_trust').then((v) => (v as OidcTrustDescr[]) ?? [])
+
+export const postOidcTrust = (
+  body: NewOidcTrustRequest
+): Promise<{ id: string; name: string }> =>
+  oidcTrustFetch('/oidc_trust', {
+    method: 'POST',
+    body: JSON.stringify(body)
+  })
+
+export const deleteOidcTrust = (name: string): Promise<unknown> =>
+  oidcTrustFetch(`/oidc_trust/${encodeURIComponent(name)}`, { method: 'DELETE' })
+
 export const dismissDeploymentError = (pipeline_name: string) =>
   mapResponse(postPipelineDismissError({ path: { pipeline_name } }), (v) => v)
 
diff --git a/openapi.json b/openapi.json
index 9a908cf281c..60708a8cf3b 100644
--- a/openapi.json
+++ b/openapi.json
@@ -546,6 +546,184 @@
         ]
       }
     },
+    "/v0/oidc_trust": {
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "List OIDC trust relationships",
+        "operationId": "list_oidc_trust",
+        "responses": {
+          "200": {
+            "description": "Trust relationships retrieved",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/OidcTrustDescr"
+                  }
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "JSON web token (JWT) or API key": []
+          }
+        ]
+      },
+      "post": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Create OIDC trust relationship",
+        "operationId": "post_oidc_trust",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/NewOidcTrustRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "description": "Trust relationship created",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NewOidcTrustResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Invalid request",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
+          "409": {
+            "description": "Name already in use",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "JSON web token (JWT) or API key": []
+          }
+        ]
+      }
+    },
+    "/v0/oidc_trust/{name}": {
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Get OIDC trust relationship",
+        "operationId": "get_oidc_trust",
+        "parameters": [
+          {
+            "name": "name",
+            "in": "path",
+            "description": "Trust relationship name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Trust relationship retrieved",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OidcTrustDescr"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "No relationship with that name",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "JSON web token (JWT) or API key": []
+          }
+        ]
+      },
+      "delete": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Delete OIDC trust relationship",
+        "operationId": "delete_oidc_trust",
+        "parameters": [
+          {
+            "name": "name",
+            "in": "path",
+            "description": "Trust relationship name",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Trust relationship deleted"
+          },
+          "404": {
+            "description": "No relationship with that name",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "JSON web token (JWT) or API key": []
+          }
+        ]
+      }
+    },
     "/v0/pipelines": {
       "get": {
         "tags": [
@@ -10855,6 +11033,60 @@
           }
         }
       },
+      "NewOidcTrustRequest": {
+        "type": "object",
+        "description": "Request to create a new OIDC trust relationship.",
+        "required": [
+          "name",
+          "issuer",
+          "subject"
+        ],
+        "properties": {
+          "audience": {
+            "type": "string",
+            "description": "Optional audience claim pattern. `*` matches any sequence of characters.\nIf omitted, the audience claim is not checked.",
+            "example": "feldera",
+            "nullable": true
+          },
+          "description": {
+            "type": "string",
+            "description": "Optional human-readable description.",
+            "example": "GitHub Actions deploys from main branch",
+            "nullable": true
+          },
+          "issuer": {
+            "type": "string",
+            "description": "Issuer URL exactly as it appears in the `iss` claim.\nJWKS are discovered at `<issuer>/.well-known/openid-configuration`.",
+            "example": "https://token.actions.githubusercontent.com"
+          },
+          "name": {
+            "type": "string",
+            "description": "Trust relationship name. Unique within the tenant.",
+            "example": "github-actions-prod"
+          },
+          "subject": {
+            "type": "string",
+            "description": "Subject claim pattern. `*` matches any sequence of characters.",
+            "example": "repo:my-org/my-repo:ref:refs/heads/main"
+          }
+        }
+      },
+      "NewOidcTrustResponse": {
+        "type": "object",
+        "description": "Response to a successful create.",
+        "required": [
+          "id",
+          "name"
+        ],
+        "properties": {
+          "id": {
+            "$ref": "#/components/schemas/OidcTrustId"
+          },
+          "name": {
+            "type": "string"
+          }
+        }
+      },
       "NexmarkInputConfig": {
         "type": "object",
         "description": "Configuration for generating Nexmark input data.\n\nThis connector must be used exactly three times in a pipeline if it is used\nat all, once for each [`NexmarkTable`].",
@@ -10933,6 +11165,50 @@
           "description": "Additional options as key-value pairs.\n\nThe following keys are supported:\n\n* S3:\n- `access_key_id`: AWS Access Key.\n- `secret_access_key`: AWS Secret Access Key.\n- `region`: Region.\n- `default_region`: Default region.\n- `endpoint`: Custom endpoint for communicating with S3,\ne.g. `https://localhost:4566` for testing against a localstack\ninstance.\n- `token`: Token to use for requests (passed to underlying provider).\n- [Other keys](https://docs.rs/object_store/latest/object_store/aws/enum.AmazonS3ConfigKey.html#variants).\n* Google Cloud Storage:\n- `service_account`: Path to the service account file.\n- `service_account_key`: The serialized service account key.\n- `google_application_credentials`: Application credentials path.\n- [Other keys](https://docs.rs/object_store/latest/object_store/gcp/enum.GoogleConfigKey.html).\n* Microsoft Azure Blob Storage:\n- `access_key`: Azure Access Key.\n- `container_name`: Azure Container Name.\n- `account`: Azure Account.\n- `bearer_token_authorization`: Static bearer token for authorizing requests.\n- `client_id`: Client ID for use in client secret or Kubernetes federated credential flow.\n- `client_secret`: Client secret for use in client secret flow.\n- `tenant_id`: Tenant ID for use in client secret or Kubernetes federated credential flow.\n- `endpoint`: Override the endpoint for communicating with blob storage.\n- [Other keys](https://docs.rs/object_store/latest/object_store/azure/enum.AzureConfigKey.html#variants).\n\nOptions set through the URL take precedence over those set with these\noptions."
         }
       },
+      "OidcTrustDescr": {
+        "type": "object",
+        "description": "Trust relationship descriptor returned to clients.\n\nWildcards: a `*` in `subject` or `audience` matches any sequence of\ncharacters; all other characters must match exactly.",
+        "required": [
+          "id",
+          "name",
+          "issuer",
+          "subject",
+          "scopes"
+        ],
+        "properties": {
+          "audience": {
+            "type": "string",
+            "nullable": true
+          },
+          "description": {
+            "type": "string",
+            "nullable": true
+          },
+          "id": {
+            "$ref": "#/components/schemas/OidcTrustId"
+          },
+          "issuer": {
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          },
+          "scopes": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/ApiPermission"
+            }
+          },
+          "subject": {
+            "type": "string"
+          }
+        }
+      },
+      "OidcTrustId": {
+        "type": "string",
+        "format": "uuid",
+        "description": "Trust relationship identifier."
+      },
       "Op": {
         "type": "object",
         "required": [
diff --git a/python/feldera/rest/_httprequests.py b/python/feldera/rest/_httprequests.py
index 53f311bf542..bba72c6a3b5 100644
--- a/python/feldera/rest/_httprequests.py
+++ b/python/feldera/rest/_httprequests.py
@@ -62,8 +62,27 @@ def __init__(self, config: Config) -> None:
         if isinstance(self.requests_verify, bool) and not self.requests_verify:
             urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
 
-        if self.config.api_key:
-            self.headers["Authorization"] = f"Bearer {self.config.api_key}"
+    def _resolve_bearer(self) -> Optional[str]:
+        """Return the bearer token to use for this request, or None."""
+        key = self.config.api_key
+        if key is None:
+            return None
+        if callable(key):
+            token = key()
+            if not isinstance(token, str):
+                raise TypeError(
+                    f"api_key callable returned {type(token).__name__}, expected str"
+                )
+            return token.strip()
+        return key
+
+    def _headers_with_auth(self) -> dict:
+        """Headers for the next request, with a freshly-resolved bearer."""
+        headers = dict(self.headers)
+        token = self._resolve_bearer()
+        if token:
+            headers["Authorization"] = f"Bearer {token}"
+        return headers
 
     def _check_cluster_health(self) -> bool:
         """Check `/cluster_healthz`; return True iff `all_healthy` is reported."""
@@ -140,12 +159,13 @@ def _do_single_request(
         data: Any,
         params: Optional[Mapping[str, Any]],
         stream: bool,
+        headers: Optional[dict] = None,
     ) -> Any:
         response = http_method(
             request_path,
             data=data,
             timeout=(self.config.connection_timeout, self.config.timeout),
-            headers=self.headers,
+            headers=headers if headers is not None else self.headers,
             params=params,
             stream=stream,
             verify=self.requests_verify,
@@ -200,11 +220,14 @@ def send_request(
         else:
             data = json_serialize(body)
 
+        headers = self._headers_with_auth()
+        headers["Content-Type"] = content_type
+
         logging.debug(
             "sending %s request to: %s with headers: %s, and params: %s",
             http_method.__name__,
             request_path,
-            _redact_headers(self.headers),
+            _redact_headers(headers),
             str(params),
         )
 
@@ -220,8 +243,25 @@ def send_request(
             for attempt in retryer:
                 with attempt:
                     return self._do_single_request(
-                        http_method, request_path, data, params, stream
+                        http_method, request_path, data, params, stream, headers
                     )
+        except FelderaAPIError as err:
+            # On 401, if the bearer is a callable, re-resolve once and retry.
+            # Covers tokens that expire mid-flight in long-running scripts
+            # without forcing every caller to wrap calls in their own retry.
+            # One-shot is enforced by scope: this except runs at most once
+            # per `send_request` call.
+            if err.status_code == 401 and callable(self.config.api_key):
+                logging.info(
+                    "401 from %s; re-resolving api_key callable and retrying once",
+                    request_path,
+                )
+                headers = self._headers_with_auth()
+                headers["Content-Type"] = content_type
+                return self._do_single_request(
+                    http_method, request_path, data, params, stream, headers
+                )
+            raise
         except requests.exceptions.Timeout as err:
             raise FelderaTimeoutError(str(err)) from err
         except requests.exceptions.ConnectionError as err:
diff --git a/python/feldera/rest/config.py b/python/feldera/rest/config.py
index 3617c980c61..d7da4964c8d 100644
--- a/python/feldera/rest/config.py
+++ b/python/feldera/rest/config.py
@@ -1,10 +1,16 @@
 import logging
 import os
-from typing import Optional
+from typing import Callable, Optional, Union
 
 from feldera.rest._helpers import requests_verify_from_env
 from feldera.rest.retry import RetryConfig
 
+# Either a static bearer (e.g. `"apikey:..."`, a long-lived JWT) or a
+# zero-arg callable resolved per-request — covers OIDC workload-identity
+# flows that mint short-lived tokens (Kubernetes projected SA token,
+# GitHub Actions OIDC, Tailscale tsidp, ...).
+ApiKey = Union[str, Callable[[], str]]
+
 
 class Config:
     """
@@ -15,7 +21,7 @@ class Config:
     def __init__(
         self,
         url: Optional[str] = None,
-        api_key: Optional[str] = None,
+        api_key: Optional[ApiKey] = None,
         version: Optional[str] = None,
         timeout: Optional[float] = None,
         connection_timeout: Optional[float] = None,
@@ -31,7 +37,7 @@ def __init__(
             Default: `RetryConfig()` — 3 retries with exponential backoff starting at 2 seconds.
         """
         self.url: str = url or os.environ.get("FELDERA_HOST") or "http://localhost:8080"
-        self.api_key: Optional[str] = api_key or os.environ.get("FELDERA_API_KEY")
+        self.api_key: Optional[ApiKey] = api_key or os.environ.get("FELDERA_API_KEY")
         self.version: str = version or "v0"
         self.timeout: Optional[float] = timeout
         self.connection_timeout: Optional[float] = connection_timeout
diff --git a/python/feldera/rest/feldera_client.py b/python/feldera/rest/feldera_client.py
index 7f35d1e7aab..d2bda473053 100644
--- a/python/feldera/rest/feldera_client.py
+++ b/python/feldera/rest/feldera_client.py
@@ -15,7 +15,7 @@
 from feldera.enums import BootstrapPolicy, PipelineFieldSelector, PipelineStatus
 from feldera.rest._helpers import determine_client_version
 from feldera.rest._httprequests import HttpRequests
-from feldera.rest.config import Config
+from feldera.rest.config import ApiKey, Config  # noqa: F401 — re-exported
 from feldera.rest.errors import FelderaAPIError, FelderaTimeoutError
 from feldera.rest.feldera_config import FelderaConfig
 from feldera.rest.pipeline import Pipeline
@@ -58,7 +58,7 @@ class FelderaClient:
     def __init__(
         self,
         url: Optional[str] = None,
-        api_key: Optional[str] = None,
+        api_key: Optional[ApiKey] = None,
         timeout: Optional[float] = None,
         connection_timeout: Optional[float] = None,
         requests_verify: Optional[bool | str] = None,
@@ -70,7 +70,15 @@ def __init__(
         :param url: (Optional) URL to the Feldera API.
             The default is read from the `FELDERA_HOST` environment variable;
             if the variable is not set, the default is `"http://localhost:8080"`.
-        :param api_key: (Optional) API key to access Feldera (format: `"apikey:..."`).
+        :param api_key: (Optional) Bearer credential. Either:
+            - a string — a Feldera API key (`"apikey:..."`) or a long-lived JWT;
+            - a zero-arg callable returning a string — resolved before every
+              request, suitable for short-lived OIDC tokens (Kubernetes
+              projected SA token, GitHub Actions OIDC, Tailscale tsidp, ...).
+              On HTTP 401 the callable is re-invoked once and the request
+              retried, so a token expiring mid-flight in a long-running
+              script self-heals.
+
             The default is read from the `FELDERA_API_KEY` environment variable;
             if the variable is not set, the default is `None` (no API key is provided).
         :param timeout: (Optional) Duration in seconds that the client will wait to receive
@@ -1628,6 +1636,73 @@ def create_api_key(self, name: str) -> dict:
             body={"name": name},
         )
 
+    def list_oidc_trust(self) -> List[dict]:
+        """
+        List the OIDC trust relationships configured for the current tenant.
+
+        :returns: A list of dicts each describing a trust relationship
+                  (`id`, `name`, `description`, `issuer`, `subject`,
+                  `audience`, `scopes`).
+        """
+        return self.http.get(path="/oidc_trust")
+
+    def get_oidc_trust(self, name: str) -> dict:
+        """
+        Retrieve a single OIDC trust relationship by name.
+
+        :param name: Trust relationship name.
+        """
+        return self.http.get(path=f"/oidc_trust/{name}")
+
+    def create_oidc_trust(
+        self,
+        name: str,
+        issuer: str,
+        subject: str,
+        audience: Optional[str] = None,
+        description: Optional[str] = None,
+    ) -> dict:
+        """
+        Register a new OIDC trust relationship.
+
+        Any JWT signed by `issuer` whose `sub` claim matches `subject`
+        (and, if specified, `aud` claim matches `audience`) is authorized
+        as the current tenant with read/write scopes. `*` is a wildcard
+        in `subject` and `audience`.
+
+        :param name: Unique name within the tenant.
+        :param issuer: Issuer URL exactly as it appears in the `iss` claim.
+        :param subject: Pattern matched against the JWT `sub` claim.
+        :param audience: Pattern matched against the JWT `aud` claim. Omit
+                         to skip audience matching.
+        :param description: Free-text description.
+        :returns: A dict with keys `id` and `name`.
+        :raises FelderaAPIError: If `name` is already in use or fields are
+                                 invalid.
+        """
+        if not name:
+            raise ValueError("Trust relationship name must be a non-empty string")
+        if not issuer:
+            raise ValueError("`issuer` must be a non-empty string")
+        if not subject:
+            raise ValueError("`subject` must be a non-empty string")
+        body: Dict[str, Any] = {
+            "name": name,
+            "issuer": issuer,
+            "subject": subject,
+        }
+        if audience is not None:
+            body["audience"] = audience
+        if description is not None:
+            body["description"] = description
+        return self.http.post(path="/oidc_trust", body=body)
+
+    def delete_oidc_trust(self, name: str) -> None:
+        """
+        Delete an OIDC trust relationship by name.
+        """
+        self.http.delete(path=f"/oidc_trust/{name}")
+
     def get_pipeline_support_bundle(
         self, pipeline_name: str, params: Optional[Dict[str, Any]] = None
     ) -> bytes:

From f8d0a82130090605181b085759af0891abee0a29 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Sun, 7 Jun 2026 20:07:21 -0700
Subject: [PATCH 02/55] [pipeline-manager] Add role-based access control

Replace the single-principal model, where a tenant was the only principal, with
per-user, per-tenant roles ordered read < write < admin < owner. A
deny-by-default table declares the minimum role for every /v0 route and a
middleware enforces it, so a new endpoint cannot ship world-accessible.

Adds the app_user and tenant_membership tables and replaces the per-key scopes
array with a single role. An admin manages members and their roles within a
tenant; a platform owner, configured at deploy time through FELDERA_OWNERS,
manages tenants across the installation. The web console gains an Admin page for
members, roles and tenants. scripts/dummy_oidc.py and scripts/rbac_demo.py bring
up a local playground for exercising the roles by hand.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 .../workflows/test-integration-platform.yml   |  81 +++
 crates/fda/src/cli.rs                         |  95 ++-
 crates/fda/src/main.rs                        | 146 +++--
 .../migrations/V34__oidc_trust.sql            |  18 -
 .../migrations/V35__oidc_trust.sql            |  22 +
 .../pipeline-manager/migrations/V36__rbac.sql |  34 +
 crates/pipeline-manager/src/api.rs            |   1 +
 crates/pipeline-manager/src/api/endpoints.rs  |   1 +
 .../src/api/endpoints/api_key.rs              |  32 +-
 .../src/api/endpoints/config.rs               |  29 +-
 .../src/api/endpoints/oidc_trust.rs           |  55 +-
 .../src/api/endpoints/tenant.rs               | 307 +++++++++
 crates/pipeline-manager/src/api/main.rs       |  41 +-
 crates/pipeline-manager/src/api/rbac.rs       | 510 +++++++++++++++
 crates/pipeline-manager/src/auth.rs           | 564 +++++++++++-----
 crates/pipeline-manager/src/config.rs         |  35 +
 crates/pipeline-manager/src/db/error.rs       |  76 +++
 crates/pipeline-manager/src/db/operations.rs  |   1 +
 .../src/db/operations/api_key.rs              |  66 +-
 .../src/db/operations/oidc_trust.rs           | 107 +--
 .../src/db/operations/tenant.rs               | 119 +++-
 .../src/db/operations/user.rs                 | 178 +++++
 .../src/db/operations/utils.rs                |  21 +
 crates/pipeline-manager/src/db/storage.rs     |  97 ++-
 .../src/db/storage_postgres.rs                | 151 ++++-
 crates/pipeline-manager/src/db/test.rs        | 411 +++++++++++-
 crates/pipeline-manager/src/db/types.rs       |   2 +
 .../pipeline-manager/src/db/types/api_key.rs  |  30 +-
 .../src/db/types/oidc_trust.rs                |  28 +-
 crates/pipeline-manager/src/db/types/role.rs  | 145 ++++
 crates/pipeline-manager/src/db/types/user.rs  |  48 ++
 crates/pipeline-manager/src/db/types/utils.rs |  13 +
 .../src/lib/components/admin/AdminPage.svelte | 120 ++++
 .../lib/components/admin/TenantList.svelte    | 101 +++
 .../lib/components/admin/UserRoleTable.svelte | 222 +++++++
 .../components/apiKey/NewApiKeyForm.svelte    |  14 +-
 .../lib/components/auth/ProfileButton.svelte  |  18 +-
 .../oidcTrust/NewOidcTrustForm.svelte         |  62 +-
 .../lib/components/other/ApiKeyMenu.svelte    |   2 +-
 .../lib/components/other/OidcTrustMenu.svelte |   7 +-
 .../compositions/usePipelineManager.svelte.ts |   7 +-
 .../src/lib/services/manager/index.ts         |  86 ++-
 .../src/lib/services/manager/sdk.gen.ts       | 294 +++++++++
 .../src/lib/services/manager/types.gen.ts     | 615 ++++++++++++++++-
 .../src/lib/services/pipelineManager.ts       | 132 ++--
 .../(authenticated)/admin/+page.svelte        |  27 +
 .../(system)/(authenticated)/admin/+page.ts   |  13 +
 js-packages/web-console/src/routes/+layout.ts |  30 +-
 openapi.json                                  | 468 ++++++++++++-
 python/feldera/rest/_httprequests.py          |   8 +-
 python/feldera/rest/config.py                 |   6 +
 python/feldera/rest/errors.py                 |  12 +-
 python/feldera/rest/feldera_client.py         |  38 +-
 python/tests/unit/test_callable_api_key.py    | 125 ++++
 scripts/dummy_oidc.py                         | 618 ++++++++++++++++++
 scripts/rbac_demo.py                          | 161 +++++
 scripts/rbac_up.sh                            |  89 +++
 57 files changed, 6160 insertions(+), 579 deletions(-)
 delete mode 100644 crates/pipeline-manager/migrations/V34__oidc_trust.sql
 create mode 100644 crates/pipeline-manager/migrations/V35__oidc_trust.sql
 create mode 100644 crates/pipeline-manager/migrations/V36__rbac.sql
 create mode 100644 crates/pipeline-manager/src/api/endpoints/tenant.rs
 create mode 100644 crates/pipeline-manager/src/api/rbac.rs
 create mode 100644 crates/pipeline-manager/src/db/operations/user.rs
 create mode 100644 crates/pipeline-manager/src/db/types/role.rs
 create mode 100644 crates/pipeline-manager/src/db/types/user.rs
 create mode 100644 js-packages/web-console/src/lib/components/admin/AdminPage.svelte
 create mode 100644 js-packages/web-console/src/lib/components/admin/TenantList.svelte
 create mode 100644 js-packages/web-console/src/lib/components/admin/UserRoleTable.svelte
 create mode 100644 js-packages/web-console/src/routes/(system)/(authenticated)/admin/+page.svelte
 create mode 100644 js-packages/web-console/src/routes/(system)/(authenticated)/admin/+page.ts
 create mode 100644 python/tests/unit/test_callable_api_key.py
 create mode 100755 scripts/dummy_oidc.py
 create mode 100755 scripts/rbac_demo.py
 create mode 100755 scripts/rbac_up.sh

diff --git a/.github/workflows/test-integration-platform.yml b/.github/workflows/test-integration-platform.yml
index 11b70053c65..39ffde1b237 100644
--- a/.github/workflows/test-integration-platform.yml
+++ b/.github/workflows/test-integration-platform.yml
@@ -145,6 +145,87 @@ jobs:
           docker inspect pipeline-manager-https || true
           docker rm -f pipeline-manager-https || true
 
+  # Exercises the RBAC + OIDC-trust auth surface end to end against a
+  # self-contained dummy OIDC issuer, so it always runs (unlike the OIDC paths
+  # gated on an external provider). The manager runs with `--network host` so it
+  # reaches the issuer on localhost for discovery/JWKS; `rbac_demo.py` mints one
+  # token per role and asserts the RBAC matrix (reader denied mutations, write
+  # cannot mint an admin key, admin creates an OIDC trust, owner sees the tenant
+  # list). Its non-zero exit fails the job.
+  rbac-oidc-trust:
+    if: ${{ !contains(vars.CI_SKIP_JOBS, 'rbac-oidc-trust') }}
+    name: RBAC + OIDC trust (self-contained dummy IdP)
+    runs-on: ubuntu-latest-amd64
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Install the latest version of uv
+        uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6
+
+      - name: Login to GHCR with GITHUB_TOKEN
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+
+      - name: Start dummy OIDC issuer in background
+        run: |
+          uv run scripts/dummy_oidc.py --issuer http://localhost:9876 >dummy-oidc.log 2>&1 &
+          echo "OIDC_PID=$!" >> "$GITHUB_ENV"
+          for i in {1..30}; do
+            if curl -sf http://localhost:9876/.well-known/openid-configuration >/dev/null; then
+              echo "dummy OIDC issuer is up"; exit 0
+            fi
+            sleep 1
+          done
+          echo "dummy OIDC issuer did not come up"; cat dummy-oidc.log; exit 1
+
+      - name: Start pipeline-manager with auth enabled (owner=owner@example.com)
+        run: |
+          docker run -d \
+            --pull missing \
+            --name pipeline-manager-rbac \
+            --network host \
+            --health-cmd='curl --fail --silent --max-time 2 http://localhost:8080/healthz || exit 1' \
+            --health-interval=10s \
+            --health-timeout=5s \
+            --health-retries=5 \
+            -e AUTH_PROVIDER=generic-oidc \
+            -e FELDERA_AUTH_CLIENT_ID=feldera \
+            -e FELDERA_AUTH_ISSUER=http://localhost:9876 \
+            -e FELDERA_AUTH_AUDIENCE=feldera-api \
+            -e FELDERA_OWNERS=owner@example.com \
+            -e RUST_LOG=info \
+            -e RUST_BACKTRACE=1 \
+            ${{ vars.FELDERA_IMAGE_NAME }}:sha-${{ github.sha }}
+
+      - name: Wait for container to become healthy (max 50s)
+        run: |
+          for i in {1..50}; do
+            status=$(docker inspect --format '{{json .State.Health}}' pipeline-manager-rbac | jq -r .Status 2>/dev/null || echo "starting")
+            echo "Health status: $status"
+            if [ "$status" == "healthy" ]; then
+              echo "pipeline-manager is healthy"
+              exit 0
+            elif [ "$status" == "unhealthy" ]; then
+              echo "pipeline-manager not healthy"
+              exit 1
+            fi
+            sleep 1
+          done
+          echo "Timed out waiting for pipeline-manager to become healthy"
+          exit 1
+
+      - name: RBAC + OIDC-trust assertion matrix
+        if: ${{ vars.CI_DRY_RUN != 'true' }}
+        run: uv run scripts/rbac_demo.py --manager http://localhost:8080 --oidc http://localhost:9876
+
+      - name: Logs & Cleanup
+        if: always()
+        run: |
+          docker logs pipeline-manager-rbac || true
+          docker rm -f pipeline-manager-rbac || true
+          if [ -n "$OIDC_PID" ]; then kill "$OIDC_PID" || true; fi
+          cat dummy-oidc.log || true
+
   oss-platform-tests:
     if: ${{ !contains(vars.CI_SKIP_JOBS, 'oss-platform-tests') }}
     name: Platform Integration Tests (OSS Docker Image)
diff --git a/crates/fda/src/cli.rs b/crates/fda/src/cli.rs
index b41546fc851..b590590d767 100644
--- a/crates/fda/src/cli.rs
+++ b/crates/fda/src/cli.rs
@@ -11,34 +11,39 @@ use feldera_rest_api::types::{
 /// Autocompletion for pipeline names by trying to fetch them from the server.
 fn pipeline_names(current: &std::ffi::OsStr) -> Vec<CompletionCandidate> {
     let mut completions = vec![];
-    // We parse FELDERA_HOST and FELDERA_API_KEY from the environment
-    // using the `try_parse_from` method.
-    let cli = Cli::try_parse_from(["fda", "pipelines"]);
-    if let Ok(cli) = cli {
-        let client = make_client(
-            cli.host,
-            cli.insecure,
-            cli.tls_cert,
-            cli.auth,
-            cli.auth_token_command,
-            cli.timeout,
-        )
-        .unwrap();
+    // Parse FELDERA_HOST / FELDERA_API_KEY from the environment.
+    let Ok(cli) = Cli::try_parse_from(["fda", "pipelines"]) else {
+        return completions;
+    };
+    // Never resolve `--auth-token-command` for completion: it would execute the
+    // user's token command (e.g. `gcloud auth print-access-token`) on every Tab
+    // press. Static API keys are cheap, so pass those through; token-command
+    // users simply get no pipeline-name completion (a failed/anonymous list
+    // returns nothing rather than panicking).
+    let Ok(client) = make_client(
+        cli.host,
+        cli.insecure,
+        cli.tls_cert,
+        cli.auth,
+        None,
+        cli.timeout,
+    ) else {
+        return completions;
+    };
 
-        let r = futures::executor::block_on(async {
-            client
-                .list_pipelines()
-                .send()
-                .await
-                .map(|r| r.into_inner())
-                .unwrap_or_else(|_| vec![])
-        });
+    let r = futures::executor::block_on(async {
+        client
+            .list_pipelines()
+            .send()
+            .await
+            .map(|r| r.into_inner())
+            .unwrap_or_default()
+    });
 
-        let current = current.to_string_lossy();
-        for pipeline in r {
-            if pipeline.name.starts_with(current.as_ref()) {
-                completions.push(CompletionCandidate::new(pipeline.name));
-            }
+    let current = current.to_string_lossy();
+    for pipeline in r {
+        if pipeline.name.starts_with(current.as_ref()) {
+            completions.push(CompletionCandidate::new(pipeline.name));
         }
     }
 
@@ -118,10 +123,12 @@ pub struct Cli {
     pub auth: Option<String>,
     /// Shell command that prints a bearer token on stdout.
     ///
-    /// Run before every request; the trimmed stdout becomes the
-    /// `Authorization: Bearer <token>` header. Use for OIDC workload-identity
-    /// flows with short-lived tokens — pair with `tsidp-token`,
-    /// `gcloud auth print-access-token`, etc. Conflicts with `--auth`.
+    /// Run once per `fda` invocation; the trimmed stdout becomes the
+    /// `Authorization: Bearer <token>` header for every request that
+    /// invocation makes. Use for OIDC workload-identity flows with short-lived
+    /// tokens — pair with `tsidp-token`, `gcloud auth print-access-token`, etc.
+    /// The kubelet-rotated token file works because each `fda` run re-reads it.
+    /// Conflicts with `--auth`.
     #[arg(
         long,
         env = "FELDERA_AUTH_TOKEN_COMMAND",
@@ -251,6 +258,11 @@ pub enum ApiKeyActions {
     Create {
         /// The name of the API key to create
         name: String,
+        /// Role the key carries: `read` or `write` (default). `admin` and
+        /// `owner` are never issuable as API keys. The role may not exceed the
+        /// caller's own role.
+        #[arg(long, default_value = "write")]
+        role: ApiKeyRole,
     },
     /// Delete an existing API key
     #[clap(aliases = &["del"])]
@@ -260,6 +272,13 @@ pub enum ApiKeyActions {
     },
 }
 
+/// The roles an API key may carry (`admin`/`owner` are never key-mintable).
+#[derive(Clone, Copy, Debug, ValueEnum)]
+pub enum ApiKeyRole {
+    Read,
+    Write,
+}
+
 #[derive(Subcommand)]
 pub enum OidcTrustActions {
     /// List configured OIDC trust relationships.
@@ -284,6 +303,13 @@ pub enum OidcTrustActions {
         /// Free-text description.
         #[arg(long)]
         description: Option<String>,
+        /// Role granted to a matching token: `read` (default), `write`,
+        /// `admin`, or `owner`. Capped at the caller's role; `owner` requires a
+        /// platform owner. Breadth rules the server enforces: a wildcard
+        /// `subject` always requires a concrete (non-wildcard) `audience`; and
+        /// above `read`, neither subject nor audience may contain a wildcard.
+        #[arg(long)]
+        role: Option<TrustRole>,
     },
     /// Delete an OIDC trust relationship.
     #[clap(aliases = &["del"])]
@@ -293,6 +319,15 @@ pub enum OidcTrustActions {
     },
 }
 
+/// The roles an OIDC trust relationship may grant.
+#[derive(Clone, Copy, Debug, ValueEnum)]
+pub enum TrustRole {
+    Read,
+    Write,
+    Admin,
+    Owner,
+}
+
 #[derive(Subcommand)]
 pub enum ClusterAction {
     /// Retrieves all cluster events (status only) and prints them.
diff --git a/crates/fda/src/main.rs b/crates/fda/src/main.rs
index 6285306faf0..90427e163a1 100644
--- a/crates/fda/src/main.rs
+++ b/crates/fda/src/main.rs
@@ -118,16 +118,18 @@ pub(crate) fn make_client(
         }
     }
 
-    let resolved_auth = match auth_token_command {
-        Some(cmd) => Some(run_auth_token_command(&cmd)?),
-        None => auth,
-    };
-
+    // Resolve the token only for https, where it is actually sent. Running the
+    // auth-token-command for an http host would spawn a subprocess whose output
+    // is then discarded.
     if host.starts_with("https://") {
+        let resolved_auth = match auth_token_command {
+            Some(cmd) => Some(run_auth_token_command(&cmd)?),
+            None => auth,
+        };
         client_builder = client_builder.default_headers(make_auth_headers(&resolved_auth)?);
-    } else if host.starts_with("http://") && resolved_auth.is_some() {
+    } else if host.starts_with("http://") && (auth.is_some() || auth_token_command.is_some()) {
         warn!(
-            "The provided API key is not added to the request because {host} does not use `https`."
+            "The provided credentials are not added to the request because {host} does not use `https`."
         );
     }
 
@@ -271,42 +273,47 @@ fn handle_errors_fatal(
                 error!("{}", UPGRADE_NOTICE);
             }
             Error::UnexpectedResponse(r) => {
-                if r.status() == StatusCode::UNAUTHORIZED {
-                    // The unauthorized error is often missing in the spec, and we can't currently have multiple
-                    // return types until https://github.com/oxidecomputer/progenitor/pull/857 lands.
-                    eprint!("{}: ", msg);
-                    eprintln!("Unauthorized. Check your API key for {server}.");
-                    if server.starts_with("http://") {
-                        eprintln!("Did you mean to use https?");
-                    }
-                } else {
-                    warn!(
-                        "Unexpected error response from {server} -- this can happen if you're running different fda and feldera versions."
-                    );
-                    warn!("{}", UPGRADE_NOTICE);
-                    debug!(
-                        "Received HTTP status `{}` which is not declared as an expected response in OpenAPI.",
-                        r.status()
-                    );
-                    std::io::stdout().flush().unwrap();
-                    std::io::stderr().flush().unwrap();
-
-                    eprint!("{}", msg);
-                    let h = Handle::current();
-                    // This spawns a separate thread because it's very hard to make this function async, I tried.
-                    let st = std::thread::spawn(move || match h.block_on(r.text()) {
-                        Ok(body) => {
-                            if let Ok(error) = serde_json::from_str::<ErrorResponse>(&body) {
-                                eprintln!(": {}", error.message);
-                            } else {
-                                eprintln!(": {body}");
-                            }
+                // Auth (401) and permission (403) failures are correct, expected
+                // responses that the OpenAPI spec does not declare (so progenitor
+                // surfaces them here rather than as `ErrorResponse`). Prefer the
+                // server's own `message` so a routine RBAC denial reads cleanly
+                // instead of the misleading "version mismatch / file a bug" notice.
+                let status = r.status();
+                let is_http = server.starts_with("http://");
+                std::io::stdout().flush().unwrap();
+                std::io::stderr().flush().unwrap();
+                let h = Handle::current();
+                // A separate thread because making this fn async is impractical here.
+                let body = std::thread::spawn(move || h.block_on(r.text()).ok())
+                    .join()
+                    .unwrap();
+                // Lenient parse: pull `message` out of any JSON body (the minimal
+                // auth error lacks the `details` field a strict `ErrorResponse` needs).
+                let server_msg = body.as_deref().and_then(|b| {
+                    serde_json::from_str::<serde_json::Value>(b)
+                        .ok()
+                        .and_then(|v| v.get("message").and_then(|m| m.as_str()).map(str::to_string))
+                });
+                match server_msg {
+                    Some(m) => {
+                        eprintln!("{msg}: {m}");
+                        if status == StatusCode::UNAUTHORIZED && is_http {
+                            eprintln!("Did you mean to use https?");
                         }
-                        _ => {
-                            eprintln!();
+                    }
+                    None => {
+                        warn!(
+                            "Unexpected error response from {server} -- this can happen if you're running different fda and feldera versions."
+                        );
+                        warn!("{}", UPGRADE_NOTICE);
+                        debug!(
+                            "Received HTTP status `{status}` which is not declared as an expected response in OpenAPI."
+                        );
+                        match body {
+                            Some(b) if !b.is_empty() => eprintln!("{msg}: {b}"),
+                            _ => eprintln!("{msg}"),
                         }
-                    });
-                    st.join().unwrap();
+                    }
                 }
             }
             Error::PreHookError(e) => {
@@ -326,11 +333,18 @@ fn handle_errors_fatal(
 
 async fn api_key_commands(format: OutputFormat, action: ApiKeyActions, client: Client) {
     match action {
-        ApiKeyActions::Create { name } => {
+        ApiKeyActions::Create { name, role } => {
             debug!("Creating API key: {}", name);
+            let role = match role {
+                ApiKeyRole::Read => feldera_rest_api::types::Role::Read,
+                ApiKeyRole::Write => feldera_rest_api::types::Role::Write,
+            };
             let response = client
                 .post_api_key()
-                .body(NewApiKeyRequest { name })
+                .body(NewApiKeyRequest {
+                    name,
+                    role: Some(role),
+                })
                 .send()
                 .await
                 .map_err(handle_errors_fatal(
@@ -386,9 +400,13 @@ async fn api_key_commands(format: OutputFormat, action: ApiKeyActions, client: C
             match format {
                 OutputFormat::Text => {
                     let mut rows = vec![];
-                    rows.push(["name".to_string(), "id".to_string()]);
+                    rows.push(["name".to_string(), "role".to_string(), "id".to_string()]);
                     for key in response.iter() {
-                        rows.push([key.name.to_string(), key.id.0.to_string()]);
+                        rows.push([
+                            key.name.to_string(),
+                            key.role.to_string(),
+                            key.id.0.to_string(),
+                        ]);
                     }
                     println!(
                         "{}",
@@ -419,14 +437,22 @@ async fn oidc_trust_commands(format: OutputFormat, action: OidcTrustActions, cli
             subject,
             audience,
             description,
+            role,
         } => {
             debug!("Creating OIDC trust relationship: {name}");
+            let role = role.map(|r| match r {
+                TrustRole::Read => feldera_rest_api::types::Role::Read,
+                TrustRole::Write => feldera_rest_api::types::Role::Write,
+                TrustRole::Admin => feldera_rest_api::types::Role::Admin,
+                TrustRole::Owner => feldera_rest_api::types::Role::Owner,
+            });
             let body = NewOidcTrustRequest::builder()
                 .name(name.clone())
                 .issuer(issuer)
                 .subject(subject)
                 .audience(audience)
-                .description(description);
+                .description(description)
+                .role(role);
             let response = client
                 .post_oidc_trust()
                 .body(body)
@@ -489,18 +515,20 @@ async fn oidc_trust_commands(format: OutputFormat, action: OidcTrustActions, cli
                 OutputFormat::Text => {
                     let mut rows = vec![[
                         "name".to_string(),
+                        "role".to_string(),
                         "issuer".to_string(),
                         "subject".to_string(),
                         "audience".to_string(),
-                        "id".to_string(),
+                        "description".to_string(),
                     ]];
                     for t in response.iter() {
                         rows.push([
                             t.name.clone(),
+                            t.role.to_string(),
                             t.issuer.clone(),
                             t.subject.clone(),
                             t.audience.clone().unwrap_or_default(),
-                            t.id.0.to_string(),
+                            t.description.clone().unwrap_or_default(),
                         ]);
                     }
                     println!(
@@ -3404,7 +3432,7 @@ fn init_logging(default_level: &str) {
 
 #[cfg(test)]
 mod tests {
-    use super::{format_program_errors, make_client};
+    use super::{format_program_errors, make_client, run_auth_token_command};
     use feldera_rest_api::types::{
         ProgramError, RustCompilationInfo, SqlCompilationInfo, SqlCompilerMessage,
     };
@@ -3502,6 +3530,26 @@ aC3Oy4iVrYGOq9v6uP9iblE=\n\
         }
     }
 
+    #[test]
+    fn auth_token_command_trims_stdout() {
+        let token = run_auth_token_command("printf '  tok-123\\n'").expect("command succeeds");
+        assert_eq!(token, "tok-123");
+    }
+
+    #[test]
+    fn auth_token_command_empty_output_is_error() {
+        let err = run_auth_token_command("true").expect_err("empty output must error");
+        assert!(err.to_string().contains("empty output"), "{err}");
+    }
+
+    #[test]
+    fn auth_token_command_nonzero_exit_is_error() {
+        let err = run_auth_token_command("echo boom >&2; exit 3").expect_err("failure must error");
+        let msg = err.to_string();
+        assert!(msg.contains("exited with"), "{msg}");
+        assert!(msg.contains("boom"), "stderr should be surfaced: {msg}");
+    }
+
     #[test]
     fn format_program_errors_empty() {
         let output = format_program_errors(&ProgramError {
diff --git a/crates/pipeline-manager/migrations/V34__oidc_trust.sql b/crates/pipeline-manager/migrations/V34__oidc_trust.sql
deleted file mode 100644
index 34a90329e0b..00000000000
--- a/crates/pipeline-manager/migrations/V34__oidc_trust.sql
+++ /dev/null
@@ -1,18 +0,0 @@
--- Trust relationships for OIDC workload identity federation.
--- A tenant registers an issuer + subject/audience match pattern; an incoming
--- JWT whose claims satisfy the pattern is authorized as that tenant with the
--- recorded scopes, exactly like an API key.
-CREATE TABLE IF NOT EXISTS oidc_trust_relationship (
-    id uuid PRIMARY KEY,
-    tenant_id uuid NOT NULL,
-    name varchar NOT NULL,
-    description varchar,
-    issuer varchar NOT NULL,
-    subject varchar NOT NULL,
-    audience varchar,
-    scopes text[] NOT NULL,
-    CONSTRAINT unique_oidc_trust_name UNIQUE (tenant_id, name),
-    FOREIGN KEY (tenant_id) REFERENCES tenant(id) ON DELETE CASCADE
-);
-
-CREATE INDEX IF NOT EXISTS idx_oidc_trust_issuer ON oidc_trust_relationship (issuer);
diff --git a/crates/pipeline-manager/migrations/V35__oidc_trust.sql b/crates/pipeline-manager/migrations/V35__oidc_trust.sql
new file mode 100644
index 00000000000..a74f28199b0
--- /dev/null
+++ b/crates/pipeline-manager/migrations/V35__oidc_trust.sql
@@ -0,0 +1,22 @@
+-- Trust relationships for OIDC workload identity federation.
+--
+-- A tenant registers an issuer plus subject/audience match patterns; an
+-- incoming JWT from that issuer whose claims satisfy the patterns is authorized
+-- to act as the tenant with the recorded role, like a signature-verified API
+-- key. `role` is the RBAC role granted (see V36); it is capped at the creator's
+-- role at write time and defaults to the least privilege.
+CREATE TABLE IF NOT EXISTS oidc_trust_relationship (
+    id uuid PRIMARY KEY,
+    tenant_id uuid NOT NULL,
+    name varchar NOT NULL,
+    description varchar,
+    issuer varchar NOT NULL,
+    subject varchar NOT NULL,
+    audience varchar,
+    role text NOT NULL DEFAULT 'read' CHECK (role IN ('read', 'write', 'admin', 'owner')),
+    CONSTRAINT unique_oidc_trust_name UNIQUE (tenant_id, name),
+    FOREIGN KEY (tenant_id) REFERENCES tenant(id) ON DELETE CASCADE
+);
+
+-- The auth hot path resolves a federated token by its issuer, so index it.
+CREATE INDEX IF NOT EXISTS idx_oidc_trust_issuer ON oidc_trust_relationship (issuer);
diff --git a/crates/pipeline-manager/migrations/V36__rbac.sql b/crates/pipeline-manager/migrations/V36__rbac.sql
new file mode 100644
index 00000000000..e2c79964676
--- /dev/null
+++ b/crates/pipeline-manager/migrations/V36__rbac.sql
@@ -0,0 +1,34 @@
+-- Role-based access control.
+--
+-- Adds the user concept and the per-(user, tenant) role link that the platform
+-- previously lacked (the only principal was the tenant). The released `api_key`
+-- table carried a `scopes text[]`; it is replaced with a single `role`.
+-- Roles: 'read' < 'write' < 'admin' (and 'owner', which is platform-wide and
+-- never stored in a membership; it is sourced from configuration or an owner
+-- OIDC trust). The `oidc_trust_relationship` table (V35) already defines `role`.
+
+CREATE TABLE IF NOT EXISTS app_user (
+    id       uuid PRIMARY KEY,
+    provider varchar NOT NULL,   -- OIDC issuer the subject was seen under
+    subject  varchar NOT NULL,   -- OIDC `sub`
+    email    varchar,            -- display only, may be null
+    CONSTRAINT unique_user_identity UNIQUE (provider, subject)
+);
+
+CREATE TABLE IF NOT EXISTS tenant_membership (
+    tenant_id uuid NOT NULL,
+    user_id   uuid NOT NULL,
+    role      text NOT NULL CHECK (role IN ('read', 'write', 'admin')),
+    PRIMARY KEY (tenant_id, user_id),
+    FOREIGN KEY (tenant_id) REFERENCES tenant(id)   ON DELETE CASCADE,
+    FOREIGN KEY (user_id)   REFERENCES app_user(id) ON DELETE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS idx_tenant_membership_user ON tenant_membership (user_id);
+
+-- Replace the released per-key `scopes text[]` with a single `role`.
+-- Existing keys were uniformly {read, write}; the backfill preserves their access.
+ALTER TABLE api_key ADD COLUMN role text NOT NULL DEFAULT 'read'
+    CHECK (role IN ('read', 'write'));
+UPDATE api_key SET role = CASE WHEN 'write' = ANY (scopes) THEN 'write' ELSE 'read' END;
+ALTER TABLE api_key DROP COLUMN scopes;
diff --git a/crates/pipeline-manager/src/api.rs b/crates/pipeline-manager/src/api.rs
index 6ad460d04b9..64eb20db190 100644
--- a/crates/pipeline-manager/src/api.rs
+++ b/crates/pipeline-manager/src/api.rs
@@ -21,5 +21,6 @@ pub mod endpoints;
 pub mod error;
 mod examples;
 pub mod main;
+pub mod rbac;
 pub mod support_data_collector;
 pub mod util;
diff --git a/crates/pipeline-manager/src/api/endpoints.rs b/crates/pipeline-manager/src/api/endpoints.rs
index f09b3d44054..9cf4c1e10ae 100644
--- a/crates/pipeline-manager/src/api/endpoints.rs
+++ b/crates/pipeline-manager/src/api/endpoints.rs
@@ -5,3 +5,4 @@ pub mod metrics;
 pub mod oidc_trust;
 pub mod pipeline_interaction;
 pub mod pipeline_management;
+pub mod tenant;
diff --git a/crates/pipeline-manager/src/api/endpoints/api_key.rs b/crates/pipeline-manager/src/api/endpoints/api_key.rs
index c322bdafd57..3e5d278e895 100644
--- a/crates/pipeline-manager/src/api/endpoints/api_key.rs
+++ b/crates/pipeline-manager/src/api/endpoints/api_key.rs
@@ -1,7 +1,10 @@
 // API to create and delete API keys
 use crate::api::main::ServerState;
 use crate::api::util::parse_url_parameter;
-use crate::db::types::api_key::{ApiKeyId, ApiPermission};
+use crate::auth::AuthenticatedPrincipal;
+use crate::db::error::DBError;
+use crate::db::types::api_key::ApiKeyId;
+use crate::db::types::role::{MintableKeyRole, Role};
 use crate::db::types::tenant::TenantId;
 use crate::error::ManagerError;
 use crate::{api::examples, db::storage::Storage};
@@ -23,6 +26,12 @@ pub(crate) struct NewApiKeyRequest {
     /// Key name.
     #[schema(example = "my-api-key")]
     name: String,
+
+    /// Role the key carries. Must be `read` or `write` and may not exceed the
+    /// caller's own role; `admin` and `owner` are never issuable as API keys.
+    /// Defaults to `read`.
+    #[serde(default)]
+    role: Option<Role>,
 }
 
 /// Response to a successful API key creation.
@@ -124,21 +133,28 @@ pub(crate) async fn get_api_key(
 pub(crate) async fn post_api_key(
     state: WebData<ServerState>,
     tenant_id: ReqData<TenantId>,
+    principal: ReqData<AuthenticatedPrincipal>,
     req: web::Json<NewApiKeyRequest>,
 ) -> Result<HttpResponse, ManagerError> {
+    // Mint cap: the key's role may not exceed the caller's role, and `admin`/
+    // `owner` are never issuable as a static key.
+    let requested = req.role.unwrap_or(Role::Read);
+    if requested > principal.role {
+        return Err(DBError::RoleExceedsCreator {
+            requested,
+            creator: principal.role,
+        }
+        .into());
+    }
+    let role = MintableKeyRole::from_role(requested).ok_or(DBError::OwnerNotMintableAsApiKey)?;
+
     let new_id = Uuid::now_v7();
     let generated_api_key = crate::auth::generate_api_key();
     let res = state
         .db
         .lock()
         .await
-        .store_api_key_hash(
-            *tenant_id,
-            new_id,
-            &req.name,
-            &generated_api_key,
-            vec![ApiPermission::Read, ApiPermission::Write],
-        )
+        .store_api_key_hash(*tenant_id, new_id, &req.name, &generated_api_key, role)
         .await
         .map(|_| {
             info!("Created API key {} (tenant: {})", &req.name, *tenant_id);
diff --git a/crates/pipeline-manager/src/api/endpoints/config.rs b/crates/pipeline-manager/src/api/endpoints/config.rs
index 470aa27d44f..693961bd48e 100644
--- a/crates/pipeline-manager/src/api/endpoints/config.rs
+++ b/crates/pipeline-manager/src/api/endpoints/config.rs
@@ -9,7 +9,9 @@ use serde::Serialize;
 use utoipa::ToSchema;
 
 use crate::api::main::ServerState;
+use crate::auth::AuthenticatedPrincipal;
 use crate::db::storage::Storage;
+use crate::db::types::role::Role;
 use crate::db::types::tenant::TenantId;
 use crate::error::ManagerError;
 use crate::license::{LicenseCheck, LicenseValidity};
@@ -224,20 +226,26 @@ pub(crate) struct SessionInfo {
     pub tenant_id: TenantId,
     /// Current user's tenant name
     pub tenant_name: String,
+    /// The caller's effective role in the acting tenant. The web console uses
+    /// this to gate the admin UI (no role claim lives in the JWT).
+    pub role: Role,
+    /// Whether the caller is a platform owner.
+    pub is_owner: bool,
 }
 
 impl SessionInfo {
-    pub(crate) async fn gather(state: &ServerState, tenant_id: TenantId) -> Self {
-        let db = state.db.lock().await;
-        let tenant_name = db
-            .get_tenant_name(tenant_id)
-            .await
-            .unwrap_or_else(|_| "unknown".to_string());
-
-        SessionInfo {
+    pub(crate) async fn gather(
+        state: &ServerState,
+        tenant_id: TenantId,
+        role: Role,
+    ) -> Result<Self, ManagerError> {
+        let tenant_name = state.db.lock().await.get_tenant_name(tenant_id).await?;
+        Ok(SessionInfo {
             tenant_id,
             tenant_name,
-        }
+            role,
+            is_owner: role == Role::Owner,
+        })
     }
 }
 
@@ -262,8 +270,9 @@ impl SessionInfo {
 pub(crate) async fn get_config_session(
     state: WebData<ServerState>,
     tenant_id: ReqData<TenantId>,
+    principal: ReqData<AuthenticatedPrincipal>,
 ) -> Result<HttpResponse, ManagerError> {
-    let session_info = SessionInfo::gather(&state, *tenant_id).await;
+    let session_info = SessionInfo::gather(&state, *tenant_id, principal.role).await?;
     Ok(HttpResponse::Ok().json(session_info))
 }
 
diff --git a/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs b/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
index 34a6388ec16..1a738ea3012 100644
--- a/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
+++ b/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
@@ -7,9 +7,11 @@
 // against patterns recorded on the trust relationship (`*` is a wildcard).
 use crate::api::main::ServerState;
 use crate::api::util::parse_url_parameter;
+use crate::auth::AuthenticatedPrincipal;
+use crate::db::error::DBError;
 use crate::db::storage::Storage;
-use crate::db::types::api_key::ApiPermission;
-use crate::db::types::oidc_trust::OidcTrustId;
+use crate::db::types::oidc_trust::{pattern_is_concrete, OidcTrustId};
+use crate::db::types::role::Role;
 use crate::db::types::tenant::TenantId;
 use crate::error::ManagerError;
 use actix_web::{
@@ -50,6 +52,12 @@ pub(crate) struct NewOidcTrustRequest {
     #[schema(example = "feldera")]
     #[serde(default)]
     pub audience: Option<String>,
+
+    /// Role granted to a token that satisfies this trust. Capped at the
+    /// caller's own role. `owner` may be set only by an owner. Defaults to
+    /// `read`.
+    #[serde(default)]
+    pub role: Option<Role>,
 }
 
 /// Response to a successful create.
@@ -126,10 +134,51 @@ pub(crate) async fn get_oidc_trust(
 pub(crate) async fn post_oidc_trust(
     state: WebData<ServerState>,
     tenant_id: ReqData<TenantId>,
+    principal: ReqData<AuthenticatedPrincipal>,
     body: web::Json<NewOidcTrustRequest>,
 ) -> Result<HttpResponse, ManagerError> {
     let new_id = Uuid::now_v7();
     let body = body.into_inner();
+
+    // Mint cap: the granted role may not exceed the caller's role. An owner
+    // trust may be created only by an owner.
+    let requested = body.role.unwrap_or(Role::Read);
+    if requested > principal.role {
+        return Err(DBError::RoleExceedsCreator {
+            requested,
+            creator: principal.role,
+        }
+        .into());
+    }
+
+    // Breadth policy. `claim_matches` treats `*` anywhere in a pattern as a glob
+    // over any character run, so an unbounded pattern can authorize a wide set
+    // of tokens. `pattern_is_concrete` (defined next to the matcher) is the
+    // shared notion of "no wildcard".
+    let subject_concrete = pattern_is_concrete(&body.subject);
+    let audience_concrete = body.audience.as_deref().map(pattern_is_concrete);
+
+    // A wildcard subject with no concrete audience matches every token the
+    // issuer emits, i.e. the whole issuer acts as this tenant. Require a
+    // concrete audience to bound such a trust, at any role.
+    if !subject_concrete && audience_concrete != Some(true) {
+        return Err(DBError::OidcTrustTooBroad {
+            reason: "a wildcard 'subject' requires a concrete (non-wildcard) 'audience'"
+                .to_string(),
+        }
+        .into());
+    }
+    // Above `read`, both subject and audience must be concrete: an elevated
+    // trust must name exactly one workload identity, not a pattern.
+    if requested > Role::Read && !(subject_concrete && audience_concrete == Some(true)) {
+        return Err(DBError::OidcTrustTooBroad {
+            reason:
+                "subject and audience must be concrete (no '*' wildcard) for a role above 'read'"
+                    .to_string(),
+        }
+        .into());
+    }
+
     state
         .db
         .lock()
@@ -142,7 +191,7 @@ pub(crate) async fn post_oidc_trust(
             &body.issuer,
             &body.subject,
             body.audience.as_deref(),
-            vec![ApiPermission::Read, ApiPermission::Write],
+            requested,
         )
         .await?;
     info!(
diff --git a/crates/pipeline-manager/src/api/endpoints/tenant.rs b/crates/pipeline-manager/src/api/endpoints/tenant.rs
new file mode 100644
index 00000000000..1bcf8cb4a43
--- /dev/null
+++ b/crates/pipeline-manager/src/api/endpoints/tenant.rs
@@ -0,0 +1,307 @@
+//! Tenant and user management endpoints.
+//!
+//! `admin` manages the members and roles of the acting tenant; `owner` manages
+//! tenants across the installation. An owner acts in a specific tenant by
+//! setting the `Feldera-Tenant` header, so the per-tenant user endpoints serve
+//! both an admin in its own tenant and an owner in any tenant.
+
+use crate::api::main::ServerState;
+use crate::api::util::parse_url_parameter;
+use crate::auth::AuthenticatedPrincipal;
+use crate::db::error::DBError;
+use crate::db::storage::Storage;
+use crate::db::types::role::Role;
+use crate::db::types::tenant::TenantId;
+use crate::db::types::user::UserId;
+use crate::error::ManagerError;
+use actix_web::{
+    delete, get,
+    http::header::{CacheControl, CacheDirective},
+    post, put,
+    web::{self, Data as WebData, ReqData},
+    HttpRequest, HttpResponse,
+};
+use serde::{Deserialize, Serialize};
+use tracing::info;
+use utoipa::ToSchema;
+use uuid::Uuid;
+
+/// Request to assign a role to a user within a tenant.
+#[derive(Debug, Deserialize, ToSchema)]
+pub(crate) struct SetMemberRoleRequest {
+    /// The role to assign. Must be `read`, `write`, or `admin`; capped at the
+    /// caller's own role. `owner` is never assignable here.
+    pub role: Role,
+}
+
+/// Request to pre-provision a tenant member by identity, before the user's
+/// first login.
+#[derive(Debug, Deserialize, ToSchema)]
+pub(crate) struct AddMemberRequest {
+    /// OIDC issuer the user authenticates through (matches the JWT `iss` claim).
+    #[schema(example = "https://accounts.google.com")]
+    pub provider: String,
+    /// OIDC subject (matches the JWT `sub` claim).
+    #[schema(example = "user@acme.com")]
+    pub subject: String,
+    /// Optional email for display in the member list.
+    #[serde(default)]
+    pub email: Option<String>,
+    /// Role to grant. Must be `read`, `write`, or `admin`; capped at the
+    /// caller's own role. `owner` is never assignable here.
+    pub role: Role,
+}
+
+/// Response to a successful member pre-provisioning.
+#[derive(Debug, Serialize, ToSchema)]
+pub(crate) struct AddMemberResponse {
+    pub user_id: UserId,
+}
+
+/// Reject a requested role an admin may not grant: `owner` is platform-wide and
+/// never a tenant membership, and no one may grant above their own role.
+fn check_grantable_role(requested: Role, caller: Role) -> Result<(), ManagerError> {
+    if requested == Role::Owner {
+        return Err(DBError::OwnerRoleNotAssignable.into());
+    }
+    if requested > caller {
+        return Err(DBError::RoleExceedsCreator {
+            requested,
+            creator: caller,
+        }
+        .into());
+    }
+    Ok(())
+}
+
+/// Request to create a tenant (owner-only).
+#[derive(Debug, Deserialize, ToSchema)]
+pub(crate) struct NewTenantRequest {
+    #[schema(example = "acme")]
+    pub name: String,
+    /// Identity provider the tenant is keyed under. Defaults to `manual` for
+    /// tenants created out of band by an owner.
+    #[serde(default)]
+    pub provider: Option<String>,
+}
+
+fn parse_user_id(req: &HttpRequest) -> Result<UserId, ManagerError> {
+    let raw = parse_url_parameter(req, "user_id")?;
+    let uuid = Uuid::parse_str(&raw).map_err(|_| {
+        ManagerError::from(DBError::UnknownUser {
+            user_id: raw.clone(),
+        })
+    })?;
+    Ok(UserId(uuid))
+}
+
+/// List tenant members
+///
+/// List the users that are members of the acting tenant and their roles.
+#[utoipa::path(
+    context_path = "/v0",
+    security(("JSON web token (JWT) or API key" = [])),
+    responses(
+        (status = OK, description = "Members retrieved", body = [TenantMember]),
+        (status = INTERNAL_SERVER_ERROR, body = ErrorResponse)
+    ),
+    tag = "Platform"
+)]
+#[get("/tenant/users")]
+pub(crate) async fn list_tenant_users(
+    state: WebData<ServerState>,
+    tenant_id: ReqData<TenantId>,
+) -> Result<HttpResponse, ManagerError> {
+    let members = state
+        .db
+        .lock()
+        .await
+        .list_tenant_members(*tenant_id)
+        .await?;
+    Ok(HttpResponse::Ok()
+        .insert_header(CacheControl(vec![CacheDirective::NoCache]))
+        .json(&members))
+}
+
+/// Assign a member role
+///
+/// Assign or change a user's role in the acting tenant. The role is capped at
+/// the caller's own role and may not be `owner`.
+#[utoipa::path(
+    context_path = "/v0",
+    security(("JSON web token (JWT) or API key" = [])),
+    params(("user_id" = String, Path, description = "User identifier")),
+    request_body = SetMemberRoleRequest,
+    responses(
+        (status = OK, description = "Role assigned"),
+        (status = FORBIDDEN, description = "Requested role exceeds caller's role or is owner", body = ErrorResponse),
+    ),
+    tag = "Platform"
+)]
+#[put("/tenant/users/{user_id}")]
+pub(crate) async fn put_tenant_user(
+    state: WebData<ServerState>,
+    tenant_id: ReqData<TenantId>,
+    principal: ReqData<AuthenticatedPrincipal>,
+    req: HttpRequest,
+    body: web::Json<SetMemberRoleRequest>,
+) -> Result<HttpResponse, ManagerError> {
+    let user_id = parse_user_id(&req)?;
+    let requested = body.role;
+    check_grantable_role(requested, principal.role)?;
+
+    state
+        .db
+        .lock()
+        .await
+        .upsert_member_role(*tenant_id, user_id, requested)
+        .await?;
+    info!(
+        "Set role {requested} for user {user_id} (tenant: {})",
+        *tenant_id
+    );
+    Ok(HttpResponse::Ok().finish())
+}
+
+/// Remove a tenant member
+///
+/// Remove a user from the acting tenant.
+#[utoipa::path(
+    context_path = "/v0",
+    security(("JSON web token (JWT) or API key" = [])),
+    params(("user_id" = String, Path, description = "User identifier")),
+    responses(
+        (status = OK, description = "Member removed"),
+        (status = NOT_FOUND, description = "User is not a member", body = ErrorResponse),
+    ),
+    tag = "Platform"
+)]
+#[delete("/tenant/users/{user_id}")]
+pub(crate) async fn delete_tenant_user(
+    state: WebData<ServerState>,
+    tenant_id: ReqData<TenantId>,
+    req: HttpRequest,
+) -> Result<HttpResponse, ManagerError> {
+    let user_id = parse_user_id(&req)?;
+    state
+        .db
+        .lock()
+        .await
+        .remove_member(*tenant_id, user_id)
+        .await?;
+    info!("Removed user {user_id} from tenant {}", *tenant_id);
+    Ok(HttpResponse::Ok().finish())
+}
+
+/// Pre-provision a tenant member
+///
+/// Add a member to the acting tenant by identity, before the user's first
+/// login. The grant is dormant until that identity authenticates into the
+/// tenant through the IdP. The role is capped at the caller's own role and may
+/// not be `owner`.
+#[utoipa::path(
+    context_path = "/v0",
+    security(("JSON web token (JWT) or API key" = [])),
+    request_body = AddMemberRequest,
+    responses(
+        (status = OK, description = "Member added", body = AddMemberResponse),
+        (status = FORBIDDEN, description = "Requested role exceeds caller's role or is owner", body = ErrorResponse),
+    ),
+    tag = "Platform"
+)]
+#[post("/tenant/users")]
+pub(crate) async fn add_tenant_user(
+    state: WebData<ServerState>,
+    tenant_id: ReqData<TenantId>,
+    principal: ReqData<AuthenticatedPrincipal>,
+    body: web::Json<AddMemberRequest>,
+) -> Result<HttpResponse, ManagerError> {
+    let body = body.into_inner();
+    check_grantable_role(body.role, principal.role)?;
+
+    let user_id = state
+        .db
+        .lock()
+        .await
+        .preprovision_member(
+            Uuid::now_v7(),
+            *tenant_id,
+            &body.provider,
+            &body.subject,
+            body.email.as_deref(),
+            body.role,
+        )
+        .await?;
+    info!(
+        "Pre-provisioned user {} ({}) with role {} in tenant {}",
+        body.subject, user_id, body.role, *tenant_id
+    );
+    Ok(HttpResponse::Ok()
+        .insert_header(CacheControl(vec![CacheDirective::NoCache]))
+        .json(&AddMemberResponse { user_id }))
+}
+
+/// Response to a successful tenant creation.
+#[derive(Debug, Serialize, ToSchema)]
+pub(crate) struct NewTenantResponse {
+    pub id: TenantId,
+    pub name: String,
+}
+
+/// List tenants
+///
+/// List all tenants in the installation. Owner-only platform view.
+#[utoipa::path(
+    context_path = "/v0",
+    security(("JSON web token (JWT) or API key" = [])),
+    responses(
+        (status = OK, description = "Tenants retrieved", body = [TenantInfo]),
+        (status = INTERNAL_SERVER_ERROR, body = ErrorResponse)
+    ),
+    tag = "Platform"
+)]
+#[get("/tenants")]
+pub(crate) async fn list_tenants(
+    state: WebData<ServerState>,
+) -> Result<HttpResponse, ManagerError> {
+    let tenants = state.db.lock().await.list_tenants().await?;
+    Ok(HttpResponse::Ok()
+        .insert_header(CacheControl(vec![CacheDirective::NoCache]))
+        .json(&tenants))
+}
+
+/// Create a tenant
+///
+/// Explicitly create a tenant (owner-only), rather than relying on first login.
+/// Fails with a conflict if a tenant with the same name and provider exists.
+#[utoipa::path(
+    context_path = "/v0",
+    security(("JSON web token (JWT) or API key" = [])),
+    request_body = NewTenantRequest,
+    responses(
+        (status = CREATED, description = "Tenant created", body = NewTenantResponse),
+        (status = CONFLICT, description = "A tenant with that name and provider already exists", body = ErrorResponse),
+    ),
+    tag = "Platform"
+)]
+#[post("/tenants")]
+pub(crate) async fn create_tenant(
+    state: WebData<ServerState>,
+    body: web::Json<NewTenantRequest>,
+) -> Result<HttpResponse, ManagerError> {
+    let body = body.into_inner();
+    let provider = body.provider.unwrap_or_else(|| "manual".to_string());
+    let id = state
+        .db
+        .lock()
+        .await
+        .create_tenant(Uuid::now_v7(), &body.name, &provider)
+        .await?;
+    info!("Created tenant '{}' ({id})", body.name);
+    Ok(HttpResponse::Created()
+        .insert_header(CacheControl(vec![CacheDirective::NoCache]))
+        .json(&NewTenantResponse {
+            id,
+            name: body.name,
+        }))
+}
diff --git a/crates/pipeline-manager/src/api/main.rs b/crates/pipeline-manager/src/api/main.rs
index b205795969b..f7c71329d35 100644
--- a/crates/pipeline-manager/src/api/main.rs
+++ b/crates/pipeline-manager/src/api/main.rs
@@ -261,7 +261,15 @@ It contains the following fields:
         // Cluster
         endpoints::cluster::list_cluster_events,
         endpoints::cluster::get_cluster_event,
-        endpoints::cluster::get_cluster_health
+        endpoints::cluster::get_cluster_health,
+
+        // Tenant and user management (RBAC)
+        endpoints::tenant::list_tenant_users,
+        endpoints::tenant::add_tenant_user,
+        endpoints::tenant::put_tenant_user,
+        endpoints::tenant::delete_tenant_user,
+        endpoints::tenant::list_tenants,
+        endpoints::tenant::create_tenant
     ),
     components(schemas(
         // Authentication
@@ -338,9 +346,19 @@ It contains the following fields:
         crate::db::types::program::ProgramInfo,
         crate::api::endpoints::pipeline_management::PartialProgramInfo,
 
+        // RBAC
+        crate::db::types::role::Role,
+        crate::db::types::user::UserId,
+        crate::db::types::user::TenantMember,
+        crate::db::types::user::TenantInfo,
+        crate::api::endpoints::tenant::SetMemberRoleRequest,
+        crate::api::endpoints::tenant::AddMemberRequest,
+        crate::api::endpoints::tenant::AddMemberResponse,
+        crate::api::endpoints::tenant::NewTenantRequest,
+        crate::api::endpoints::tenant::NewTenantResponse,
+
         // API key
         crate::db::types::api_key::ApiKeyId,
-        crate::db::types::api_key::ApiPermission,
         crate::db::types::api_key::ApiKeyDescr,
         crate::api::endpoints::api_key::NewApiKeyRequest,
         crate::api::endpoints::api_key::NewApiKeyResponse,
@@ -606,13 +624,16 @@ fn build_app(
     let app = match auth_configuration {
         Some(auth_configuration) => {
             let auth_middleware = HttpAuthentication::with_fn(crate::auth::auth_validator);
+            // Wrap order is inside-out (last wrap = outermost): cors, then the
+            // websocket subprotocol promotion (browsers can't set the
+            // `Authorization` header on a WebSocket handshake, so promote a
+            // token carried in a `feldera-bearer.*` subprotocol to that header
+            // first), then auth (installs the principal), then the RBAC check
+            // (reads it), then the handler.
             app.app_data(auth_configuration.clone()).service(
                 api_scope()
+                    .wrap(middleware::from_fn(crate::api::rbac::rbac_middleware))
                     .wrap(auth_middleware)
-                    // Runs ahead of `auth_middleware` (last wrap = outermost):
-                    // browsers can't set the `Authorization` header on a
-                    // WebSocket handshake, so promote a token carried in a
-                    // `feldera-bearer.*` subprotocol to that header first.
                     .wrap(middleware::from_fn(
                         crate::auth::promote_websocket_subprotocol_auth,
                     ))
@@ -621,6 +642,7 @@ fn build_app(
         }
         None => app.service(
             api_scope()
+                .wrap(middleware::from_fn(crate::api::rbac::rbac_middleware))
                 .wrap_fn(|req, srv| {
                     let req = crate::auth::tag_with_default_tenant_id(req);
                     srv.call(req)
@@ -743,6 +765,13 @@ fn api_scope() -> Scope {
         .service(endpoints::cluster::list_cluster_events)
         .service(endpoints::cluster::get_cluster_event)
         .service(endpoints::cluster::get_cluster_health)
+        // Tenant and user management (RBAC)
+        .service(endpoints::tenant::list_tenant_users)
+        .service(endpoints::tenant::add_tenant_user)
+        .service(endpoints::tenant::put_tenant_user)
+        .service(endpoints::tenant::delete_tenant_user)
+        .service(endpoints::tenant::list_tenants)
+        .service(endpoints::tenant::create_tenant)
 }
 
 struct SecurityAddon;
diff --git a/crates/pipeline-manager/src/api/rbac.rs b/crates/pipeline-manager/src/api/rbac.rs
new file mode 100644
index 00000000000..86eb76fb1e1
--- /dev/null
+++ b/crates/pipeline-manager/src/api/rbac.rs
@@ -0,0 +1,510 @@
+//! Role-based access-control enforcement.
+//!
+//! A single middleware over the authenticated `/v0` scope reads the
+//! [`AuthenticatedPrincipal`] that `auth_validator` installed and compares its
+//! role against the minimum role declared for the matched route. The
+//! [`ROUTE_MIN_ROLE`] table below is the single source of truth for the
+//! access-control model of RFC #6422. Enforcement is deny-by-default: a route
+//! that is reached but absent from the table is refused (fail closed), so a
+//! newly added endpoint cannot ship silently world-accessible. The
+//! `every_registered_v0_route_is_classified` test enforces that every route
+//! actually registered gets an entry.
+
+use crate::auth::AuthenticatedPrincipal;
+use crate::db::error::DBError;
+use crate::db::types::role::Role;
+use actix_web::body::{BoxBody, MessageBody};
+use actix_web::dev::{ServiceRequest, ServiceResponse};
+use actix_web::http::Method;
+use actix_web::middleware::Next;
+use actix_web::{HttpMessage, HttpResponse, ResponseError};
+use std::collections::HashMap;
+use std::sync::OnceLock;
+use tracing::{debug, error, info};
+
+/// Minimum role required to reach each `/v0` route. `None` means the route is
+/// reachable by any authenticated principal (no role floor). A `(method, path)`
+/// absent from this table is denied by the middleware.
+#[rustfmt::skip]
+static ROUTE_MIN_ROLE: &[(&str, &str, Option<Role>)] = &[
+    ("GET", "/v0/api_keys", Some(Role::Write)), // list_api_keys
+    ("POST", "/v0/api_keys", Some(Role::Write)), // post_api_key
+    ("DELETE", "/v0/api_keys/{api_key_name}", Some(Role::Write)), // delete_api_key
+    ("GET", "/v0/api_keys/{api_key_name}", Some(Role::Write)), // get_api_key
+    ("GET", "/v0/cluster/events", Some(Role::Read)), // list_cluster_events
+    ("GET", "/v0/cluster/events/{event_id}", Some(Role::Read)), // get_cluster_event
+    ("GET", "/v0/cluster_healthz", Some(Role::Read)), // get_cluster_health
+    ("GET", "/v0/config", Some(Role::Read)), // get_config
+    ("GET", "/v0/config/demos", Some(Role::Read)), // get_config_demos
+    ("GET", "/v0/config/session", Some(Role::Read)), // get_config_session
+    ("GET", "/v0/metrics", Some(Role::Read)), // get_metrics
+    ("GET", "/v0/oidc_trust", Some(Role::Admin)), // list_oidc_trust
+    ("POST", "/v0/oidc_trust", Some(Role::Admin)), // post_oidc_trust
+    ("DELETE", "/v0/oidc_trust/{name}", Some(Role::Admin)), // delete_oidc_trust
+    ("GET", "/v0/oidc_trust/{name}", Some(Role::Admin)), // get_oidc_trust
+    ("GET", "/v0/pipelines", Some(Role::Read)), // list_pipelines
+    ("POST", "/v0/pipelines", Some(Role::Write)), // post_pipeline
+    ("DELETE", "/v0/pipelines/{pipeline_name}", Some(Role::Write)), // delete_pipeline
+    ("GET", "/v0/pipelines/{pipeline_name}", Some(Role::Read)), // get_pipeline
+    ("PATCH", "/v0/pipelines/{pipeline_name}", Some(Role::Write)), // patch_pipeline
+    ("PUT", "/v0/pipelines/{pipeline_name}", Some(Role::Write)), // put_pipeline
+    ("POST", "/v0/pipelines/{pipeline_name}/activate", Some(Role::Write)), // post_pipeline_activate
+    ("POST", "/v0/pipelines/{pipeline_name}/approve", Some(Role::Write)), // post_pipeline_approve
+    ("POST", "/v0/pipelines/{pipeline_name}/checkpoint", Some(Role::Write)), // checkpoint_pipeline
+    ("POST", "/v0/pipelines/{pipeline_name}/checkpoint/sync", Some(Role::Write)), // sync_checkpoint
+    ("GET", "/v0/pipelines/{pipeline_name}/checkpoint/sync_status", Some(Role::Read)), // get_checkpoint_sync_status
+    ("GET", "/v0/pipelines/{pipeline_name}/checkpoint_status", Some(Role::Read)), // get_checkpoint_status
+    ("GET", "/v0/pipelines/{pipeline_name}/checkpoints", Some(Role::Read)), // get_checkpoints
+    ("GET", "/v0/pipelines/{pipeline_name}/checkpoints/remote", Some(Role::Read)), // get_remote_checkpoints
+    ("GET", "/v0/pipelines/{pipeline_name}/circuit_json_profile", Some(Role::Read)), // get_pipeline_circuit_json_profile
+    ("GET", "/v0/pipelines/{pipeline_name}/circuit_profile", Some(Role::Read)), // get_pipeline_circuit_profile
+    ("POST", "/v0/pipelines/{pipeline_name}/clear", Some(Role::Write)), // post_pipeline_clear
+    ("POST", "/v0/pipelines/{pipeline_name}/clock/advance", Some(Role::Write)), // clock_advance
+    ("POST", "/v0/pipelines/{pipeline_name}/commit_transaction", Some(Role::Write)), // commit_transaction
+    ("GET", "/v0/pipelines/{pipeline_name}/completion_status", Some(Role::Read)), // completion_status
+    ("GET", "/v0/pipelines/{pipeline_name}/dataflow_graph", Some(Role::Read)), // get_pipeline_dataflow_graph
+    ("POST", "/v0/pipelines/{pipeline_name}/diff", Some(Role::Read)), // post_pipeline_diff (compile-only, no data/state change)
+    ("POST", "/v0/pipelines/{pipeline_name}/dismiss_error", Some(Role::Write)), // post_pipeline_dismiss_error
+    ("POST", "/v0/pipelines/{pipeline_name}/egress/{table_name}", Some(Role::Write)), // http_output
+    ("GET", "/v0/pipelines/{pipeline_name}/events", Some(Role::Read)), // list_pipeline_events
+    ("GET", "/v0/pipelines/{pipeline_name}/events/{event_id}", Some(Role::Read)), // get_pipeline_event
+    ("GET", "/v0/pipelines/{pipeline_name}/heap_profile", Some(Role::Read)), // get_pipeline_heap_profile
+    ("POST", "/v0/pipelines/{pipeline_name}/ingress/{table_name}", Some(Role::Write)), // http_input
+    ("GET", "/v0/pipelines/{pipeline_name}/logs", Some(Role::Read)), // get_pipeline_logs
+    ("GET", "/v0/pipelines/{pipeline_name}/metrics", Some(Role::Read)), // get_pipeline_metrics
+    ("POST", "/v0/pipelines/{pipeline_name}/pause", Some(Role::Write)), // post_pipeline_pause
+    ("GET", "/v0/pipelines/{pipeline_name}/query", Some(Role::Write)), // pipeline_adhoc_sql
+    ("POST", "/v0/pipelines/{pipeline_name}/rebalance", Some(Role::Write)), // post_pipeline_rebalance
+    ("POST", "/v0/pipelines/{pipeline_name}/resume", Some(Role::Write)), // post_pipeline_resume
+    ("GET", "/v0/pipelines/{pipeline_name}/samply_profile", Some(Role::Read)), // get_pipeline_samply_profile
+    ("POST", "/v0/pipelines/{pipeline_name}/samply_profile", Some(Role::Read)), // start_samply_profile
+    ("POST", "/v0/pipelines/{pipeline_name}/start", Some(Role::Write)), // post_pipeline_start
+    ("POST", "/v0/pipelines/{pipeline_name}/start_compaction", Some(Role::Write)), // post_pipeline_start_compaction
+    ("POST", "/v0/pipelines/{pipeline_name}/start_transaction", Some(Role::Write)), // start_transaction
+    ("GET", "/v0/pipelines/{pipeline_name}/stats", Some(Role::Read)), // get_pipeline_stats
+    ("POST", "/v0/pipelines/{pipeline_name}/stop", Some(Role::Write)), // post_pipeline_stop
+    ("GET", "/v0/pipelines/{pipeline_name}/support_bundle", Some(Role::Read)), // get_pipeline_support_bundle
+    ("GET", "/v0/pipelines/{pipeline_name}/tables/{table_name}/connectors/{connector_name}/completion_token", Some(Role::Write)), // completion_token
+    ("GET", "/v0/pipelines/{pipeline_name}/tables/{table_name}/connectors/{connector_name}/stats", Some(Role::Read)), // get_pipeline_input_connector_status
+    ("POST", "/v0/pipelines/{pipeline_name}/tables/{table_name}/connectors/{connector_name}/{action}", Some(Role::Write)), // post_pipeline_input_connector_action
+    ("POST", "/v0/pipelines/{pipeline_name}/testing", Some(Role::Write)), // post_pipeline_testing
+    ("GET", "/v0/pipelines/{pipeline_name}/time_series", Some(Role::Read)), // get_pipeline_time_series
+    ("GET", "/v0/pipelines/{pipeline_name}/time_series_stream", Some(Role::Read)), // get_pipeline_time_series_stream
+    ("POST", "/v0/pipelines/{pipeline_name}/update_runtime", Some(Role::Write)), // post_update_runtime
+    ("POST", "/v0/validate_program", Some(Role::Read)), // post_validate_program (compile-only, no data/state change)
+    ("POST", "/v0/pipelines/{pipeline_name}/views/{view_name}/connectors/{connector_name}/command", Some(Role::Write)), // post_pipeline_output_connector_command
+    ("GET", "/v0/pipelines/{pipeline_name}/views/{view_name}/connectors/{connector_name}/stats", Some(Role::Read)), // get_pipeline_output_connector_status
+    // --- RBAC tenant/user management (new) ---
+    ("GET", "/v0/tenant/users", Some(Role::Admin)), // list_tenant_users
+    ("POST", "/v0/tenant/users", Some(Role::Admin)), // add_tenant_user (pre-provision)
+    ("PUT", "/v0/tenant/users/{user_id}", Some(Role::Admin)), // put_tenant_user
+    ("DELETE", "/v0/tenant/users/{user_id}", Some(Role::Admin)), // delete_tenant_user
+    ("GET", "/v0/tenants", Some(Role::Owner)), // list_tenants
+    ("POST", "/v0/tenants", Some(Role::Owner)), // create_tenant
+];
+
+/// Build the lookup map once (the table is static and small).
+fn route_table() -> &'static HashMap<(&'static str, &'static str), Option<Role>> {
+    static TABLE: OnceLock<HashMap<(&'static str, &'static str), Option<Role>>> = OnceLock::new();
+    TABLE.get_or_init(|| {
+        ROUTE_MIN_ROLE
+            .iter()
+            .map(|(m, p, r)| ((*m, *p), *r))
+            .collect()
+    })
+}
+
+/// Look up the access rule for a matched route.
+/// `None` => route unknown (deny). `Some(None)` => any authenticated principal.
+/// `Some(Some(role))` => requires at least `role`.
+fn lookup(method: &str, pattern: &str) -> Option<Option<Role>> {
+    route_table().get(&(method, pattern)).copied()
+}
+
+/// Build the 403 body in the same shape as the rest of the API.
+fn forbidden(message: &str) -> HttpResponse<BoxBody> {
+    HttpResponse::Forbidden().json(serde_json::json!({
+        "message": message,
+        "error_code": "InsufficientPermissions",
+    }))
+}
+
+/// Decide whether the principal may proceed. `Ok(())` allows; `Err(resp)` is the
+/// 403 to return.
+fn authorize(
+    method: &str,
+    pattern: Option<&str>,
+    principal: Option<&AuthenticatedPrincipal>,
+) -> Result<(), HttpResponse<BoxBody>> {
+    // No matched route: let actix produce its normal 404. RBAC only guards
+    // routes that exist.
+    let Some(pattern) = pattern else {
+        return Ok(());
+    };
+    match lookup(method, pattern) {
+        None => {
+            // Registered route with no classification: fail closed.
+            error!("RBAC: route {method} {pattern} has no access-control entry; denying");
+            Err(forbidden(
+                "This endpoint has no access-control classification and is denied",
+            ))
+        }
+        Some(None) => Ok(()),
+        Some(Some(required)) => match principal {
+            Some(p) if p.role.satisfies(required) => Ok(()),
+            Some(p) => Err(DBError::InsufficientPermissions {
+                required,
+                actual: p.role,
+            }
+            .error_response()),
+            None => {
+                error!("RBAC: no authenticated principal for {method} {pattern}; denying");
+                Err(forbidden("No authenticated principal"))
+            }
+        },
+    }
+}
+
+/// Emit an audit line for an authorized request. Mutations and any owner action
+/// are logged at info; reads at debug, to keep the happy path quiet.
+fn audit(method: &Method, pattern: &str, principal: Option<&AuthenticatedPrincipal>) {
+    let Some(p) = principal else { return };
+    // Make an owner acting outside its home tenant explicit in the log.
+    let tenant = if p.home_tenant != p.acting_tenant {
+        format!("{} (home={})", p.acting_tenant, p.home_tenant)
+    } else {
+        p.acting_tenant.to_string()
+    };
+    let is_owner = p.role == Role::Owner;
+    if method != Method::GET || is_owner {
+        info!(
+            "audit: user='{}' tenant={} role={} {} {}",
+            p.label, tenant, p.role, method, pattern
+        );
+    } else {
+        debug!(
+            "audit: user='{}' tenant={} role={} {} {}",
+            p.label, tenant, p.role, method, pattern
+        );
+    }
+}
+
+/// RBAC enforcement middleware for the authenticated `/v0` scope. Runs after
+/// `auth_validator` has installed the principal.
+pub(crate) async fn rbac_middleware(
+    req: ServiceRequest,
+    next: Next<impl MessageBody + 'static>,
+) -> Result<ServiceResponse<BoxBody>, actix_web::Error> {
+    let principal = req.extensions().get::<AuthenticatedPrincipal>().cloned();
+    let method = req.method().clone();
+    let pattern = req.match_pattern();
+
+    match authorize(method.as_str(), pattern.as_deref(), principal.as_ref()) {
+        Ok(()) => {
+            if let Some(pattern) = pattern.as_deref() {
+                audit(&method, pattern, principal.as_ref());
+            }
+            Ok(next.call(req).await?.map_into_boxed_body())
+        }
+        Err(resp) => Ok(req.into_response(resp)),
+    }
+}
+
+#[cfg(test)]
+mod test {
+    use super::*;
+
+    #[test]
+    fn table_has_no_duplicate_entries() {
+        let mut seen = std::collections::HashSet::new();
+        for (m, p, _) in ROUTE_MIN_ROLE {
+            assert!(seen.insert((*m, *p)), "duplicate route entry: {m} {p}");
+        }
+    }
+
+    #[test]
+    fn unknown_route_is_denied() {
+        let p = AuthenticatedPrincipal::for_test(Role::Owner);
+        assert!(authorize("GET", Some("/v0/does/not/exist"), Some(&p)).is_err());
+    }
+
+    #[test]
+    fn role_floor_is_enforced() {
+        let reader = AuthenticatedPrincipal::for_test(Role::Read);
+        let writer = AuthenticatedPrincipal::for_test(Role::Write);
+        // A write route rejects a reader and admits a writer.
+        assert!(authorize("POST", Some("/v0/pipelines"), Some(&reader)).is_err());
+        assert!(authorize("POST", Some("/v0/pipelines"), Some(&writer)).is_ok());
+        // A read route admits a reader.
+        assert!(authorize("GET", Some("/v0/pipelines"), Some(&reader)).is_ok());
+        // An owner-only route rejects an admin.
+        let admin = AuthenticatedPrincipal::for_test(Role::Admin);
+        assert!(authorize("GET", Some("/v0/tenants"), Some(&admin)).is_err());
+    }
+
+    /// Systematic matrix: for every classified route and every role, a request
+    /// is admitted iff the role meets the route's minimum, and refused
+    /// otherwise. This is the exhaustive "only the correct role can access each
+    /// endpoint" check. Reverting any `Role::*` in the table, or breaking the
+    /// `>=` comparison, makes this fail.
+    #[test]
+    fn every_route_admits_exactly_its_minimum_role() {
+        let all_roles = [Role::Read, Role::Write, Role::Admin, Role::Owner];
+        for (method, pattern, min) in ROUTE_MIN_ROLE {
+            for role in all_roles {
+                let principal = AuthenticatedPrincipal::for_test(role);
+                let allowed = authorize(method, Some(pattern), Some(&principal)).is_ok();
+                let expected = match min {
+                    None => true, // any authenticated principal
+                    Some(required) => role >= *required,
+                };
+                assert_eq!(
+                    allowed, expected,
+                    "{method} {pattern}: role {role} allowed={allowed}, expected={expected} (min={min:?})"
+                );
+            }
+            // A request with no principal at all is always refused on a
+            // classified route (fail closed).
+            assert!(
+                authorize(method, Some(pattern), None).is_err(),
+                "{method} {pattern}: missing principal must be denied"
+            );
+        }
+    }
+
+    /// Independent pin of the most security-sensitive classifications, so an
+    /// accidental downgrade in the table is caught here regardless of the
+    /// self-consistent matrix test above. Revert any of these table entries and
+    /// this fails.
+    #[test]
+    fn security_critical_routes_have_expected_minimums() {
+        let expect = |method, pattern, role| {
+            assert_eq!(lookup(method, pattern), Some(role), "{method} {pattern}");
+        };
+        // Data plane and mutations require write; read must never reach them.
+        expect("POST", "/v0/pipelines", Some(Role::Write));
+        expect("DELETE", "/v0/pipelines/{pipeline_name}", Some(Role::Write));
+        expect(
+            "POST",
+            "/v0/pipelines/{pipeline_name}/start",
+            Some(Role::Write),
+        );
+        expect(
+            "POST",
+            "/v0/pipelines/{pipeline_name}/stop",
+            Some(Role::Write),
+        );
+        expect(
+            "POST",
+            "/v0/pipelines/{pipeline_name}/clear",
+            Some(Role::Write),
+        );
+        expect(
+            "POST",
+            "/v0/pipelines/{pipeline_name}/ingress/{table_name}",
+            Some(Role::Write),
+        );
+        expect(
+            "POST",
+            "/v0/pipelines/{pipeline_name}/egress/{table_name}",
+            Some(Role::Write),
+        );
+        expect(
+            "GET",
+            "/v0/pipelines/{pipeline_name}/query",
+            Some(Role::Write),
+        );
+        expect(
+            "POST",
+            "/v0/pipelines/{pipeline_name}/start_transaction",
+            Some(Role::Write),
+        );
+        // Monitoring is read.
+        expect("GET", "/v0/pipelines", Some(Role::Read));
+        expect(
+            "GET",
+            "/v0/pipelines/{pipeline_name}/stats",
+            Some(Role::Read),
+        );
+        expect(
+            "GET",
+            "/v0/pipelines/{pipeline_name}/logs",
+            Some(Role::Read),
+        );
+        // Identity administration is admin.
+        expect("POST", "/v0/oidc_trust", Some(Role::Admin));
+        expect("GET", "/v0/tenant/users", Some(Role::Admin));
+        // Platform administration is owner.
+        expect("GET", "/v0/tenants", Some(Role::Owner));
+        expect("POST", "/v0/tenants", Some(Role::Owner));
+    }
+
+    /// End-to-end through a real actix pipeline: the middleware short-circuits
+    /// with 403 below the minimum role and passes through at or above it. This
+    /// exercises `match_pattern`, the response/body unification, and the wrap
+    /// ordering that the unit tests above cannot. Reverting the `.wrap(rbac)` in
+    /// `build_app` would make the deny cases return 200 here.
+    #[actix_web::test]
+    async fn middleware_enforces_in_a_real_pipeline() {
+        use actix_web::middleware::from_fn;
+        use actix_web::{test, web, App, HttpResponse};
+        use std::str::FromStr;
+
+        // Installs a principal whose role comes from the `x-test-role` header,
+        // standing in for `auth_validator`.
+        async fn install_principal(
+            req: ServiceRequest,
+            next: Next<impl MessageBody + 'static>,
+        ) -> Result<ServiceResponse<BoxBody>, actix_web::Error> {
+            if let Some(role) = req
+                .headers()
+                .get("x-test-role")
+                .and_then(|h| h.to_str().ok())
+                .and_then(|s| Role::from_str(s).ok())
+            {
+                req.extensions_mut()
+                    .insert(AuthenticatedPrincipal::for_test(role));
+            }
+            Ok(next.call(req).await?.map_into_boxed_body())
+        }
+
+        let app = test::init_service(
+            App::new().service(
+                web::scope("/v0")
+                    .wrap(from_fn(rbac_middleware))
+                    .wrap(from_fn(install_principal))
+                    .route(
+                        "/pipelines",
+                        web::get().to(|| async { HttpResponse::Ok().finish() }),
+                    )
+                    .route(
+                        "/pipelines",
+                        web::post().to(|| async { HttpResponse::Ok().finish() }),
+                    )
+                    .route(
+                        "/tenants",
+                        web::get().to(|| async { HttpResponse::Ok().finish() }),
+                    ),
+            ),
+        )
+        .await;
+
+        let call = |method: &str, path: &str, role: &str| {
+            let req = match method {
+                "POST" => test::TestRequest::post(),
+                _ => test::TestRequest::get(),
+            }
+            .uri(path)
+            .insert_header(("x-test-role", role))
+            .to_request();
+            test::call_service(&app, req)
+        };
+
+        // read may GET pipelines but not POST; write may POST.
+        assert_eq!(call("GET", "/v0/pipelines", "read").await.status(), 200);
+        assert_eq!(call("POST", "/v0/pipelines", "read").await.status(), 403);
+        assert_eq!(call("POST", "/v0/pipelines", "write").await.status(), 200);
+        // owner-only tenant list: admin refused, owner admitted.
+        assert_eq!(call("GET", "/v0/tenants", "admin").await.status(), 403);
+        assert_eq!(call("GET", "/v0/tenants", "owner").await.status(), 200);
+    }
+
+    /// The authenticated `/v0` surface, enumerated from the generated OpenAPI
+    /// document (the single source of truth for what `api_scope()` registers).
+    /// Paths outside `/v0` are unauthenticated (public scope) and not gated.
+    fn openapi_v0_routes() -> Vec<(String, String)> {
+        use crate::api::main::ApiDoc;
+        use utoipa::openapi::PathItemType;
+        use utoipa::OpenApi;
+
+        let method = |t: &PathItemType| match t {
+            PathItemType::Get => "GET",
+            PathItemType::Post => "POST",
+            PathItemType::Put => "PUT",
+            PathItemType::Delete => "DELETE",
+            PathItemType::Patch => "PATCH",
+            PathItemType::Head => "HEAD",
+            PathItemType::Options => "OPTIONS",
+            PathItemType::Trace => "TRACE",
+            PathItemType::Connect => "CONNECT",
+        };
+        ApiDoc::openapi()
+            .paths
+            .paths
+            .into_iter()
+            .filter(|(path, _)| path.starts_with("/v0"))
+            .flat_map(|(path, item)| {
+                item.operations
+                    .keys()
+                    .map(|t| (method(t).to_string(), path.clone()))
+                    .collect::<Vec<_>>()
+            })
+            .collect()
+    }
+
+    /// Routes registered in `api_scope()` but absent from the OpenAPI document
+    /// (`ApiDoc::paths()`), so the OpenAPI-driven meta-tests must account for
+    /// them explicitly. Both are still classified in `ROUTE_MIN_ROLE`, so RBAC
+    /// covers them; they are only invisible to the OpenAPI enumeration:
+    /// - `.../testing`: a test-only hook intentionally hidden from the spec.
+    /// - `.../command`: declares a non-standard `text/json` content type the
+    ///   client generator rejects, so it is left out of the spec for now.
+    const REGISTERED_BUT_UNDOCUMENTED: &[(&str, &str)] = &[
+        ("POST", "/v0/pipelines/{pipeline_name}/testing"),
+        (
+            "POST",
+            "/v0/pipelines/{pipeline_name}/views/{view_name}/connectors/{connector_name}/command",
+        ),
+    ];
+
+    /// Deny-by-default has teeth only if every registered route is classified.
+    /// Enumerate the `/v0` surface from the OpenAPI document (which mirrors
+    /// `api_scope()`, save the explicit `REGISTERED_BUT_UNDOCUMENTED` set) and
+    /// fail the build if any route lacks a `ROUTE_MIN_ROLE` entry. A new endpoint
+    /// added without a classification breaks this test rather than silently
+    /// shipping 403 (which is how the `diff`/`validate_program`/
+    /// `checkpoints/remote` routes slipped through a hand-maintained count).
+    /// Enforces RFC I6.
+    #[test]
+    fn every_registered_v0_route_is_classified() {
+        let table: std::collections::HashSet<(&str, &str)> =
+            ROUTE_MIN_ROLE.iter().map(|(m, p, _)| (*m, *p)).collect();
+        let mut unclassified = vec![];
+        for (method, path) in openapi_v0_routes() {
+            if !table.contains(&(method.as_str(), path.as_str())) {
+                unclassified.push(format!("{method} {path}"));
+            }
+        }
+        unclassified.sort();
+        assert!(
+            unclassified.is_empty(),
+            "these registered /v0 routes have no ROUTE_MIN_ROLE entry (add one, or they 403 for everyone):\n  {}",
+            unclassified.join("\n  ")
+        );
+    }
+
+    /// The reverse guard: every table entry must name a real registered route,
+    /// so a stale entry (renamed/removed endpoint) is caught instead of lingering.
+    #[test]
+    fn no_stale_route_table_entries() {
+        let mut registered: std::collections::HashSet<(String, String)> =
+            openapi_v0_routes().into_iter().collect();
+        registered.extend(
+            REGISTERED_BUT_UNDOCUMENTED
+                .iter()
+                .map(|(m, p)| (m.to_string(), p.to_string())),
+        );
+        let mut stale = vec![];
+        for (method, path, _) in ROUTE_MIN_ROLE {
+            if !registered.contains(&(method.to_string(), path.to_string())) {
+                stale.push(format!("{method} {path}"));
+            }
+        }
+        stale.sort();
+        assert!(
+            stale.is_empty(),
+            "these ROUTE_MIN_ROLE entries do not match any registered /v0 route (remove or fix them):\n  {}",
+            stale.join("\n  ")
+        );
+    }
+}
diff --git a/crates/pipeline-manager/src/auth.rs b/crates/pipeline-manager/src/auth.rs
index c69c9b528d7..816ba3a6a12 100644
--- a/crates/pipeline-manager/src/auth.rs
+++ b/crates/pipeline-manager/src/auth.rs
@@ -33,9 +33,11 @@
 //! OpenAPI spec (or look at the endpoints in `api/api_keys`).
 //! These API keys can then be used in the REST API similar to how JWT tokens
 //! are used above, but with the bearer token being "apikey:1234..." to
-//! authorize access. For now, we simply have two permission types: Read and
-//! Write. Later, we will expand to have fine-grained access to specific API
-//! resources.
+//! authorize access. Every principal (login JWT, API key, or OIDC trust)
+//! resolves to a single RBAC [`Role`] (`read < write < admin < owner`); the
+//! RBAC middleware (`crate::api::rbac`) enforces the minimum role per route.
+//! API keys carry only `read` or `write`; `admin` and `owner` come solely from
+//! signature-verified principals.
 //!
 //! API keys are randomly generated 128 character sequences that are never
 //! stored in the pipeline manager or in the database. It is the responsibility
@@ -44,6 +46,7 @@
 //! pipeline manager side, we store a hash of the API key in the database along
 //! with the permissions.
 
+use std::time::Duration;
 use std::{collections::HashMap, env};
 
 use actix_web::body::MessageBody;
@@ -78,15 +81,80 @@ use crate::config::ApiServerConfig;
 use crate::db::error::DBError;
 use crate::db::storage::Storage;
 use crate::db::storage_postgres::StoragePostgres;
-use crate::db::types::api_key::ApiPermission;
+use crate::db::types::role::Role;
 use crate::db::types::tenant::TenantId;
 
-// Used when no auth is configured, so we tag the request with the default user
-// and passthrough
+/// The authenticated principal behind a request, resolved by `auth_validator`
+/// and stored in request extensions. The RBAC middleware reads `role`; handlers
+/// read the acting tenant (also stored as a bare `TenantId` for compatibility
+/// with existing `ReqData<TenantId>` extractors).
+#[derive(Clone, Debug)]
+pub(crate) struct AuthenticatedPrincipal {
+    /// The tenant the request operates in. Equals `home_tenant` for everyone
+    /// but an `owner` selecting another tenant via `Feldera-Tenant`.
+    pub acting_tenant: TenantId,
+    /// The tenant the principal belongs to. Differs from `acting_tenant` only
+    /// for an `owner` selecting another tenant; the audit log flags that case.
+    pub home_tenant: TenantId,
+    /// The principal's effective role in the acting tenant.
+    pub role: Role,
+    /// Human-readable identity for audit logging (email, sub, or "apikey:<name>").
+    pub label: String,
+}
+
+impl AuthenticatedPrincipal {
+    /// Insert the principal and the acting tenant into request extensions.
+    fn install(self, req: &ServiceRequest) {
+        req.extensions_mut().insert(self.acting_tenant);
+        req.extensions_mut().insert(self);
+    }
+
+    #[cfg(test)]
+    pub(crate) fn for_test(role: Role) -> Self {
+        Self {
+            acting_tenant: DEFAULT_TENANT_ID,
+            home_tenant: DEFAULT_TENANT_ID,
+            role,
+            label: "test".to_string(),
+        }
+    }
+}
+
+/// Returns true if the given OIDC identity is configured as a platform owner.
+/// Matches an `owners` entry against the email, the bare subject, or the
+/// provider-qualified `"<issuer> <subject>"` form. Callers must pass `email`
+/// only when the provider verified it (`email_verified == true`), so an
+/// unverified, user-settable email cannot confer `owner`.
+fn is_configured_owner(
+    owners: &[String],
+    provider: &str,
+    subject: &str,
+    email: Option<&str>,
+) -> bool {
+    if owners.is_empty() {
+        return false;
+    }
+    let qualified = format!("{provider} {subject}");
+    owners
+        .iter()
+        .map(|o| o.trim())
+        // Skip empty entries: a trailing/double comma in FELDERA_OWNERS yields
+        // "", which must not match a token with an empty/absent email or subject.
+        .filter(|o| !o.is_empty())
+        .any(|o| o == qualified || o == subject || email.map(|e| e == o).unwrap_or(false))
+}
+
+// Used when no auth is configured, so we tag the request with the default
+// principal and passthrough. A single local node has one tenant, so the dev
+// principal is `admin` of it; cross-tenant `owner` is meaningless here.
 pub(crate) fn tag_with_default_tenant_id(req: ServiceRequest) -> ServiceRequest {
-    req.extensions_mut().insert(DEFAULT_TENANT_ID);
-    req.extensions_mut()
-        .insert(vec![ApiPermission::Read, ApiPermission::Write]);
+    AuthenticatedPrincipal {
+        acting_tenant: DEFAULT_TENANT_ID,
+        home_tenant: DEFAULT_TENANT_ID,
+        role: Role::Admin,
+        label: "default".to_string(),
+    }
+    .install(&req);
     req
 }
 
@@ -161,6 +229,7 @@ fn create_authz_json_error(message: &str) -> actix_web::Error {
 ///   1. The configured OIDC login provider (existing browser-driven flow).
 ///   2. A foreign issuer authorized by an OIDC trust relationship — the
 ///      workload-identity-federation path.
+///
 /// We dispatch on the `iss` claim, peeked unverified, then sign-verify in
 /// the corresponding handler.
 pub(crate) async fn auth_validator(
@@ -248,21 +317,39 @@ async fn oidc_trust_auth(
     };
 
     let state = req.app_data::<Data<ServerState>>().unwrap().clone();
-    let jwk = {
-        let mut cache = state.issuer_jwk_cache.lock().await;
-        match cache.get(&iss, &kid).await {
-            Ok(k) => k,
-            Err(e) => {
-                error!("Federated JWKS fetch for issuer '{iss}' failed: {e}");
-                return unauthorized(format!("JWKS lookup failed: {e}"), req);
-            }
+
+    // SSRF/DoS gate: only fetch discovery/JWKS for an issuer that at least one
+    // trust relationship names. An unregistered issuer is rejected here, before
+    // any outbound request, so an unauthenticated caller cannot make the manager
+    // fetch an arbitrary URL or amplify one request into repeated fetches.
+    match state.db.lock().await.is_trusted_issuer(&iss).await {
+        Ok(true) => {}
+        Ok(false) => {
+            debug!("Federated token from unregistered issuer '{iss}' rejected before any fetch");
+            return unauthorized(
+                "No OIDC trust relationship matches this token".to_string(),
+                req,
+            );
+        }
+        Err(e) => {
+            error!("Trusted-issuer check failed for '{iss}': {e}");
+            return unauthorized(format!("Database error: {e}"), req);
+        }
+    }
+
+    let jwk = match resolve_issuer_jwk(&state, &iss, &kid).await {
+        Ok(k) => k,
+        Err(e) => {
+            error!("Federated JWKS fetch for issuer '{iss}' failed: {e}");
+            return unauthorized(format!("JWKS lookup failed: {e}"), req);
         }
     };
 
-    // Verify signature + exp. Issuer/audience are checked against the trust
-    // relationship below, not by the JWT validator itself.
+    // Verify signature + exp + nbf. Issuer/audience are checked against the
+    // trust relationship below, not by the JWT validator itself.
     let mut validation = Validation::new(Algorithm::RS256);
     validation.validate_exp = true;
+    validation.validate_nbf = true;
     validation.validate_aud = false;
     validation.set_required_spec_claims(&["exp"]);
     let token_data = match decode::<OidcClaim>(token, &jwk, &validation) {
@@ -283,9 +370,30 @@ async fn oidc_trust_auth(
             .await
     };
     match lookup {
-        Ok(Some((tenant_id, scopes))) => {
-            req.extensions_mut().insert(tenant_id);
-            req.extensions_mut().insert(scopes);
+        Ok(Some((home_tenant, role))) => {
+            let label = format!("oidc:{}", token_data.claims.sub);
+            // An owner trust acts cross-tenant: the target tenant comes from the
+            // Feldera-Tenant header (strict lookup), defaulting to the trust's
+            // home tenant when no header is present.
+            let acting_tenant = if role == Role::Owner {
+                let acting = {
+                    let db = state.db.lock().await;
+                    resolve_owner_acting_tenant(&db, req.headers(), home_tenant).await
+                };
+                match acting {
+                    Ok(t) => t,
+                    Err(e) => return Err((e, req)),
+                }
+            } else {
+                home_tenant
+            };
+            AuthenticatedPrincipal {
+                acting_tenant,
+                home_tenant,
+                role,
+                label,
+            }
+            .install(&req);
             Ok(req)
         }
         Ok(None) => {
@@ -309,6 +417,26 @@ async fn oidc_trust_auth(
     }
 }
 
+/// Resolve the tenant an `owner` acts in. The `Feldera-Tenant` header selects
+/// any existing tenant by UUID or name (strict lookup, never created); a miss is
+/// a 404, so a typo cannot silently create or cross into the wrong tenant.
+/// Without the header the owner acts in its home tenant. This widening is gated
+/// on `role == Owner` by the callers; lower roles never reach here.
+async fn resolve_owner_acting_tenant(
+    db: &StoragePostgres,
+    headers: &actix_web::http::header::HeaderMap,
+    home: TenantId,
+) -> Result<TenantId, actix_web::Error> {
+    match headers.get(TENANT_HEADER).and_then(|h| h.to_str().ok()) {
+        Some(selector) if !selector.is_empty() => db
+            .resolve_tenant_selector(selector)
+            .await
+            // DBError::UnknownTenantName maps to HTTP 404 through ResponseError.
+            .map_err(|e| crate::error::ManagerError::from(e).into()),
+        _ => Ok(home),
+    }
+}
+
 async fn bearer_auth(
     req: ServiceRequest,
     token: &str,
@@ -322,8 +450,9 @@ async fn bearer_auth(
     let token_data = decode_token_with_validation(token, &req, configuration).await;
     match token_data {
         Ok(token_data) => {
-            // Validate groups authorization (for providers that support groups)
-            let state = req.app_data::<Data<ServerState>>().unwrap();
+            // Validate groups authorization (for providers that support groups).
+            // Clone the (Arc-backed) handle so `req` can be moved on error paths.
+            let state = req.app_data::<Data<ServerState>>().unwrap().clone();
             if let Err(AuthError::InsufficientGroups) =
                 validate_groups_authorization(&token_data, &state.config)
             {
@@ -333,59 +462,104 @@ async fn bearer_auth(
                 ));
             }
 
-            // Get tenant name using resolution logic with headers
+            let provider = token_data.provider();
+            let subject = token_data.claims.sub.clone();
+            let email = token_data.claims.email.clone();
+            let label = email.clone().unwrap_or_else(|| subject.clone());
+            // Only a provider-verified email may match an owner entry; an
+            // unverified, user-settable email must never confer `owner`.
+            let verified_email = if token_data.claims.email_verified == Some(true) {
+                email.as_deref()
+            } else {
+                None
+            };
+            let is_owner =
+                is_configured_owner(&state.config.owners, &provider, &subject, verified_email);
+
+            if is_owner {
+                // The owner's home tenant comes from its claims, ignoring the
+                // Feldera-Tenant header (which selects the acting tenant for an
+                // owner). Falls back to the default tenant when claims name none.
+                let empty = actix_web::http::header::HeaderMap::new();
+                let home = match token_data.tenant_name(&state.config, &empty) {
+                    Ok(name) => {
+                        let db = state.db.lock().await;
+                        match db
+                            .get_or_create_tenant_id(Uuid::now_v7(), name, provider.clone())
+                            .await
+                        {
+                            Ok(t) => t,
+                            Err(e) => {
+                                return Err((
+                                    create_authz_json_error(&format!(
+                                        "Database error while fetching tenant: {e}"
+                                    )),
+                                    req,
+                                ))
+                            }
+                        }
+                    }
+                    Err(_) => DEFAULT_TENANT_ID,
+                };
+                let acting = {
+                    let db = state.db.lock().await;
+                    resolve_owner_acting_tenant(&db, req.headers(), home).await
+                };
+                let acting_tenant = match acting {
+                    Ok(t) => t,
+                    Err(e) => return Err((e, req)),
+                };
+                AuthenticatedPrincipal {
+                    acting_tenant,
+                    home_tenant: home,
+                    role: Role::Owner,
+                    label,
+                }
+                .install(&req);
+                return Ok(req);
+            }
+
+            // Non-owner: the header disambiguates among the authorized tenants
+            // (existing behavior); the role comes from the membership table.
+            // `AuthError::Display` is the single source of these user-facing
+            // messages, so they cannot drift from the error variants.
             let tenant_name = match token_data.tenant_name(&state.config, req.headers()) {
                 Ok(name) => name,
-                Err(AuthError::NoTenantFound) => {
-                    return Err((
-                        create_authz_json_error("You are not authorized to access any Feldera tenant. Contact your administrator if you need access to Feldera."),
-                        req,
-                    ));
-                }
-                Err(AuthError::MissingTenantHeader) => {
-                    return Err((
-                        create_authz_json_error("Feldera-Tenant header is required when your access token contains multiple tenants."),
-                        req,
-                    ));
-                }
-                Err(AuthError::UnauthorizedTenant(tenant)) => {
-                    return Err((
-                        create_authz_json_error(&format!("You are not authorized to access tenant '{}'. Check your access token's tenants claim.", tenant)),
-                        req,
-                    ));
-                }
                 Err(e) => {
-                    error!("Tenant resolution error: {}", e);
-                    return Err((
-                        create_authz_json_error(&format!("Tenant resolution failed: {}", e)),
-                        req,
-                    ));
+                    error!("Tenant resolution failed: {e}");
+                    return Err((create_authz_json_error(&e.to_string()), req));
                 }
             };
 
-            // TODO: Handle tenant deletions at some point
-            let tenant = {
-                let db = &state.db.lock().await;
-                db.get_or_create_tenant_id(Uuid::now_v7(), tenant_name, token_data.provider())
-                    .await
+            let resolved = {
+                let db = state.db.lock().await;
+                db.resolve_login(
+                    Uuid::now_v7(),
+                    Uuid::now_v7(),
+                    tenant_name,
+                    provider,
+                    subject,
+                    email,
+                    state.config.default_role,
+                )
+                .await
             };
-
-            match tenant {
-                Ok(tenant_id) => {
-                    req.extensions_mut().insert(tenant_id);
-                    req.extensions_mut()
-                        .insert(vec![ApiPermission::Read, ApiPermission::Write]);
+            match resolved {
+                Ok((tenant_id, _user_id, role)) => {
+                    AuthenticatedPrincipal {
+                        acting_tenant: tenant_id,
+                        home_tenant: tenant_id,
+                        role,
+                        label,
+                    }
+                    .install(&req);
                     Ok(req)
                 }
                 Err(e) => {
-                    error!(
-                        "Could not fetch tenant ID for token_data {:?}, with error {}",
-                        token_data, e
-                    );
+                    error!("Could not resolve login, with error {}", e);
                     Err((
                         create_authz_json_error(&format!(
-                            "Database error while fetching tenant: {}",
-                            e
+                            "Database error while resolving login: {e}"
                         )),
                         req,
                     ))
@@ -423,12 +597,17 @@ async fn api_key_auth(
     let ad = req.app_data::<Data<ServerState>>();
     let validate = {
         let db = &ad.unwrap().db.lock().await;
-        validate_api_keys(db, api_key_str).await
+        db.validate_api_key(api_key_str).await
     };
     match validate {
-        Ok((tenant_id, permissions)) => {
-            req.extensions_mut().insert(tenant_id);
-            req.extensions_mut().insert(permissions);
+        Ok((tenant_id, role)) => {
+            AuthenticatedPrincipal {
+                acting_tenant: tenant_id,
+                home_tenant: tenant_id,
+                role,
+                label: "apikey".to_string(),
+            }
+            .install(&req);
             Ok(req)
         }
         Err(error) => {
@@ -563,16 +742,8 @@ impl OidcClaimExt for TokenData<OidcClaim> {
     }
 }
 
-/// Extract tenant identifier from OIDC issuer domain.
-///
-/// Extracts the full hostname from issuer URLs for tenant identification.
-/// This approach avoids tenant name collisions by using the complete domain.
-/// Examples:
-/// - "<https://acme-corp.okta.com/oauth2/default>" → Some("acme-corp.okta.com")
-/// - "<https://company.auth.us-west-2.amazoncognito.com/oauth2>" → Some("company.auth.us-west-2.amazoncognito.com")
-/// - "<https://accounts.google.com>" → Some("accounts.google.com")
-///
-/// Validates that the user belongs to at least one required group (for providers that support groups).
+/// Validates that the user belongs to at least one required group (for
+/// providers that support groups). Passes when no groups are configured.
 fn validate_groups_authorization(
     token: &TokenData<OidcClaim>,
     config: &ApiServerConfig,
@@ -599,8 +770,10 @@ fn validate_groups_authorization(
     }
 }
 
-/// Extract tenant identifier from issuer claim in OIDC Access token.
-/// The full issuer hostname is used to avoid collisions.
+/// Extract a tenant identifier from an OIDC issuer URL: the full hostname, used
+/// to avoid tenant-name collisions across providers. Examples:
+/// - `https://acme-corp.okta.com/oauth2/default` → `Some("acme-corp.okta.com")`
+/// - `https://accounts.google.com` → `Some("accounts.google.com")`
 fn extract_tenant_from_issuer(issuer: &str) -> Option<String> {
     Url::parse(issuer)
         .ok()
@@ -631,17 +804,73 @@ struct OidcDiscoveryDocument {
     jwks_uri: String,
 }
 
-/// Fetch OIDC discovery document and extract jwks_uri
+/// Timeout for OIDC discovery / JWKS HTTP requests.
+const OIDC_FETCH_TIMEOUT_SECONDS: u64 = 10;
+
+/// HTTP client for OIDC discovery / JWKS fetches: a short timeout and no
+/// redirect following, to bound the blast radius of a slow or redirecting
+/// issuer endpoint (defense in depth behind the trusted-issuer gate).
+fn oidc_http_client() -> Result<reqwest::Client, reqwest::Error> {
+    reqwest::Client::builder()
+        .timeout(Duration::from_secs(OIDC_FETCH_TIMEOUT_SECONDS))
+        .redirect(reqwest::redirect::Policy::none())
+        .build()
+}
+
+/// Fetch OIDC discovery document and extract `jwks_uri`.
 async fn fetch_jwks_uri_from_discovery(issuer: &str) -> Result<String, reqwest::Error> {
     let discovery_url = format!(
         "{}/.well-known/openid-configuration",
         issuer.trim_end_matches('/')
     );
-    let response = reqwest::get(&discovery_url).await?;
-    let discovery: OidcDiscoveryDocument = response.json().await?;
+    let discovery: OidcDiscoveryDocument = oidc_http_client()?
+        .get(&discovery_url)
+        .send()
+        .await?
+        .json()
+        .await?;
     Ok(discovery.jwks_uri)
 }
 
+/// Fetch and parse the RSA JWKS for a federated `issuer` (discovery then keys),
+/// using the hardened OIDC client. Called on the auth path only after the
+/// issuer is confirmed trusted.
+async fn fetch_issuer_jwks(issuer: &str) -> Result<HashMap<String, DecodingKey>, AuthError> {
+    let jwks_uri = fetch_jwks_uri_from_discovery(issuer)
+        .await
+        .map_err(|e| AuthError::JwkShape(format!("OIDC discovery failed: {e}")))?;
+    let client =
+        oidc_http_client().map_err(|e| AuthError::JwkShape(format!("OIDC client build: {e}")))?;
+    let keys_json: Value = client
+        .get(&jwks_uri)
+        .send()
+        .await
+        .map_err(|e| AuthError::JwkShape(format!("JWKS request failed: {e}")))?
+        .json()
+        .await
+        .map_err(|e| AuthError::JwkShape(format!("JWKS parse failed: {e}")))?;
+    parse_rsa_jwks(&keys_json)
+}
+
+/// Resolve the RSA decoding key for `(issuer, kid)` from the federated JWKS
+/// cache, fetching on a miss. The network fetch runs without holding the cache
+/// lock, so a slow issuer endpoint cannot serialize all federated auth.
+async fn resolve_issuer_jwk(
+    state: &ServerState,
+    issuer: &str,
+    kid: &str,
+) -> Result<DecodingKey, AuthError> {
+    if let Some(key) = state.issuer_jwk_cache.lock().await.cached(issuer, kid) {
+        return Ok(key);
+    }
+    let keys = fetch_issuer_jwks(issuer).await?;
+    let mut cache = state.issuer_jwk_cache.lock().await;
+    cache.insert(issuer, keys);
+    cache
+        .cached(issuer, kid)
+        .ok_or_else(|| AuthError::JwkShape("kid not present in issuer JWKS".to_string()))
+}
+
 #[derive(Clone, Serialize, ToSchema)]
 pub(crate) enum AuthProvider {
     AwsCognito(ProviderAwsCognito), // The argument is the URL to use for fetching JWKs
@@ -767,6 +996,11 @@ struct OidcClaim {
     /// Email address (if available)
     email: Option<String>,
 
+    /// Whether the identity provider verified the email address. Owner matching
+    /// on `email` requires this to be `true`: an unverified, user-settable email
+    /// must never confer the platform-wide `owner` role.
+    email_verified: Option<bool>,
+
     /// Tenant identifier for single-tenant deployments
     /// TODO: Deprecated, remove when no one no longer uses it
     tenant: Option<String>,
@@ -953,22 +1187,20 @@ impl IssuerJwkCache {
         }
     }
 
-    async fn get(&mut self, issuer: &str, kid: &str) -> Result<DecodingKey, AuthError> {
-        let key = (issuer.to_string(), kid.to_string());
-        if let Some(dk) = self.cache.cache_get(&key) {
-            return Ok(dk.clone());
-        }
-        let jwks_uri = fetch_jwks_uri_from_discovery(issuer)
-            .await
-            .map_err(|e| AuthError::JwkShape(format!("OIDC discovery failed: {e}")))?;
-        let fetched = fetch_jwk_oidc_keys(&jwks_uri).await?;
-        for (k, dk) in fetched {
-            self.cache.cache_set((issuer.to_string(), k), dk);
-        }
+    /// Return the cached decoding key for `(issuer, kid)`, if present. No I/O,
+    /// so the caller holds the lock only briefly (see [`resolve_issuer_jwk`]).
+    fn cached(&mut self, issuer: &str, kid: &str) -> Option<DecodingKey> {
         self.cache
-            .cache_get(&key)
+            .cache_get(&(issuer.to_string(), kid.to_string()))
             .cloned()
-            .ok_or_else(|| AuthError::JwkShape("kid not present in issuer JWKS".to_string()))
+    }
+
+    /// Insert freshly fetched keys for `issuer`, keyed by `kid`.
+    fn insert(&mut self, issuer: &str, keys: HashMap<String, DecodingKey>) {
+        for (kid, decoding_key) in keys {
+            self.cache
+                .cache_set((issuer.to_string(), kid), decoding_key);
+        }
     }
 }
 
@@ -1034,46 +1266,7 @@ async fn fetch_jwk_oidc_keys(url: &String) -> Result<HashMap<String, DecodingKey
     let keys_as_json = res?.json::<Value>().await;
 
     match keys_as_json {
-        Ok(value) => {
-            let filtered = value
-                .get("keys")
-                .ok_or_else(|| {
-                    debug!("JWK response missing 'keys' field");
-                    AuthError::JwkShape("Missing keys field".to_owned())
-                })?
-                .as_array()
-                .ok_or_else(|| {
-                    debug!("JWK 'keys' field is not an array");
-                    AuthError::JwkShape("keys field was not an array".to_owned())
-                })?
-                .iter()
-                // Standard OIDC JWK endpoints should return keys for RS256 signature verification.
-                // This filter ensures we only use appropriate keys for our validation
-                .filter_map(|val| check_key_as_str("alg", "RS256", val))
-                .filter_map(|val| check_key_as_str("use", "sig", val));
-
-            let mut ret = HashMap::new();
-            for json_value in filtered {
-                let kid = validate_field_is_str("kid", json_value).ok_or_else(|| {
-                    debug!("JWK entry missing 'kid' field");
-                    AuthError::JwkShape("Could not extract 'kid' field".to_owned())
-                })?;
-                let n = validate_field_is_str("n", json_value).ok_or_else(|| {
-                    debug!("JWK entry missing 'n' field");
-                    AuthError::JwkShape("Could not extract 'n' field".to_owned())
-                })?;
-                let e = validate_field_is_str("e", json_value).ok_or_else(|| {
-                    debug!("JWK entry missing 'e' field");
-                    AuthError::JwkShape("Could not extract 'e' field".to_owned())
-                })?;
-                let decoding_key = DecodingKey::from_rsa_components(n, e).map_err(|e| {
-                    debug!("Failed to create decoding key: {}", e);
-                    AuthError::JwkShape(format!("Invalid JWK decoding key: {}", e))
-                })?;
-                ret.insert(kid.to_owned(), decoding_key);
-            }
-            Ok(ret)
-        }
+        Ok(value) => parse_rsa_jwks(&value),
         Err(JsonPayloadError::Deserialize(json_error)) => {
             debug!("Failed to deserialize JWK response: {}", json_error);
             Err(AuthError::JwkShape(json_error.to_string()))
@@ -1089,6 +1282,48 @@ async fn fetch_jwk_oidc_keys(url: &String) -> Result<HashMap<String, DecodingKey
     }
 }
 
+/// Parse a JWK set into RSA decoding keys, keyed by `kid`. Keeps only keys
+/// declared for RS256 signature verification (`alg=RS256`, `use=sig`). Shared by
+/// the login-provider (awc) and federated (reqwest) fetch paths.
+fn parse_rsa_jwks(value: &Value) -> Result<HashMap<String, DecodingKey>, AuthError> {
+    let filtered = value
+        .get("keys")
+        .ok_or_else(|| {
+            debug!("JWK response missing 'keys' field");
+            AuthError::JwkShape("Missing keys field".to_owned())
+        })?
+        .as_array()
+        .ok_or_else(|| {
+            debug!("JWK 'keys' field is not an array");
+            AuthError::JwkShape("keys field was not an array".to_owned())
+        })?
+        .iter()
+        .filter_map(|val| check_key_as_str("alg", "RS256", val))
+        .filter_map(|val| check_key_as_str("use", "sig", val));
+
+    let mut ret = HashMap::new();
+    for json_value in filtered {
+        let kid = validate_field_is_str("kid", json_value).ok_or_else(|| {
+            debug!("JWK entry missing 'kid' field");
+            AuthError::JwkShape("Could not extract 'kid' field".to_owned())
+        })?;
+        let n = validate_field_is_str("n", json_value).ok_or_else(|| {
+            debug!("JWK entry missing 'n' field");
+            AuthError::JwkShape("Could not extract 'n' field".to_owned())
+        })?;
+        let e = validate_field_is_str("e", json_value).ok_or_else(|| {
+            debug!("JWK entry missing 'e' field");
+            AuthError::JwkShape("Could not extract 'e' field".to_owned())
+        })?;
+        let decoding_key = DecodingKey::from_rsa_components(n, e).map_err(|e| {
+            debug!("Failed to create decoding key: {}", e);
+            AuthError::JwkShape(format!("Invalid JWK decoding key: {}", e))
+        })?;
+        ret.insert(kid.to_owned(), decoding_key);
+    }
+    Ok(ret)
+}
+
 fn check_key_as_str<'a>(key: &str, check: &str, json: &'a Value) -> Option<&'a Value> {
     if let Some(value) = validate_field_is_str(key, json) {
         if value == check {
@@ -1112,15 +1347,6 @@ fn validate_field_is_str<'a>(key: &str, json: &'a Value) -> Option<&'a str> {
     None
 }
 
-// Fetch keys on every authentication attempt, so cache the
-// results.
-async fn validate_api_keys(
-    db: &StoragePostgres,
-    api_key: &str,
-) -> Result<(TenantId, Vec<ApiPermission>), DBError> {
-    db.validate_api_key(api_key).await
-}
-
 const API_KEY_LENGTH: usize = 128;
 pub const API_KEY_PREFIX: &str = "apikey:";
 
@@ -1157,8 +1383,8 @@ mod test {
     use tokio::sync::{Mutex, RwLock};
     use uuid::Uuid;
 
-    use super::AuthError;
-    use crate::db::types::api_key::ApiPermission;
+    use super::{AuthError, AuthenticatedPrincipal};
+    use crate::db::types::role::{MintableKeyRole, Role};
     use crate::{
         api::main::ServerState,
         auth::{self, AuthConfiguration, AuthProvider, OidcClaim},
@@ -1204,6 +1430,7 @@ mod test {
             token_use: Some("access".to_owned()),
             username: Some("some-user".to_owned()),
             email: None,
+            email_verified: None,
             tenant: None,
             tenants: None,
             groups: None,
@@ -1273,6 +1500,8 @@ mod test {
             individual_tenant: true,
             issuer_tenant: false,
             auth_audience: "feldera-api".to_string(),
+            owners: vec![],
+            default_role: Role::Read,
         };
 
         let (conn, _temp) = crate::db::test::setup_pg().await;
@@ -1290,7 +1519,7 @@ mod test {
                 Uuid::now_v7(),
                 "foo",
                 &api_key,
-                vec![ApiPermission::Read, ApiPermission::Write],
+                MintableKeyRole::Write,
             )
             .await
             .unwrap();
@@ -1322,12 +1551,12 @@ mod test {
                 "/",
                 web::get().to(|req: HttpRequest| async move {
                     {
+                        // After auth, a principal must be installed with at least
+                        // the read role (login creates the tenant => admin; the
+                        // test API key carries write).
                         let ext = req.extensions();
-                        let permissions = ext.get::<Vec<ApiPermission>>().unwrap();
-                        assert_eq!(
-                            *permissions,
-                            vec![ApiPermission::Read, ApiPermission::Write]
-                        );
+                        let principal = ext.get::<AuthenticatedPrincipal>().unwrap();
+                        assert!(principal.role.satisfies(Role::Read));
                     }
                     HttpResponse::build(StatusCode::OK).await
                 }),
@@ -1345,6 +1574,31 @@ mod test {
         assert!(matches!(res.err().unwrap(), AuthError::JwkFetch(_)));
     }
 
+    #[tokio::test]
+    async fn owner_matching_ignores_empty_entries() {
+        use super::is_configured_owner;
+        let owners = vec!["owner@example.com".to_string(), "iss sub2".to_string()];
+        // Matches by email and by provider-qualified "<issuer> <subject>".
+        assert!(is_configured_owner(
+            &owners,
+            "iss",
+            "x",
+            Some("owner@example.com")
+        ));
+        assert!(is_configured_owner(&owners, "iss", "sub2", None));
+        assert!(!is_configured_owner(
+            &owners,
+            "iss",
+            "nobody",
+            Some("no@x.com")
+        ));
+        // A blank entry (trailing/double comma in FELDERA_OWNERS) must never
+        // match a token with an empty/absent email or subject.
+        let with_blank = vec!["a".to_string(), "".to_string(), "b".to_string()];
+        assert!(!is_configured_owner(&with_blank, "iss", "", Some("")));
+        assert!(!is_configured_owner(&with_blank, "iss", "", None));
+    }
+
     #[tokio::test]
     async fn valid_token() {
         let claim = default_claim();
diff --git a/crates/pipeline-manager/src/config.rs b/crates/pipeline-manager/src/config.rs
index 048d63d59c3..2149d83a5e9 100644
--- a/crates/pipeline-manager/src/config.rs
+++ b/crates/pipeline-manager/src/config.rs
@@ -1,4 +1,5 @@
 use crate::db::types::program::CompilationProfile;
+use crate::db::types::role::Role;
 use crate::db::types::version::Version;
 use crate::db::{error::DBError, types::pipeline::PipelineId};
 use crate::has_unstable_feature;
@@ -20,6 +21,7 @@ use rustls::pki_types::pem::PemObject;
 use rustls::pki_types::{CertificateDer, PrivateKeyDer};
 use rustls::{ClientConfig, RootCertStore};
 use serde::Deserialize;
+use std::str::FromStr;
 use std::sync::Arc;
 use std::{
     env,
@@ -111,6 +113,23 @@ fn default_auth_audience() -> String {
     "feldera-api".to_string()
 }
 
+/// Default role for an authenticated user with no explicit tenant membership.
+fn default_default_role() -> Role {
+    Role::Read
+}
+
+/// Parse the configured default role, restricting it to `read` or `write`
+/// (a tenant `admin`/`owner` is never granted implicitly).
+fn parse_default_role(s: &str) -> Result<Role, String> {
+    match Role::from_str(s) {
+        Ok(role @ (Role::Read | Role::Write)) => Ok(role),
+        Ok(other) => Err(format!(
+            "default role must be 'read' or 'write', not '{other}'"
+        )),
+        Err(e) => Err(e.to_string()),
+    }
+}
+
 /// Default number of monitor events that are retained for each pipeline.
 fn default_pipeline_monitor_events_retention() -> u32 {
     720
@@ -941,6 +960,20 @@ pub struct ApiServerConfig {
     #[serde(default = "default_auth_audience")]
     #[arg(long, default_value = "feldera-api", env = "FELDERA_AUTH_AUDIENCE")]
     pub auth_audience: String,
+
+    /// Identities granted the platform-wide `owner` role. Each entry matches an
+    /// access token's email, its OIDC subject, or the provider-qualified
+    /// `"<issuer> <subject>"` form. Comma-separated.
+    /// Example: "ops@acme.com,platform-admins"
+    #[serde(default)]
+    #[arg(long, value_delimiter = ',', env = "FELDERA_OWNERS")]
+    pub owners: Vec<String>,
+
+    /// Role assigned to an authenticated user who has no explicit tenant
+    /// membership yet. Must be `read` or `write`. Default: `read`.
+    #[serde(default = "default_default_role")]
+    #[arg(long, default_value = "read", value_parser = parse_default_role, env = "FELDERA_AUTH_DEFAULT_ROLE")]
+    pub default_role: Role,
 }
 
 impl ApiServerConfig {
@@ -987,6 +1020,8 @@ impl ApiServerConfig {
             individual_tenant: true,
             authorized_groups: vec![],
             auth_audience: "feldera-api".to_string(),
+            owners: vec![],
+            default_role: Role::Read,
         }
     }
 }
diff --git a/crates/pipeline-manager/src/db/error.rs b/crates/pipeline-manager/src/db/error.rs
index 8bfd3ff84d8..fa235e25cdf 100644
--- a/crates/pipeline-manager/src/db/error.rs
+++ b/crates/pipeline-manager/src/db/error.rs
@@ -3,6 +3,7 @@ use crate::db::types::monitor::{ClusterMonitorEventId, PipelineMonitorEventId};
 use crate::db::types::pipeline::PipelineId;
 use crate::db::types::program::ProgramStatus;
 use crate::db::types::resources_status::{ResourcesDesiredStatus, ResourcesStatus};
+use crate::db::types::role::Role;
 use crate::db::types::storage::StorageStatus;
 use crate::db::types::tenant::TenantId;
 use crate::db::types::utils::ValidationError;
@@ -142,6 +143,9 @@ pub enum DBError {
     UnknownTenant {
         tenant_id: TenantId,
     },
+    UnknownTenantName {
+        name: String,
+    },
     // API key-related errors
     UnknownApiKey {
         name: String,
@@ -154,10 +158,30 @@ pub enum DBError {
     EmptyOidcTrustField {
         field: String,
     },
+    OidcTrustTooBroad {
+        reason: String,
+    },
     InvalidOidcToken {
         reason: String,
     },
     UnauthorizedOidcToken,
+    // RBAC errors
+    InsufficientPermissions {
+        required: Role,
+        actual: Role,
+    },
+    RoleExceedsCreator {
+        requested: Role,
+        creator: Role,
+    },
+    OwnerNotMintableAsApiKey,
+    OwnerRoleNotAssignable,
+    InvalidRoleString {
+        value: String,
+    },
+    UnknownUser {
+        user_id: String,
+    },
     // Pipeline-related errors
     UnknownPipeline {
         pipeline_id: PipelineId,
@@ -588,12 +612,45 @@ impl Display for DBError {
             DBError::UnknownTenant { tenant_id } => {
                 write!(f, "Unknown tenant id '{tenant_id}'")
             }
+            DBError::UnknownTenantName { name } => {
+                write!(f, "Unknown tenant '{name}'")
+            }
             DBError::UnknownApiKey { name } => {
                 write!(f, "Unknown API key '{name}'")
             }
             DBError::InvalidApiKey => {
                 write!(f, "Invalid API key")
             }
+            DBError::InsufficientPermissions { required, actual } => {
+                write!(
+                    f,
+                    "Insufficient permissions: this action requires the '{required}' role, but the caller has '{actual}'"
+                )
+            }
+            DBError::RoleExceedsCreator { requested, creator } => {
+                write!(
+                    f,
+                    "Cannot grant the '{requested}' role: it exceeds the creator's own '{creator}' role"
+                )
+            }
+            DBError::OwnerNotMintableAsApiKey => {
+                write!(
+                    f,
+                    "The 'owner' and 'admin' roles cannot be issued as an API key; use an OIDC trust relationship or interactive login"
+                )
+            }
+            DBError::OwnerRoleNotAssignable => {
+                write!(
+                    f,
+                    "The 'owner' role is platform-wide and cannot be assigned as a tenant membership"
+                )
+            }
+            DBError::InvalidRoleString { value } => {
+                write!(f, "Invalid role string '{value}' encountered")
+            }
+            DBError::UnknownUser { user_id } => {
+                write!(f, "Unknown user '{user_id}'")
+            }
             DBError::UnknownOidcTrust { name } => {
                 write!(f, "Unknown OIDC trust relationship '{name}'")
             }
@@ -603,6 +660,9 @@ impl Display for DBError {
                     "OIDC trust relationship field '{field}' must not be empty"
                 )
             }
+            DBError::OidcTrustTooBroad { reason } => {
+                write!(f, "OIDC trust relationship is too broad: {reason}")
+            }
             DBError::InvalidOidcToken { reason } => {
                 write!(f, "Invalid OIDC token: {reason}")
             }
@@ -901,10 +961,18 @@ impl DetailedError for DBError {
             Self::TooManyTags { .. } => Cow::from("TooManyTags"),
             Self::TooLongDescription { .. } => Cow::from("TooLongDescription"),
             Self::UnknownTenant { .. } => Cow::from("UnknownTenant"),
+            Self::UnknownTenantName { .. } => Cow::from("UnknownTenantName"),
             Self::UnknownApiKey { .. } => Cow::from("UnknownApiKey"),
             Self::InvalidApiKey => Cow::from("InvalidApiKey"),
+            Self::InsufficientPermissions { .. } => Cow::from("InsufficientPermissions"),
+            Self::RoleExceedsCreator { .. } => Cow::from("RoleExceedsCreator"),
+            Self::OwnerNotMintableAsApiKey => Cow::from("OwnerNotMintableAsApiKey"),
+            Self::OwnerRoleNotAssignable => Cow::from("OwnerRoleNotAssignable"),
+            Self::InvalidRoleString { .. } => Cow::from("InvalidRoleString"),
+            Self::UnknownUser { .. } => Cow::from("UnknownUser"),
             Self::UnknownOidcTrust { .. } => Cow::from("UnknownOidcTrust"),
             Self::EmptyOidcTrustField { .. } => Cow::from("EmptyOidcTrustField"),
+            Self::OidcTrustTooBroad { .. } => Cow::from("OidcTrustTooBroad"),
             Self::InvalidOidcToken { .. } => Cow::from("InvalidOidcToken"),
             Self::UnauthorizedOidcToken => Cow::from("UnauthorizedOidcToken"),
             Self::UnknownPipeline { .. } => Cow::from("UnknownPipeline"),
@@ -1018,10 +1086,18 @@ impl ResponseError for DBError {
             Self::TooManyTags { .. } => StatusCode::BAD_REQUEST,
             Self::TooLongDescription { .. } => StatusCode::BAD_REQUEST,
             Self::UnknownTenant { .. } => StatusCode::UNAUTHORIZED, // TODO: should we report not found instead?
+            Self::UnknownTenantName { .. } => StatusCode::NOT_FOUND,
             Self::UnknownApiKey { .. } => StatusCode::NOT_FOUND,
             Self::InvalidApiKey => StatusCode::UNAUTHORIZED,
+            Self::InsufficientPermissions { .. } => StatusCode::FORBIDDEN,
+            Self::RoleExceedsCreator { .. } => StatusCode::FORBIDDEN,
+            Self::OwnerNotMintableAsApiKey => StatusCode::FORBIDDEN,
+            Self::OwnerRoleNotAssignable => StatusCode::FORBIDDEN,
+            Self::InvalidRoleString { .. } => StatusCode::INTERNAL_SERVER_ERROR,
+            Self::UnknownUser { .. } => StatusCode::NOT_FOUND,
             Self::UnknownOidcTrust { .. } => StatusCode::NOT_FOUND,
             Self::EmptyOidcTrustField { .. } => StatusCode::BAD_REQUEST,
+            Self::OidcTrustTooBroad { .. } => StatusCode::BAD_REQUEST,
             Self::InvalidOidcToken { .. } => StatusCode::UNAUTHORIZED,
             Self::UnauthorizedOidcToken => StatusCode::UNAUTHORIZED,
             Self::UnknownPipeline { .. } => StatusCode::NOT_FOUND,
diff --git a/crates/pipeline-manager/src/db/operations.rs b/crates/pipeline-manager/src/db/operations.rs
index d546a8b3987..e91d58711d6 100644
--- a/crates/pipeline-manager/src/db/operations.rs
+++ b/crates/pipeline-manager/src/db/operations.rs
@@ -19,4 +19,5 @@ pub mod pipeline;
 pub mod pipeline_monitor;
 mod pipeline_parsing;
 pub mod tenant;
+pub mod user;
 pub(crate) mod utils;
diff --git a/crates/pipeline-manager/src/db/operations/api_key.rs b/crates/pipeline-manager/src/db/operations/api_key.rs
index b1da9d69c32..2409b40b412 100644
--- a/crates/pipeline-manager/src/db/operations/api_key.rs
+++ b/crates/pipeline-manager/src/db/operations/api_key.rs
@@ -2,9 +2,8 @@ use crate::db::error::DBError;
 use crate::db::operations::utils::{
     maybe_tenant_id_foreign_key_constraint_err, maybe_unique_violation,
 };
-use crate::db::types::api_key::{
-    ApiKeyDescr, ApiKeyId, ApiPermission, API_PERMISSION_READ, API_PERMISSION_WRITE,
-};
+use crate::db::types::api_key::{ApiKeyDescr, ApiKeyId};
+use crate::db::types::role::{MintableKeyRole, Role};
 use crate::db::types::tenant::TenantId;
 use crate::db::types::utils::validate_api_key_name;
 use deadpool_postgres::Transaction;
@@ -12,24 +11,28 @@ use openssl::sha;
 use std::str::FromStr;
 use uuid::Uuid;
 
+/// Parse a role string read from the DB, turning an unexpected value into a
+/// request error rather than a panic (this runs on the auth path).
+fn parse_role(s: &str) -> Result<Role, DBError> {
+    Role::from_str(s).map_err(|_| DBError::InvalidRoleString {
+        value: s.to_string(),
+    })
+}
+
 pub async fn list_api_keys(
     txn: &Transaction<'_>,
     tenant_id: TenantId,
 ) -> Result<Vec<ApiKeyDescr>, DBError> {
     let stmt = txn
-        .prepare_cached("SELECT id, name, scopes FROM api_key WHERE tenant_id = $1")
+        .prepare_cached("SELECT id, name, role FROM api_key WHERE tenant_id = $1")
         .await?;
     let rows = txn.query(&stmt, &[&tenant_id.0]).await?;
     let mut result = Vec::with_capacity(rows.len());
     for row in rows {
         let id: ApiKeyId = ApiKeyId(row.get(0));
         let name: String = row.get(1);
-        let vec: Vec<String> = row.get(2);
-        let scopes = vec
-            .iter()
-            .map(|s| ApiPermission::from_str(s).expect("Unexpected ApiPermission string in the DB"))
-            .collect();
-        result.push(ApiKeyDescr { id, name, scopes });
+        let role = parse_role(&row.get::<_, String>(2))?;
+        result.push(ApiKeyDescr { id, name, role });
     }
     Ok(result)
 }
@@ -40,19 +43,14 @@ pub async fn get_api_key(
     name: &str,
 ) -> Result<ApiKeyDescr, DBError> {
     let stmt = txn
-        .prepare_cached("SELECT id, name, scopes FROM api_key WHERE tenant_id = $1 and name = $2")
+        .prepare_cached("SELECT id, name, role FROM api_key WHERE tenant_id = $1 and name = $2")
         .await?;
     let maybe_row = txn.query_opt(&stmt, &[&tenant_id.0, &name]).await?;
     if let Some(row) = maybe_row {
         let id: ApiKeyId = ApiKeyId(row.get(0));
         let name: String = row.get(1);
-        let vec: Vec<String> = row.get(2);
-        let scopes = vec
-            .iter()
-            .map(|s| ApiPermission::from_str(s).expect("Unexpected ApiPermission string in the DB"))
-            .collect();
-
-        Ok(ApiKeyDescr { id, name, scopes })
+        let role = parse_role(&row.get::<_, String>(2))?;
+        Ok(ApiKeyDescr { id, name, role })
     } else {
         Err(DBError::UnknownApiKey {
             name: name.to_string(),
@@ -78,13 +76,15 @@ pub async fn delete_api_key(
     }
 }
 
+/// Persists the SHA-256 hash of an API key. The role is a [`MintableKeyRole`]
+/// (read/write only) so `admin`/`owner` cannot reach storage by construction.
 pub async fn store_api_key_hash(
     txn: &Transaction<'_>,
     tenant_id: TenantId,
     id: Uuid,
     name: &str,
     key: &str,
-    scopes: Vec<ApiPermission>,
+    role: MintableKeyRole,
 ) -> Result<(), DBError> {
     validate_api_key_name(name)?;
     let mut hasher = sha::Sha256::new();
@@ -92,25 +92,13 @@ pub async fn store_api_key_hash(
     let hash = openssl::base64::encode_block(&hasher.finish());
     let stmt = txn
         .prepare_cached(
-            "INSERT INTO api_key (id, tenant_id, name, hash, scopes) VALUES ($1, $2, $3, $4, $5)",
+            "INSERT INTO api_key (id, tenant_id, name, hash, role) VALUES ($1, $2, $3, $4, $5)",
         )
         .await?;
     let res = txn
         .execute(
             &stmt,
-            &[
-                &id,
-                &tenant_id.0,
-                &name,
-                &hash,
-                &scopes
-                    .iter()
-                    .map(|scope| match scope {
-                        ApiPermission::Read => API_PERMISSION_READ,
-                        ApiPermission::Write => API_PERMISSION_WRITE,
-                    })
-                    .collect::<Vec<&str>>(),
-            ],
+            &[&id, &tenant_id.0, &name, &hash, &role.role().as_str()],
         )
         .await
         .map_err(maybe_unique_violation)
@@ -125,20 +113,16 @@ pub async fn store_api_key_hash(
 pub async fn validate_api_key(
     txn: &Transaction<'_>,
     api_key: &str,
-) -> Result<(TenantId, Vec<ApiPermission>), DBError> {
+) -> Result<(TenantId, Role), DBError> {
     let mut hasher = sha::Sha256::new();
     hasher.update(api_key.as_bytes());
     let hash = openssl::base64::encode_block(&hasher.finish());
     let stmt = txn
-        .prepare_cached("SELECT tenant_id, scopes FROM api_key WHERE hash = $1")
+        .prepare_cached("SELECT tenant_id, role FROM api_key WHERE hash = $1")
         .await?;
     let res = txn.query(&stmt, &[&hash]).await?;
     let res = res.first().ok_or(DBError::InvalidApiKey)?;
     let tenant_id = TenantId(res.get(0));
-    let vec: Vec<String> = res.get(1);
-    let vec = vec
-        .iter()
-        .map(|s| ApiPermission::from_str(s).expect("Unexpected ApiPermission string in the DB"))
-        .collect();
-    Ok((tenant_id, vec))
+    let role = parse_role(&res.get::<_, String>(1))?;
+    Ok((tenant_id, role))
 }
diff --git a/crates/pipeline-manager/src/db/operations/oidc_trust.rs b/crates/pipeline-manager/src/db/operations/oidc_trust.rs
index 31403fc27be..e1bd2b5d5c9 100644
--- a/crates/pipeline-manager/src/db/operations/oidc_trust.rs
+++ b/crates/pipeline-manager/src/db/operations/oidc_trust.rs
@@ -2,35 +2,37 @@ use crate::db::error::DBError;
 use crate::db::operations::utils::{
     maybe_tenant_id_foreign_key_constraint_err, maybe_unique_violation,
 };
-use crate::db::types::api_key::{ApiPermission, API_PERMISSION_READ, API_PERMISSION_WRITE};
 use crate::db::types::oidc_trust::{claim_matches, OidcTrustDescr, OidcTrustId};
+use crate::db::types::role::Role;
 use crate::db::types::tenant::TenantId;
-use crate::db::types::utils::validate_name;
+use crate::db::types::utils::validate_oidc_trust_name;
 use deadpool_postgres::Transaction;
 use std::str::FromStr;
 use uuid::Uuid;
 
-fn row_to_descr(row: &tokio_postgres::Row) -> OidcTrustDescr {
+fn parse_role(s: &str) -> Result<Role, DBError> {
+    Role::from_str(s).map_err(|_| DBError::InvalidRoleString {
+        value: s.to_string(),
+    })
+}
+
+fn row_to_descr(row: &tokio_postgres::Row) -> Result<OidcTrustDescr, DBError> {
     let id: Uuid = row.get(0);
     let name: String = row.get(1);
     let description: Option<String> = row.get(2);
     let issuer: String = row.get(3);
     let subject: String = row.get(4);
     let audience: Option<String> = row.get(5);
-    let scopes_raw: Vec<String> = row.get(6);
-    let scopes = scopes_raw
-        .iter()
-        .map(|s| ApiPermission::from_str(s).expect("unexpected ApiPermission string in DB"))
-        .collect();
-    OidcTrustDescr {
+    let role = parse_role(&row.get::<_, String>(6))?;
+    Ok(OidcTrustDescr {
         id: OidcTrustId(id),
         name,
         description,
         issuer,
         subject,
         audience,
-        scopes,
-    }
+        role,
+    })
 }
 
 pub async fn list_oidc_trust(
@@ -39,12 +41,12 @@ pub async fn list_oidc_trust(
 ) -> Result<Vec<OidcTrustDescr>, DBError> {
     let stmt = txn
         .prepare_cached(
-            "SELECT id, name, description, issuer, subject, audience, scopes \
+            "SELECT id, name, description, issuer, subject, audience, role \
              FROM oidc_trust_relationship WHERE tenant_id = $1",
         )
         .await?;
     let rows = txn.query(&stmt, &[&tenant_id.0]).await?;
-    Ok(rows.iter().map(row_to_descr).collect())
+    rows.iter().map(row_to_descr).collect()
 }
 
 pub async fn get_oidc_trust(
@@ -54,16 +56,17 @@ pub async fn get_oidc_trust(
 ) -> Result<OidcTrustDescr, DBError> {
     let stmt = txn
         .prepare_cached(
-            "SELECT id, name, description, issuer, subject, audience, scopes \
+            "SELECT id, name, description, issuer, subject, audience, role \
              FROM oidc_trust_relationship WHERE tenant_id = $1 AND name = $2",
         )
         .await?;
     let maybe_row = txn.query_opt(&stmt, &[&tenant_id.0, &name]).await?;
-    maybe_row
-        .map(|row| row_to_descr(&row))
-        .ok_or(DBError::UnknownOidcTrust {
+    match maybe_row {
+        Some(row) => row_to_descr(&row),
+        None => Err(DBError::UnknownOidcTrust {
             name: name.to_string(),
-        })
+        }),
+    }
 }
 
 pub async fn delete_oidc_trust(
@@ -94,9 +97,9 @@ pub async fn create_oidc_trust(
     issuer: &str,
     subject: &str,
     audience: Option<&str>,
-    scopes: &[ApiPermission],
+    role: Role,
 ) -> Result<(), DBError> {
-    validate_name(name)?;
+    validate_oidc_trust_name(name)?;
     if issuer.is_empty() {
         return Err(DBError::EmptyOidcTrustField {
             field: "issuer".to_string(),
@@ -110,17 +113,10 @@ pub async fn create_oidc_trust(
     let stmt = txn
         .prepare_cached(
             "INSERT INTO oidc_trust_relationship \
-             (id, tenant_id, name, description, issuer, subject, audience, scopes) \
+             (id, tenant_id, name, description, issuer, subject, audience, role) \
              VALUES ($1, $2, $3, $4, $5, $6, $7, $8)",
         )
         .await?;
-    let scopes_str: Vec<&str> = scopes
-        .iter()
-        .map(|s| match s {
-            ApiPermission::Read => API_PERMISSION_READ,
-            ApiPermission::Write => API_PERMISSION_WRITE,
-        })
-        .collect();
     let res = txn
         .execute(
             &stmt,
@@ -132,7 +128,7 @@ pub async fn create_oidc_trust(
                 &issuer,
                 &subject,
                 &audience,
-                &scopes_str,
+                &role.as_str(),
             ],
         )
         .await
@@ -145,27 +141,48 @@ pub async fn create_oidc_trust(
     }
 }
 
-/// Look up the trust relationships registered for an `issuer` and return the
-/// first one whose subject pattern matches `sub` and (if present) audience
-/// pattern matches `aud`.
+/// Cheap indexed check: is `issuer` named by at least one trust relationship?
+///
+/// The federated auth path calls this before any OIDC discovery / JWKS fetch,
+/// so an unregistered issuer is rejected without an outbound request. Without
+/// this gate an unauthenticated caller could make the manager fetch arbitrary
+/// URLs (SSRF) and amplify one request into repeated discovery fetches (DoS).
+pub async fn is_trusted_issuer(txn: &Transaction<'_>, issuer: &str) -> Result<bool, DBError> {
+    let stmt = txn
+        .prepare_cached("SELECT EXISTS (SELECT 1 FROM oidc_trust_relationship WHERE issuer = $1)")
+        .await?;
+    let row = txn.query_one(&stmt, &[&issuer]).await?;
+    Ok(row.get(0))
+}
+
+/// Resolve a federated token to the tenant and role it is authorized for.
+///
+/// All trusts registered for `issuer` whose subject pattern matches `subject`
+/// and (if present) audience pattern matches one of `audiences` are candidates.
+/// The `aud` claim is the disambiguator: a tenant scopes its trust with a
+/// tenant-specific audience. If candidates resolve to more than one distinct
+/// tenant, the match is ambiguous and rejected (fail closed) rather than
+/// silently crossing tenants. Within a single tenant the most permissive
+/// matching role wins.
 pub async fn match_oidc_trust(
     txn: &Transaction<'_>,
     issuer: &str,
     subject: &str,
     audiences: &[String],
-) -> Result<Option<(TenantId, Vec<ApiPermission>)>, DBError> {
+) -> Result<Option<(TenantId, Role)>, DBError> {
     let stmt = txn
         .prepare_cached(
-            "SELECT tenant_id, subject, audience, scopes \
+            "SELECT tenant_id, subject, audience, role \
              FROM oidc_trust_relationship WHERE issuer = $1",
         )
         .await?;
     let rows = txn.query(&stmt, &[&issuer]).await?;
+    let mut matched: Option<(TenantId, Role)> = None;
     for row in rows {
-        let tenant_uuid: Uuid = row.get(0);
+        let tenant_id = TenantId(row.get(0));
         let pattern_subject: String = row.get(1);
         let pattern_audience: Option<String> = row.get(2);
-        let scopes_raw: Vec<String> = row.get(3);
+        let role = parse_role(&row.get::<_, String>(3))?;
 
         if !claim_matches(&pattern_subject, subject) {
             continue;
@@ -175,11 +192,17 @@ pub async fn match_oidc_trust(
                 continue;
             }
         }
-        let scopes = scopes_raw
-            .iter()
-            .map(|s| ApiPermission::from_str(s).expect("unexpected ApiPermission string in DB"))
-            .collect();
-        return Ok(Some((TenantId(tenant_uuid), scopes)));
+        match matched {
+            None => matched = Some((tenant_id, role)),
+            Some((prev_tenant, prev_role)) => {
+                if prev_tenant != tenant_id {
+                    // Ambiguous cross-tenant match: fail closed. Operators must
+                    // disambiguate with tenant-specific audiences.
+                    return Err(DBError::UnauthorizedOidcToken);
+                }
+                matched = Some((tenant_id, prev_role.max(role)));
+            }
+        }
     }
-    Ok(None)
+    Ok(matched)
 }
diff --git a/crates/pipeline-manager/src/db/operations/tenant.rs b/crates/pipeline-manager/src/db/operations/tenant.rs
index b28b4bb4c09..ac797fced7c 100644
--- a/crates/pipeline-manager/src/db/operations/tenant.rs
+++ b/crates/pipeline-manager/src/db/operations/tenant.rs
@@ -1,5 +1,7 @@
 use crate::db::error::DBError;
+use crate::db::operations::utils::maybe_unique_violation;
 use crate::db::types::tenant::TenantId;
+use crate::db::types::user::TenantInfo;
 use deadpool_postgres::Transaction;
 use uuid::Uuid;
 
@@ -11,24 +13,117 @@ pub async fn get_or_create_tenant_id(
     name: String,
     provider: String,
 ) -> Result<TenantId, DBError> {
+    Ok(get_or_create_tenant_id_created(txn, new_id, name, provider)
+        .await?
+        .0)
+}
+
+/// As [`get_or_create_tenant_id`], but also reports whether the tenant was
+/// newly created by this call. The boolean lets the login path grant the very
+/// first principal of a fresh tenant the `admin` role.
+pub async fn get_or_create_tenant_id_created(
+    txn: &Transaction<'_>,
+    new_id: Uuid,
+    name: String,
+    provider: String,
+) -> Result<(TenantId, bool), DBError> {
+    // Atomic get-or-create: a single INSERT ... ON CONFLICT DO NOTHING avoids
+    // the SELECT-then-INSERT race where two concurrent first-logins to a fresh
+    // (name, provider) both miss the SELECT, then one INSERT wins and the other
+    // fails with a unique violation. `inserted` (1 vs 0 rows affected) tells us
+    // whether THIS call created the tenant, which decides the first-member-admin
+    // grant in `resolve_login`. A subsequent SELECT always finds the row.
+    let stmt_insert = txn
+        .prepare_cached(
+            "INSERT INTO tenant (id, tenant, provider) VALUES ($1, $2, $3) \
+             ON CONFLICT (tenant, provider) DO NOTHING",
+        )
+        .await?;
+    let inserted = txn
+        .execute(&stmt_insert, &[&new_id, &name, &provider])
+        .await?;
     let stmt_select = txn
         .prepare_cached("SELECT id FROM tenant WHERE tenant = $1 AND provider = $2")
         .await?;
-    let row = txn.query_opt(&stmt_select, &[&name, &provider]).await?;
-    let id = match row {
-        None => {
-            let stmt_insert = txn
-                .prepare_cached("INSERT INTO tenant (id, tenant, provider) VALUES ($1, $2, $3)")
-                .await?;
-            txn.execute(&stmt_insert, &[&new_id, &name, &provider])
-                .await?;
-            new_id
-        }
-        Some(row) => row.get(0),
-    };
+    let row = txn.query_one(&stmt_select, &[&name, &provider]).await?;
+    Ok((TenantId(row.get(0)), inserted == 1))
+}
+
+/// Strict lookup of a tenant by name only, used for owner cross-tenant
+/// resolution from the `Feldera-Tenant` header. Never creates a tenant; errors
+/// on miss or ambiguity (a name shared across providers cannot be resolved).
+pub async fn get_tenant_id_by_name(txn: &Transaction<'_>, name: &str) -> Result<TenantId, DBError> {
+    let stmt = txn
+        .prepare_cached("SELECT id FROM tenant WHERE tenant = $1")
+        .await?;
+    let rows = txn.query(&stmt, &[&name]).await?;
+    match rows.len() {
+        1 => Ok(TenantId(rows[0].get(0))),
+        _ => Err(DBError::UnknownTenantName {
+            name: name.to_string(),
+        }),
+    }
+}
+
+/// Strict resolution of a `Feldera-Tenant` selector for an owner acting
+/// cross-tenant. A selector that parses as a UUID is resolved by tenant id
+/// (unambiguous); otherwise it is resolved by name. Never creates a tenant;
+/// errors with `UnknownTenantName` (HTTP 404) on miss, so a typo cannot silently
+/// create or cross into the wrong tenant. Tenant names are unique only per
+/// provider, so the UUID form is the robust selector.
+pub async fn resolve_tenant_selector(
+    txn: &Transaction<'_>,
+    selector: &str,
+) -> Result<TenantId, DBError> {
+    if let Ok(uuid) = Uuid::parse_str(selector) {
+        let stmt = txn
+            .prepare_cached("SELECT id FROM tenant WHERE id = $1")
+            .await?;
+        let row = txn.query_opt(&stmt, &[&uuid]).await?;
+        return row
+            .map(|r| TenantId(r.get(0)))
+            .ok_or_else(|| DBError::UnknownTenantName {
+                name: selector.to_string(),
+            });
+    }
+    get_tenant_id_by_name(txn, selector).await
+}
+
+/// Create a tenant, failing with a conflict if `(name, provider)` already
+/// exists. Distinct from the get-or-create login path: the owner-only explicit
+/// create endpoint should report a duplicate rather than silently returning the
+/// existing tenant.
+pub async fn create_tenant(
+    txn: &Transaction<'_>,
+    id: Uuid,
+    name: &str,
+    provider: &str,
+) -> Result<TenantId, DBError> {
+    let stmt = txn
+        .prepare_cached("INSERT INTO tenant (id, tenant, provider) VALUES ($1, $2, $3)")
+        .await?;
+    txn.execute(&stmt, &[&id, &name, &provider])
+        .await
+        .map_err(maybe_unique_violation)?;
     Ok(TenantId(id))
 }
 
+/// Lists all tenants in the installation (platform-wide, owner-only).
+pub async fn list_tenants(txn: &Transaction<'_>) -> Result<Vec<TenantInfo>, DBError> {
+    let stmt = txn
+        .prepare_cached("SELECT id, tenant, provider FROM tenant ORDER BY tenant")
+        .await?;
+    let rows = txn.query(&stmt, &[]).await?;
+    Ok(rows
+        .iter()
+        .map(|row| TenantInfo {
+            id: TenantId(row.get(0)),
+            name: row.get(1),
+            provider: row.get(2),
+        })
+        .collect())
+}
+
 /// Retrieves the tenant name for a given tenant ID.
 pub async fn get_tenant_name(
     txn: &Transaction<'_>,
diff --git a/crates/pipeline-manager/src/db/operations/user.rs b/crates/pipeline-manager/src/db/operations/user.rs
new file mode 100644
index 00000000000..6cd7a6398a3
--- /dev/null
+++ b/crates/pipeline-manager/src/db/operations/user.rs
@@ -0,0 +1,178 @@
+//! User identity and tenant-membership operations for RBAC.
+
+use crate::db::error::DBError;
+use crate::db::operations::tenant::get_or_create_tenant_id_created;
+use crate::db::operations::utils::{
+    maybe_tenant_id_foreign_key_constraint_err, maybe_user_id_foreign_key_constraint_err,
+};
+use crate::db::types::role::Role;
+use crate::db::types::tenant::TenantId;
+use crate::db::types::user::{TenantMember, UserId};
+use deadpool_postgres::Transaction;
+use std::str::FromStr;
+use uuid::Uuid;
+
+fn parse_role(s: &str) -> Result<Role, DBError> {
+    Role::from_str(s).map_err(|_| DBError::InvalidRoleString {
+        value: s.to_string(),
+    })
+}
+
+/// Get the persisted user for an OIDC `(provider, subject)`, creating it if
+/// absent and refreshing the stored email. Returns its identifier.
+pub async fn get_or_create_user(
+    txn: &Transaction<'_>,
+    new_id: Uuid,
+    provider: &str,
+    subject: &str,
+    email: Option<&str>,
+) -> Result<UserId, DBError> {
+    let stmt = txn
+        .prepare_cached(
+            // COALESCE keeps a previously stored email when a later token omits
+            // the claim (some IdPs drop email on refresh-derived access tokens),
+            // rather than overwriting it with NULL.
+            "INSERT INTO app_user (id, provider, subject, email) VALUES ($1, $2, $3, $4) \
+             ON CONFLICT (provider, subject) DO UPDATE SET email = COALESCE(EXCLUDED.email, app_user.email) \
+             RETURNING id",
+        )
+        .await?;
+    let row = txn
+        .query_one(&stmt, &[&new_id, &provider, &subject, &email])
+        .await?;
+    Ok(UserId(row.get(0)))
+}
+
+/// Pre-provision a tenant member by identity: create the user record if it does
+/// not exist yet and set its role. Lets an admin grant access before the user's
+/// first login (the grant is dormant until the identity authenticates through
+/// the IdP into this tenant). Returns the user id.
+pub async fn preprovision_member(
+    txn: &Transaction<'_>,
+    new_user_id: Uuid,
+    tenant_id: TenantId,
+    provider: &str,
+    subject: &str,
+    email: Option<&str>,
+    role: Role,
+) -> Result<UserId, DBError> {
+    let user_id = get_or_create_user(txn, new_user_id, provider, subject, email).await?;
+    upsert_member_role(txn, tenant_id, user_id, role).await?;
+    Ok(user_id)
+}
+
+/// Returns the user's role within a tenant, or `None` if not a member.
+pub async fn get_member_role(
+    txn: &Transaction<'_>,
+    tenant_id: TenantId,
+    user_id: UserId,
+) -> Result<Option<Role>, DBError> {
+    let stmt = txn
+        .prepare_cached("SELECT role FROM tenant_membership WHERE tenant_id = $1 AND user_id = $2")
+        .await?;
+    let row = txn.query_opt(&stmt, &[&tenant_id.0, &user_id.0]).await?;
+    match row {
+        Some(row) => Ok(Some(parse_role(&row.get::<_, String>(0))?)),
+        None => Ok(None),
+    }
+}
+
+/// Inserts or updates a membership row. The role must be `<= admin`
+/// (`owner` is never stored); the caller enforces the cap.
+pub async fn upsert_member_role(
+    txn: &Transaction<'_>,
+    tenant_id: TenantId,
+    user_id: UserId,
+    role: Role,
+) -> Result<(), DBError> {
+    let stmt = txn
+        .prepare_cached(
+            "INSERT INTO tenant_membership (tenant_id, user_id, role) VALUES ($1, $2, $3) \
+             ON CONFLICT (tenant_id, user_id) DO UPDATE SET role = EXCLUDED.role",
+        )
+        .await?;
+    txn.execute(&stmt, &[&tenant_id.0, &user_id.0, &role.as_str()])
+        .await
+        .map_err(DBError::from)
+        .map_err(|e| maybe_tenant_id_foreign_key_constraint_err(e, tenant_id))
+        .map_err(|e| maybe_user_id_foreign_key_constraint_err(e, user_id))?;
+    Ok(())
+}
+
+/// Removes a user from a tenant.
+pub async fn remove_member(
+    txn: &Transaction<'_>,
+    tenant_id: TenantId,
+    user_id: UserId,
+) -> Result<(), DBError> {
+    let stmt = txn
+        .prepare_cached("DELETE FROM tenant_membership WHERE tenant_id = $1 AND user_id = $2")
+        .await?;
+    let res = txn.execute(&stmt, &[&tenant_id.0, &user_id.0]).await?;
+    if res > 0 {
+        Ok(())
+    } else {
+        Err(DBError::UnknownUser {
+            user_id: user_id.to_string(),
+        })
+    }
+}
+
+/// Lists the members of a tenant joined with their identity, for the admin UI.
+pub async fn list_tenant_members(
+    txn: &Transaction<'_>,
+    tenant_id: TenantId,
+) -> Result<Vec<TenantMember>, DBError> {
+    let stmt = txn
+        .prepare_cached(
+            "SELECT u.id, u.provider, u.subject, u.email, m.role \
+             FROM tenant_membership m JOIN app_user u ON u.id = m.user_id \
+             WHERE m.tenant_id = $1 ORDER BY u.email, u.subject",
+        )
+        .await?;
+    let rows = txn.query(&stmt, &[&tenant_id.0]).await?;
+    let mut result = Vec::with_capacity(rows.len());
+    for row in rows {
+        result.push(TenantMember {
+            user_id: UserId(row.get(0)),
+            provider: row.get(1),
+            subject: row.get(2),
+            email: row.get(3),
+            role: parse_role(&row.get::<_, String>(4))?,
+        });
+    }
+    Ok(result)
+}
+
+/// Atomic login resolution for a non-owner principal: resolve (or create) the
+/// acting tenant, ensure the user record, and determine the role. The first
+/// principal of a freshly created tenant becomes its `admin`; an existing
+/// member keeps its stored role; any other principal is admitted at
+/// `default_role` and a membership row is recorded so admins can see and adjust
+/// it. Returns the acting tenant, the user, and the effective role.
+#[allow(clippy::too_many_arguments)]
+pub async fn resolve_login(
+    txn: &Transaction<'_>,
+    new_tenant_id: Uuid,
+    new_user_id: Uuid,
+    tenant_name: String,
+    provider: String,
+    subject: String,
+    email: Option<String>,
+    default_role: Role,
+) -> Result<(TenantId, UserId, Role), DBError> {
+    let (tenant_id, created) =
+        get_or_create_tenant_id_created(txn, new_tenant_id, tenant_name, provider.clone()).await?;
+    let user_id =
+        get_or_create_user(txn, new_user_id, &provider, &subject, email.as_deref()).await?;
+
+    let role = match get_member_role(txn, tenant_id, user_id).await? {
+        Some(role) => role,
+        None => {
+            let role = if created { Role::Admin } else { default_role };
+            upsert_member_role(txn, tenant_id, user_id, role).await?;
+            role
+        }
+    };
+    Ok((tenant_id, user_id, role))
+}
diff --git a/crates/pipeline-manager/src/db/operations/utils.rs b/crates/pipeline-manager/src/db/operations/utils.rs
index 1400516398f..0c2c7a824a9 100644
--- a/crates/pipeline-manager/src/db/operations/utils.rs
+++ b/crates/pipeline-manager/src/db/operations/utils.rs
@@ -1,5 +1,6 @@
 use crate::db::error::DBError;
 use crate::db::types::tenant::TenantId;
+use crate::db::types::user::UserId;
 use tokio_postgres::error::Error as PgError;
 
 /// Converts the Postgres error into our `DBError`.
@@ -54,3 +55,23 @@ pub(crate) fn maybe_tenant_id_foreign_key_constraint_err(
     }
     err
 }
+
+/// Maps a foreign-key violation on a `*user_id_fkey` constraint to a clear
+/// `UnknownUser`, so assigning a role to a nonexistent user id yields 404
+/// rather than a raw 500. Other errors pass through unchanged.
+pub(crate) fn maybe_user_id_foreign_key_constraint_err(err: DBError, user_id: UserId) -> DBError {
+    if let DBError::PostgresError { error, .. } = &err {
+        if let Some(db_err) = error.as_db_error() {
+            if db_err.code() == &tokio_postgres::error::SqlState::FOREIGN_KEY_VIOLATION {
+                if let Some(constraint_name) = db_err.constraint() {
+                    if constraint_name.ends_with("user_id_fkey") {
+                        return DBError::UnknownUser {
+                            user_id: user_id.to_string(),
+                        };
+                    }
+                }
+            }
+        }
+    }
+    err
+}
diff --git a/crates/pipeline-manager/src/db/storage.rs b/crates/pipeline-manager/src/db/storage.rs
index a92607f7ce5..fb06ed187a4 100644
--- a/crates/pipeline-manager/src/db/storage.rs
+++ b/crates/pipeline-manager/src/db/storage.rs
@@ -1,6 +1,6 @@
 use crate::api::support_data_collector::SupportBundleData;
 use crate::db::error::DBError;
-use crate::db::types::api_key::{ApiKeyDescr, ApiPermission};
+use crate::db::types::api_key::ApiKeyDescr;
 use crate::db::types::monitor::{
     ClusterMonitorEvent, ClusterMonitorEventId, ExtendedClusterMonitorEvent,
     ExtendedPipelineMonitorEvent, NewClusterMonitorEvent, PipelineMonitorEvent,
@@ -12,7 +12,9 @@ use crate::db::types::pipeline::{
     PipelineId,
 };
 use crate::db::types::program::{RustCompilationInfo, SqlCompilationInfo};
+use crate::db::types::role::{MintableKeyRole, Role};
 use crate::db::types::tenant::TenantId;
+use crate::db::types::user::{TenantInfo, TenantMember, UserId};
 use crate::db::types::version::Version;
 use async_trait::async_trait;
 use feldera_types::error::ErrorResponse;
@@ -92,6 +94,77 @@ pub(crate) trait Storage {
     /// Retrieves the tenant name for a given tenant ID.
     async fn get_tenant_name(&self, tenant_id: TenantId) -> Result<String, DBError>;
 
+    /// Strict resolution of a `Feldera-Tenant` selector (a tenant UUID or name)
+    /// for an owner acting cross-tenant. Never creates a tenant; errors (HTTP
+    /// 404) on miss. See
+    /// [`crate::db::operations::tenant::resolve_tenant_selector`].
+    async fn resolve_tenant_selector(&self, selector: &str) -> Result<TenantId, DBError>;
+
+    /// Creates a tenant, failing with a conflict (HTTP 409) if `(name, provider)`
+    /// already exists. Used by the owner-only explicit-create endpoint.
+    async fn create_tenant(
+        &self,
+        id: Uuid,
+        name: &str,
+        provider: &str,
+    ) -> Result<TenantId, DBError>;
+
+    /// Lists all tenants in the installation (owner-only platform view).
+    async fn list_tenants(&self) -> Result<Vec<TenantInfo>, DBError>;
+
+    /// Resolves a non-owner login to its acting tenant and effective role,
+    /// ensuring the user and membership records exist. See
+    /// [`crate::db::operations::user::resolve_login`].
+    #[allow(clippy::too_many_arguments)]
+    async fn resolve_login(
+        &self,
+        new_tenant_id: Uuid,
+        new_user_id: Uuid,
+        tenant_name: String,
+        provider: String,
+        subject: String,
+        email: Option<String>,
+        default_role: Role,
+    ) -> Result<(TenantId, UserId, Role), DBError>;
+
+    /// Ensures a user record exists for an OIDC `(provider, subject)`.
+    #[allow(dead_code)] // Provided for completeness; logins go through `resolve_login`.
+    async fn get_or_create_user(
+        &self,
+        new_id: Uuid,
+        provider: &str,
+        subject: &str,
+        email: Option<&str>,
+    ) -> Result<UserId, DBError>;
+
+    /// Lists the members of a tenant with their roles.
+    async fn list_tenant_members(&self, tenant_id: TenantId) -> Result<Vec<TenantMember>, DBError>;
+
+    /// Assigns or updates a member's role within a tenant.
+    async fn upsert_member_role(
+        &self,
+        tenant_id: TenantId,
+        user_id: UserId,
+        role: Role,
+    ) -> Result<(), DBError>;
+
+    /// Pre-provisions a tenant member by identity `(provider, subject)`: ensures
+    /// the user record exists and assigns the role, so an admin can grant access
+    /// before the user's first login. Returns the user id.
+    #[allow(clippy::too_many_arguments)]
+    async fn preprovision_member(
+        &self,
+        new_user_id: Uuid,
+        tenant_id: TenantId,
+        provider: &str,
+        subject: &str,
+        email: Option<&str>,
+        role: Role,
+    ) -> Result<UserId, DBError>;
+
+    /// Removes a user from a tenant.
+    async fn remove_member(&self, tenant_id: TenantId, user_id: UserId) -> Result<(), DBError>;
+
     /// Retrieves the list of all API keys.
     async fn list_api_keys(&self, tenant_id: TenantId) -> Result<Vec<ApiKeyDescr>, DBError>;
 
@@ -101,19 +174,21 @@ pub(crate) trait Storage {
     /// Deletes an API key by name.
     async fn delete_api_key(&self, tenant_id: TenantId, name: &str) -> Result<(), DBError>;
 
-    /// Persists an SHA-256 hash of an API key in the database.
+    /// Persists an SHA-256 hash of an API key in the database. The role is a
+    /// [`MintableKeyRole`] (read/write only), so `admin`/`owner` cannot be
+    /// persisted as a static key by construction.
     async fn store_api_key_hash(
         &self,
         tenant_id: TenantId,
         id: Uuid,
         name: &str,
         key: &str,
-        permissions: Vec<ApiPermission>,
+        role: MintableKeyRole,
     ) -> Result<(), DBError>;
 
     /// Validates an API key against the database by comparing its SHA-256 hash
     /// against the stored value.
-    async fn validate_api_key(&self, key: &str) -> Result<(TenantId, Vec<ApiPermission>), DBError>;
+    async fn validate_api_key(&self, key: &str) -> Result<(TenantId, Role), DBError>;
 
     /// Lists all OIDC trust relationships for the tenant.
     async fn list_oidc_trust(&self, tenant_id: TenantId) -> Result<Vec<OidcTrustDescr>, DBError>;
@@ -139,17 +214,23 @@ pub(crate) trait Storage {
         issuer: &str,
         subject: &str,
         audience: Option<&str>,
-        scopes: Vec<ApiPermission>,
+        role: Role,
     ) -> Result<(), DBError>;
 
-    /// Finds the first trust relationship matching the given issuer + claims.
-    /// Returns the owning tenant and scopes if a match is found.
+    /// Cheap indexed check that an issuer is named by at least one trust
+    /// relationship. Called before any OIDC discovery/JWKS fetch so an
+    /// unregistered issuer never triggers an outbound request (SSRF/DoS gate).
+    async fn is_trusted_issuer(&self, issuer: &str) -> Result<bool, DBError>;
+
+    /// Resolves a federated token to the tenant and role it is authorized for.
+    /// Returns `None` if no trust matches; errors if the match is ambiguous
+    /// across tenants (see [`crate::db::operations::oidc_trust::match_oidc_trust`]).
     async fn match_oidc_trust(
         &self,
         issuer: &str,
         subject: &str,
         audiences: &[String],
-    ) -> Result<Option<(TenantId, Vec<ApiPermission>)>, DBError>;
+    ) -> Result<Option<(TenantId, Role)>, DBError>;
 
     /// Retrieves a list of pipelines as extended descriptors.
     async fn list_pipelines(
diff --git a/crates/pipeline-manager/src/db/storage_postgres.rs b/crates/pipeline-manager/src/db/storage_postgres.rs
index e154e20b628..02a8e5137ad 100644
--- a/crates/pipeline-manager/src/db/storage_postgres.rs
+++ b/crates/pipeline-manager/src/db/storage_postgres.rs
@@ -6,7 +6,7 @@ use crate::db::operations;
 #[cfg(feature = "postgresql_embedded")]
 use crate::db::pg_setup;
 use crate::db::storage::{ExtendedPipelineDescrRunner, Storage};
-use crate::db::types::api_key::{ApiKeyDescr, ApiPermission};
+use crate::db::types::api_key::ApiKeyDescr;
 use crate::db::types::monitor::{
     ClusterMonitorEvent, ClusterMonitorEventId, ExtendedClusterMonitorEvent,
     ExtendedPipelineMonitorEvent, NewClusterMonitorEvent, PipelineMonitorEvent,
@@ -21,8 +21,10 @@ use crate::db::types::program::{
     ProgramConfig, ProgramInfo, ProgramStatus, RustCompilationInfo, SqlCompilationInfo,
 };
 use crate::db::types::resources_status::{ResourcesDesiredStatus, ResourcesStatus};
+use crate::db::types::role::{MintableKeyRole, Role};
 use crate::db::types::storage::StorageStatus;
 use crate::db::types::tenant::TenantId;
+use crate::db::types::user::{TenantInfo, TenantMember, UserId};
 use crate::db::types::version::Version;
 use crate::is_supported_runtime;
 use crate::{auth::TenantRecord, config::DatabaseConfig};
@@ -115,6 +117,132 @@ impl Storage for StoragePostgres {
         Ok(tenant_name)
     }
 
+    async fn resolve_tenant_selector(&self, selector: &str) -> Result<TenantId, DBError> {
+        let mut client = self.pool.get().await?;
+        let txn = client.transaction().await?;
+        let result = operations::tenant::resolve_tenant_selector(&txn, selector).await?;
+        txn.commit().await?;
+        Ok(result)
+    }
+
+    async fn create_tenant(
+        &self,
+        id: Uuid,
+        name: &str,
+        provider: &str,
+    ) -> Result<TenantId, DBError> {
+        let mut client = self.pool.get().await?;
+        let txn = client.transaction().await?;
+        let result = operations::tenant::create_tenant(&txn, id, name, provider).await?;
+        txn.commit().await?;
+        Ok(result)
+    }
+
+    async fn list_tenants(&self) -> Result<Vec<TenantInfo>, DBError> {
+        let mut client = self.pool.get().await?;
+        let txn = client.transaction().await?;
+        let result = operations::tenant::list_tenants(&txn).await?;
+        txn.commit().await?;
+        Ok(result)
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    async fn resolve_login(
+        &self,
+        new_tenant_id: Uuid,
+        new_user_id: Uuid,
+        tenant_name: String,
+        provider: String,
+        subject: String,
+        email: Option<String>,
+        default_role: Role,
+    ) -> Result<(TenantId, UserId, Role), DBError> {
+        let mut client = self.pool.get().await?;
+        let txn = client.transaction().await?;
+        let result = operations::user::resolve_login(
+            &txn,
+            new_tenant_id,
+            new_user_id,
+            tenant_name,
+            provider,
+            subject,
+            email,
+            default_role,
+        )
+        .await?;
+        txn.commit().await?;
+        Ok(result)
+    }
+
+    async fn get_or_create_user(
+        &self,
+        new_id: Uuid,
+        provider: &str,
+        subject: &str,
+        email: Option<&str>,
+    ) -> Result<UserId, DBError> {
+        let mut client = self.pool.get().await?;
+        let txn = client.transaction().await?;
+        let result =
+            operations::user::get_or_create_user(&txn, new_id, provider, subject, email).await?;
+        txn.commit().await?;
+        Ok(result)
+    }
+
+    async fn list_tenant_members(&self, tenant_id: TenantId) -> Result<Vec<TenantMember>, DBError> {
+        let mut client = self.pool.get().await?;
+        let txn = client.transaction().await?;
+        let result = operations::user::list_tenant_members(&txn, tenant_id).await?;
+        txn.commit().await?;
+        Ok(result)
+    }
+
+    async fn upsert_member_role(
+        &self,
+        tenant_id: TenantId,
+        user_id: UserId,
+        role: Role,
+    ) -> Result<(), DBError> {
+        let mut client = self.pool.get().await?;
+        let txn = client.transaction().await?;
+        operations::user::upsert_member_role(&txn, tenant_id, user_id, role).await?;
+        txn.commit().await?;
+        Ok(())
+    }
+
+    async fn preprovision_member(
+        &self,
+        new_user_id: Uuid,
+        tenant_id: TenantId,
+        provider: &str,
+        subject: &str,
+        email: Option<&str>,
+        role: Role,
+    ) -> Result<UserId, DBError> {
+        let mut client = self.pool.get().await?;
+        let txn = client.transaction().await?;
+        let result = operations::user::preprovision_member(
+            &txn,
+            new_user_id,
+            tenant_id,
+            provider,
+            subject,
+            email,
+            role,
+        )
+        .await?;
+        txn.commit().await?;
+        Ok(result)
+    }
+
+    async fn remove_member(&self, tenant_id: TenantId, user_id: UserId) -> Result<(), DBError> {
+        let mut client = self.pool.get().await?;
+        let txn = client.transaction().await?;
+        operations::user::remove_member(&txn, tenant_id, user_id).await?;
+        txn.commit().await?;
+        Ok(())
+    }
+
     async fn list_api_keys(&self, tenant_id: TenantId) -> Result<Vec<ApiKeyDescr>, DBError> {
         let mut client = self.pool.get().await?;
         let txn = client.transaction().await?;
@@ -145,18 +273,17 @@ impl Storage for StoragePostgres {
         id: Uuid,
         name: &str,
         key: &str,
-        permissions: Vec<ApiPermission>,
+        role: MintableKeyRole,
     ) -> Result<(), DBError> {
         let mut client = self.pool.get().await?;
         let txn = client.transaction().await?;
         let result =
-            operations::api_key::store_api_key_hash(&txn, tenant_id, id, name, key, permissions)
-                .await?;
+            operations::api_key::store_api_key_hash(&txn, tenant_id, id, name, key, role).await?;
         txn.commit().await?;
         Ok(result)
     }
 
-    async fn validate_api_key(&self, key: &str) -> Result<(TenantId, Vec<ApiPermission>), DBError> {
+    async fn validate_api_key(&self, key: &str) -> Result<(TenantId, Role), DBError> {
         let mut client = self.pool.get().await?;
         let txn = client.transaction().await?;
         let result = operations::api_key::validate_api_key(&txn, key).await?;
@@ -201,7 +328,7 @@ impl Storage for StoragePostgres {
         issuer: &str,
         subject: &str,
         audience: Option<&str>,
-        scopes: Vec<ApiPermission>,
+        role: Role,
     ) -> Result<(), DBError> {
         let mut client = self.pool.get().await?;
         let txn = client.transaction().await?;
@@ -214,19 +341,27 @@ impl Storage for StoragePostgres {
             issuer,
             subject,
             audience,
-            &scopes,
+            role,
         )
         .await?;
         txn.commit().await?;
         Ok(())
     }
 
+    async fn is_trusted_issuer(&self, issuer: &str) -> Result<bool, DBError> {
+        let mut client = self.pool.get().await?;
+        let txn = client.transaction().await?;
+        let result = operations::oidc_trust::is_trusted_issuer(&txn, issuer).await?;
+        txn.commit().await?;
+        Ok(result)
+    }
+
     async fn match_oidc_trust(
         &self,
         issuer: &str,
         subject: &str,
         audiences: &[String],
-    ) -> Result<Option<(TenantId, Vec<ApiPermission>)>, DBError> {
+    ) -> Result<Option<(TenantId, Role)>, DBError> {
         let mut client = self.pool.get().await?;
         let txn = client.transaction().await?;
         let result =
diff --git a/crates/pipeline-manager/src/db/test.rs b/crates/pipeline-manager/src/db/test.rs
index 9f2f12ccff5..905dc7910f8 100644
--- a/crates/pipeline-manager/src/db/test.rs
+++ b/crates/pipeline-manager/src/db/test.rs
@@ -5,7 +5,7 @@ use crate::db::error::DBError::InvalidResourcesStatusNotRemain;
 use crate::db::operations::pipeline::get_pipeline_by_id_for_monitoring;
 use crate::db::storage::{ExtendedPipelineDescrRunner, Storage};
 use crate::db::storage_postgres::{is_pipeline_assigned_to_worker, StoragePostgres};
-use crate::db::types::api_key::{ApiKeyDescr, ApiKeyId, ApiPermission};
+use crate::db::types::api_key::{ApiKeyDescr, ApiKeyId};
 use crate::db::types::monitor::{
     ClusterMonitorEvent, ClusterMonitorEventId, ExtendedClusterMonitorEvent,
     ExtendedPipelineMonitorEvent, MonitorStatus, NewClusterMonitorEvent, PipelineMonitorEvent,
@@ -24,8 +24,10 @@ use crate::db::types::resources_status::{
     validate_resources_desired_status_transition, validate_resources_status_transition,
     ResourcesDesiredStatus, ResourcesStatus,
 };
+use crate::db::types::role::{MintableKeyRole, Role};
 use crate::db::types::storage::{validate_storage_status_transition, StorageStatus};
 use crate::db::types::tenant::TenantId;
+use crate::db::types::user::{TenantInfo, TenantMember, UserId};
 use crate::db::types::utils::{
     validate_api_key_name, validate_deployment_config, validate_pipeline_name,
     validate_program_config, validate_program_info, validate_runtime_config,
@@ -743,14 +745,13 @@ async fn api_key_store_and_validation() {
                 Uuid::now_v7(),
                 api_key_name,
                 &api_key,
-                vec![ApiPermission::Read, ApiPermission::Write],
+                MintableKeyRole::Write,
             )
             .await
             .unwrap();
-        let scopes = handle.db.validate_api_key(&api_key).await.unwrap();
-        assert_eq!(tenant_id, scopes.0);
-        assert_eq!(&ApiPermission::Read, scopes.1.first().unwrap());
-        assert_eq!(&ApiPermission::Write, scopes.1.get(1).unwrap());
+        let validated = handle.db.validate_api_key(&api_key).await.unwrap();
+        assert_eq!(tenant_id, validated.0);
+        assert_eq!(Role::Write, validated.1);
 
         // Delete API key
         handle
@@ -777,6 +778,287 @@ async fn api_key_store_and_validation() {
     }
 }
 
+/// RBAC login resolution and membership: the first principal of a fresh tenant
+/// becomes its admin, later principals default to read, roles are editable and
+/// removable, and strict tenant lookup works.
+#[tokio::test]
+async fn rbac_login_resolution_and_membership() {
+    let handle = test_setup().await;
+    let provider = "https://idp.example".to_string();
+
+    // First login into a fresh tenant: the creator becomes admin.
+    let (tenant, alice, role) = handle
+        .db
+        .resolve_login(
+            Uuid::now_v7(),
+            Uuid::now_v7(),
+            "acme".to_string(),
+            provider.clone(),
+            "alice".to_string(),
+            Some("alice@acme.test".to_string()),
+            Role::Read,
+        )
+        .await
+        .unwrap();
+    assert_eq!(role, Role::Admin);
+
+    // Second login into the existing tenant defaults to read.
+    let (tenant2, bob, role) = handle
+        .db
+        .resolve_login(
+            Uuid::now_v7(),
+            Uuid::now_v7(),
+            "acme".to_string(),
+            provider.clone(),
+            "bob".to_string(),
+            Some("bob@acme.test".to_string()),
+            Role::Read,
+        )
+        .await
+        .unwrap();
+    assert_eq!(tenant2, tenant);
+    assert_eq!(role, Role::Read);
+
+    // A repeat login keeps the stored role (idempotent, not re-defaulted).
+    let (_, alice_again, role) = handle
+        .db
+        .resolve_login(
+            Uuid::now_v7(),
+            Uuid::now_v7(),
+            "acme".to_string(),
+            provider.clone(),
+            "alice".to_string(),
+            None,
+            Role::Read,
+        )
+        .await
+        .unwrap();
+    assert_eq!(alice_again, alice);
+    assert_eq!(role, Role::Admin);
+
+    // Membership listing reflects both users and their roles.
+    let role_of = |members: &[crate::db::types::user::TenantMember], uid: UserId| {
+        members.iter().find(|m| m.user_id == uid).map(|m| m.role)
+    };
+    let members = handle.db.list_tenant_members(tenant).await.unwrap();
+    assert_eq!(members.len(), 2);
+    assert_eq!(role_of(&members, alice), Some(Role::Admin));
+    assert_eq!(role_of(&members, bob), Some(Role::Read));
+
+    // An admin can change bob's role to write.
+    handle
+        .db
+        .upsert_member_role(tenant, bob, Role::Write)
+        .await
+        .unwrap();
+    let members = handle.db.list_tenant_members(tenant).await.unwrap();
+    assert_eq!(role_of(&members, bob), Some(Role::Write));
+
+    // Strict tenant selector resolves by name and by UUID, and rejects misses.
+    assert_eq!(
+        handle.db.resolve_tenant_selector("acme").await.unwrap(),
+        tenant
+    );
+    assert_eq!(
+        handle
+            .db
+            .resolve_tenant_selector(&tenant.0.to_string())
+            .await
+            .unwrap(),
+        tenant
+    );
+    assert!(matches!(
+        handle.db.resolve_tenant_selector("nope").await.unwrap_err(),
+        DBError::UnknownTenantName { .. }
+    ));
+
+    // Removal drops the membership.
+    handle.db.remove_member(tenant, bob).await.unwrap();
+    assert_eq!(
+        handle.db.list_tenant_members(tenant).await.unwrap().len(),
+        1
+    );
+}
+
+/// Federated-token resolution: the issuer gate rejects unregistered issuers
+/// before any fetch, the audience disambiguates between tenants trusting the
+/// same identity, and an ambiguous cross-tenant match fails closed.
+#[tokio::test]
+async fn oidc_trust_matching_and_issuer_gate() {
+    let handle = test_setup().await;
+    let iss = "https://oidc.example";
+
+    let mk_tenant = |name: &'static str| {
+        let db = &handle.db;
+        async move {
+            db.resolve_login(
+                Uuid::now_v7(),
+                Uuid::now_v7(),
+                name.to_string(),
+                "prov".to_string(),
+                format!("admin-{name}"),
+                None,
+                Role::Read,
+            )
+            .await
+            .unwrap()
+            .0
+        }
+    };
+    let tenant_a = mk_tenant("a").await;
+    let tenant_b = mk_tenant("b").await;
+
+    // Unregistered issuer: gate is closed and no trust matches.
+    assert!(!handle.db.is_trusted_issuer(iss).await.unwrap());
+    assert!(handle
+        .db
+        .match_oidc_trust(iss, "system:sa:app", &["a".to_string()])
+        .await
+        .unwrap()
+        .is_none());
+
+    // Two tenants trust the same issuer+subject, disambiguated by audience.
+    let sub = "system:sa:app";
+    handle
+        .db
+        .create_oidc_trust(
+            tenant_a,
+            Uuid::now_v7(),
+            "ta",
+            None,
+            iss,
+            sub,
+            Some("a"),
+            Role::Write,
+        )
+        .await
+        .unwrap();
+    handle
+        .db
+        .create_oidc_trust(
+            tenant_b,
+            Uuid::now_v7(),
+            "tb",
+            None,
+            iss,
+            sub,
+            Some("b"),
+            Role::Write,
+        )
+        .await
+        .unwrap();
+
+    assert!(handle.db.is_trusted_issuer(iss).await.unwrap());
+    assert_eq!(
+        handle
+            .db
+            .match_oidc_trust(iss, sub, &["a".to_string()])
+            .await
+            .unwrap(),
+        Some((tenant_a, Role::Write))
+    );
+    assert_eq!(
+        handle
+            .db
+            .match_oidc_trust(iss, sub, &["b".to_string()])
+            .await
+            .unwrap(),
+        Some((tenant_b, Role::Write))
+    );
+    // A token whose audience matches neither trust does not resolve.
+    assert!(handle
+        .db
+        .match_oidc_trust(iss, sub, &["c".to_string()])
+        .await
+        .unwrap()
+        .is_none());
+
+    // A third tenant trusts the same issuer+subject with NO audience, so it
+    // matches any token. A token now resolves to two distinct tenants: the
+    // match is ambiguous and fails closed rather than picking one arbitrarily.
+    let tenant_c = mk_tenant("c").await;
+    handle
+        .db
+        .create_oidc_trust(
+            tenant_c,
+            Uuid::now_v7(),
+            "tc",
+            None,
+            iss,
+            sub,
+            None,
+            Role::Read,
+        )
+        .await
+        .unwrap();
+    assert!(matches!(
+        handle
+            .db
+            .match_oidc_trust(iss, sub, &["a".to_string()])
+            .await
+            .unwrap_err(),
+        DBError::UnauthorizedOidcToken
+    ));
+}
+
+/// Pre-provisioning: an admin grants a role by identity before first login; the
+/// grant appears in the member list and survives the user's first login instead
+/// of being overwritten by the default role.
+#[tokio::test]
+async fn preprovision_member_survives_first_login() {
+    let handle = test_setup().await;
+    let (tenant, _admin, _) = handle
+        .db
+        .resolve_login(
+            Uuid::now_v7(),
+            Uuid::now_v7(),
+            "acme".to_string(),
+            "prov".to_string(),
+            "admin".to_string(),
+            None,
+            Role::Read,
+        )
+        .await
+        .unwrap();
+
+    // Grant write to carol before she has ever logged in.
+    let carol = handle
+        .db
+        .preprovision_member(
+            Uuid::now_v7(),
+            tenant,
+            "prov",
+            "carol",
+            Some("carol@acme.test"),
+            Role::Write,
+        )
+        .await
+        .unwrap();
+    let members = handle.db.list_tenant_members(tenant).await.unwrap();
+    assert_eq!(
+        members.iter().find(|m| m.user_id == carol).map(|m| m.role),
+        Some(Role::Write)
+    );
+
+    // Carol's first login keeps the pre-provisioned write role (not defaulted).
+    let (login_tenant, login_user, role) = handle
+        .db
+        .resolve_login(
+            Uuid::now_v7(),
+            Uuid::now_v7(),
+            "acme".to_string(),
+            "prov".to_string(),
+            "carol".to_string(),
+            Some("carol@acme.test".to_string()),
+            Role::Read,
+        )
+        .await
+        .unwrap();
+    assert_eq!(login_tenant, tenant);
+    assert_eq!(login_user, carol);
+    assert_eq!(role, Role::Write);
+}
+
 /// Creation of pipelines.
 #[tokio::test]
 async fn pipeline_creation() {
@@ -3156,7 +3438,7 @@ enum StorageAction {
         #[proptest(strategy = "limited_uuid()")] Uuid,
         String,
         String,
-        Vec<ApiPermission>,
+        MintableKeyRole,
     ),
     ValidateApiKey(TenantId, String),
     // Pipelines
@@ -3873,8 +4155,8 @@ fn db_impl_behaves_like_model() {
                             },
                             StorageAction::StoreApiKeyHash(tenant_id, id, name, key, permissions) => {
                                 create_tenants_if_not_exists(&model, &handle, tenant_id).await.unwrap();
-                                let model_response = model.store_api_key_hash(tenant_id, id, &name, &key, permissions.clone()).await;
-                                let impl_response = handle.db.store_api_key_hash(tenant_id, id, &name, &key, permissions.clone()).await;
+                                let model_response = model.store_api_key_hash(tenant_id, id, &name, &key, permissions).await;
+                                let impl_response = handle.db.store_api_key_hash(tenant_id, id, &name, &key, permissions).await;
                                 check_responses(i, model_response, impl_response);
                             },
                             StorageAction::ValidateApiKey(tenant_id,key) => {
@@ -4208,7 +4490,7 @@ fn db_impl_behaves_like_model() {
 #[derive(Debug)]
 struct DbModel {
     pub tenants: BTreeMap<TenantId, TenantRecord>,
-    pub api_keys: BTreeMap<(TenantId, String), (ApiKeyId, String, Vec<ApiPermission>)>,
+    pub api_keys: BTreeMap<(TenantId, String), (ApiKeyId, String, Role)>,
     pub pipelines: BTreeMap<(TenantId, PipelineId), ExtendedPipelineDescr>,
     pub pipeline_events: BTreeMap<(TenantId, PipelineId), Vec<ExtendedPipelineMonitorEvent>>,
     pub cluster_events: BTreeMap<ClusterMonitorEventId, ExtendedClusterMonitorEvent>,
@@ -4681,6 +4963,10 @@ impl Storage for Mutex<DbModel> {
         panic!("For model-based tests, we generate the TenantID using proptest, as opposed to generating a claim that we then get or create an ID for");
     }
 
+    async fn create_tenant(&self, id: Uuid, _name: &str, _provider: &str) -> DBResult<TenantId> {
+        Ok(TenantId(id))
+    }
+
     async fn get_tenant_name(&self, tenant_id: TenantId) -> Result<String, DBError> {
         let s = self.lock().await;
         s.tenants
@@ -4697,7 +4983,7 @@ impl Storage for Mutex<DbModel> {
             .map(|k| ApiKeyDescr {
                 id: k.1 .0,
                 name: k.0 .1.clone(),
-                scopes: k.1 .2.clone(),
+                role: k.1 .2,
             })
             .collect())
     }
@@ -4712,7 +4998,7 @@ impl Storage for Mutex<DbModel> {
                 Ok(ApiKeyDescr {
                     id: k.0,
                     name: name.to_string(),
-                    scopes: k.2.clone(),
+                    role: k.2,
                 })
             },
         )
@@ -4734,7 +5020,7 @@ impl Storage for Mutex<DbModel> {
         id: Uuid,
         name: &str,
         key: &str,
-        permissions: Vec<ApiPermission>,
+        role: MintableKeyRole,
     ) -> DBResult<()> {
         let mut s = self.lock().await;
         validate_api_key_name(name)?;
@@ -4752,26 +5038,25 @@ impl Storage for Mutex<DbModel> {
         }
         s.api_keys.insert(
             (tenant_id, name.to_string()),
-            (ApiKeyId(id), hash, permissions),
+            (ApiKeyId(id), hash, role.role()),
         );
         Ok(())
     }
 
-    async fn validate_api_key(&self, key: &str) -> DBResult<(TenantId, Vec<ApiPermission>)> {
+    async fn validate_api_key(&self, key: &str) -> DBResult<(TenantId, Role)> {
         let s = self.lock().await;
         let mut hasher = sha::Sha256::new();
         hasher.update(key.as_bytes());
         let hash = openssl::base64::encode_block(&hasher.finish());
-        let record: Vec<(TenantId, Vec<ApiPermission>)> = s
+        let record: Vec<(TenantId, Role)> = s
             .api_keys
             .iter()
             .filter(|k| k.1 .1 == hash)
-            .map(|k| (k.0 .0, k.1 .2.clone()))
+            .map(|k| (k.0 .0, k.1 .2))
             .collect();
         assert!(record.len() <= 1);
-        let record = record.first();
-        match record {
-            Some(record) => Ok((record.0, record.1.clone())),
+        match record.first() {
+            Some(record) => Ok((record.0, record.1)),
             None => Err(DBError::InvalidApiKey),
         }
     }
@@ -4809,20 +5094,102 @@ impl Storage for Mutex<DbModel> {
         _issuer: &str,
         _subject: &str,
         _audience: Option<&str>,
-        _scopes: Vec<ApiPermission>,
+        _role: Role,
     ) -> DBResult<()> {
         Ok(())
     }
 
+    async fn is_trusted_issuer(&self, _issuer: &str) -> DBResult<bool> {
+        Ok(false)
+    }
+
     async fn match_oidc_trust(
         &self,
         _issuer: &str,
         _subject: &str,
         _audiences: &[String],
-    ) -> DBResult<Option<(TenantId, Vec<ApiPermission>)>> {
+    ) -> DBResult<Option<(TenantId, Role)>> {
         Ok(None)
     }
 
+    // RBAC user/membership methods are not exercised by the proptest model.
+    async fn resolve_tenant_selector(&self, selector: &str) -> DBResult<TenantId> {
+        let s = self.lock().await;
+        if let Ok(uuid) = Uuid::parse_str(selector) {
+            return s.tenants.keys().find(|id| id.0 == uuid).copied().ok_or(
+                DBError::UnknownTenantName {
+                    name: selector.to_string(),
+                },
+            );
+        }
+        s.tenants
+            .iter()
+            .find(|(_, t)| t.tenant == selector)
+            .map(|(id, _)| *id)
+            .ok_or(DBError::UnknownTenantName {
+                name: selector.to_string(),
+            })
+    }
+
+    async fn list_tenants(&self) -> DBResult<Vec<TenantInfo>> {
+        Ok(vec![])
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    async fn resolve_login(
+        &self,
+        _new_tenant_id: Uuid,
+        _new_user_id: Uuid,
+        _tenant_name: String,
+        _provider: String,
+        _subject: String,
+        _email: Option<String>,
+        default_role: Role,
+    ) -> DBResult<(TenantId, UserId, Role)> {
+        Ok((TenantId(Uuid::nil()), UserId(Uuid::nil()), default_role))
+    }
+
+    async fn get_or_create_user(
+        &self,
+        new_id: Uuid,
+        _provider: &str,
+        _subject: &str,
+        _email: Option<&str>,
+    ) -> DBResult<UserId> {
+        Ok(UserId(new_id))
+    }
+
+    async fn list_tenant_members(&self, _tenant_id: TenantId) -> DBResult<Vec<TenantMember>> {
+        Ok(vec![])
+    }
+
+    async fn upsert_member_role(
+        &self,
+        _tenant_id: TenantId,
+        _user_id: UserId,
+        _role: Role,
+    ) -> DBResult<()> {
+        Ok(())
+    }
+
+    async fn remove_member(&self, _tenant_id: TenantId, user_id: UserId) -> DBResult<()> {
+        Err(DBError::UnknownUser {
+            user_id: user_id.to_string(),
+        })
+    }
+
+    async fn preprovision_member(
+        &self,
+        new_user_id: Uuid,
+        _tenant_id: TenantId,
+        _provider: &str,
+        _subject: &str,
+        _email: Option<&str>,
+        _role: Role,
+    ) -> DBResult<UserId> {
+        Ok(UserId(new_user_id))
+    }
+
     async fn list_pipelines(
         &self,
         tenant_id: TenantId,
diff --git a/crates/pipeline-manager/src/db/types.rs b/crates/pipeline-manager/src/db/types.rs
index cac2e20f563..4fa85889e64 100644
--- a/crates/pipeline-manager/src/db/types.rs
+++ b/crates/pipeline-manager/src/db/types.rs
@@ -8,7 +8,9 @@ pub mod oidc_trust;
 pub mod pipeline;
 pub mod program;
 pub mod resources_status;
+pub mod role;
 pub mod storage;
 pub mod tenant;
+pub mod user;
 pub mod utils;
 pub mod version;
diff --git a/crates/pipeline-manager/src/db/types/api_key.rs b/crates/pipeline-manager/src/db/types/api_key.rs
index c8a76e47071..f3374d13a0f 100644
--- a/crates/pipeline-manager/src/db/types/api_key.rs
+++ b/crates/pipeline-manager/src/db/types/api_key.rs
@@ -1,7 +1,7 @@
+use crate::db::types::role::Role;
 use serde::{Deserialize, Serialize};
 use std::fmt;
 use std::fmt::Display;
-use std::str::FromStr;
 use utoipa::ToSchema;
 use uuid::Uuid;
 
@@ -19,33 +19,13 @@ impl Display for ApiKeyId {
     }
 }
 
-/// Permission types for invoking API endpoints.
-#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, ToSchema)]
-#[cfg_attr(test, derive(proptest_derive::Arbitrary))]
-pub enum ApiPermission {
-    Read,
-    Write,
-}
-
-pub const API_PERMISSION_READ: &str = "read";
-pub const API_PERMISSION_WRITE: &str = "write";
-
-impl FromStr for ApiPermission {
-    type Err = ();
-
-    fn from_str(input: &str) -> Result<ApiPermission, Self::Err> {
-        match input {
-            API_PERMISSION_READ => Ok(ApiPermission::Read),
-            API_PERMISSION_WRITE => Ok(ApiPermission::Write),
-            _ => Err(()),
-        }
-    }
-}
-
 /// API key descriptor.
+///
+/// A key carries a single [`Role`], capped at `write`: `admin` and `owner` are
+/// never issuable as static keys (see [`crate::db::types::role::MintableKeyRole`]).
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, ToSchema)]
 pub struct ApiKeyDescr {
     pub id: ApiKeyId,
     pub name: String,
-    pub scopes: Vec<ApiPermission>,
+    pub role: Role,
 }
diff --git a/crates/pipeline-manager/src/db/types/oidc_trust.rs b/crates/pipeline-manager/src/db/types/oidc_trust.rs
index f4614278a9f..849c22f9a73 100644
--- a/crates/pipeline-manager/src/db/types/oidc_trust.rs
+++ b/crates/pipeline-manager/src/db/types/oidc_trust.rs
@@ -1,4 +1,4 @@
-use crate::db::types::api_key::ApiPermission;
+use crate::db::types::role::Role;
 use serde::{Deserialize, Serialize};
 use std::fmt;
 use std::fmt::Display;
@@ -34,7 +34,18 @@ pub struct OidcTrustDescr {
     pub subject: String,
     #[serde(default)]
     pub audience: Option<String>,
-    pub scopes: Vec<ApiPermission>,
+    /// Role granted to a token that satisfies this trust. Capped at the
+    /// creating principal's role; `owner` trusts are platform-wide and may be
+    /// created only by an owner.
+    pub role: Role,
+}
+
+/// Returns true if `pattern` is a concrete claim value: non-empty and free of
+/// the `*` wildcard. Used by the create path to bound how broadly a trust may
+/// match (a wildcard pattern authorizes a whole set of tokens). Lives next to
+/// [`claim_matches`] so the matcher and the breadth policy change together.
+pub fn pattern_is_concrete(pattern: &str) -> bool {
+    !pattern.is_empty() && !pattern.contains('*')
 }
 
 /// Returns true if `pattern` matches `value`, where `*` in `pattern` matches
@@ -70,7 +81,18 @@ pub fn claim_matches(pattern: &str, value: &str) -> bool {
 
 #[cfg(test)]
 mod test {
-    use super::claim_matches;
+    use super::{claim_matches, pattern_is_concrete};
+
+    #[test]
+    fn concrete_patterns_have_no_wildcard() {
+        assert!(pattern_is_concrete("system:sa:app"));
+        assert!(pattern_is_concrete("feldera-tenant"));
+        assert!(!pattern_is_concrete("system:sa:*"));
+        assert!(!pattern_is_concrete("*"));
+        assert!(!pattern_is_concrete("*prod"));
+        // Empty is not a usable concrete value.
+        assert!(!pattern_is_concrete(""));
+    }
 
     #[test]
     fn exact_match() {
diff --git a/crates/pipeline-manager/src/db/types/role.rs b/crates/pipeline-manager/src/db/types/role.rs
new file mode 100644
index 00000000000..5e305c6a896
--- /dev/null
+++ b/crates/pipeline-manager/src/db/types/role.rs
@@ -0,0 +1,145 @@
+//! Role-based access control roles.
+//!
+//! Roles form a single total order: a higher role may do everything a lower
+//! role can. `owner` is platform-wide (acts across tenants); the others are
+//! scoped to a single tenant. The ordering is the derived `Ord` on the
+//! declaration order below, so it must stay `Read < Write < Admin < Owner`.
+
+use serde::{Deserialize, Serialize};
+use std::fmt;
+use std::str::FromStr;
+use utoipa::ToSchema;
+
+pub const ROLE_READ: &str = "read";
+pub const ROLE_WRITE: &str = "write";
+pub const ROLE_ADMIN: &str = "admin";
+pub const ROLE_OWNER: &str = "owner";
+
+/// A role in the RBAC model. Declaration order defines the privilege order.
+#[derive(
+    Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, ToSchema,
+)]
+#[cfg_attr(test, derive(proptest_derive::Arbitrary))]
+#[serde(rename_all = "lowercase")]
+pub enum Role {
+    Read,
+    Write,
+    Admin,
+    Owner,
+}
+
+impl Role {
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Role::Read => ROLE_READ,
+            Role::Write => ROLE_WRITE,
+            Role::Admin => ROLE_ADMIN,
+            Role::Owner => ROLE_OWNER,
+        }
+    }
+
+    /// True if this role is at least `required` in the privilege order.
+    pub fn satisfies(&self, required: Role) -> bool {
+        *self >= required
+    }
+}
+
+impl fmt::Display for Role {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
+
+/// Parsing is total: an unknown string is an error, never a panic, because
+/// these parse on the request (auth) path where a stored bad value must fail
+/// the request rather than crash the process.
+impl FromStr for Role {
+    type Err = InvalidRole;
+
+    fn from_str(input: &str) -> Result<Role, Self::Err> {
+        match input {
+            ROLE_READ => Ok(Role::Read),
+            ROLE_WRITE => Ok(Role::Write),
+            ROLE_ADMIN => Ok(Role::Admin),
+            ROLE_OWNER => Ok(Role::Owner),
+            other => Err(InvalidRole(other.to_string())),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct InvalidRole(pub String);
+
+impl fmt::Display for InvalidRole {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "invalid role '{}'", self.0)
+    }
+}
+
+/// The subset of roles that may be carried by a static API key. `admin` and
+/// `owner` are deliberately not representable here, so an over-privileged key
+/// cannot be constructed (a leaked static secret carrying admin/owner would be
+/// a standing liability; those roles come only from signature-verified
+/// principals: login JWTs and OIDC trust relationships).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[cfg_attr(test, derive(proptest_derive::Arbitrary))]
+pub enum MintableKeyRole {
+    Read,
+    Write,
+}
+
+impl MintableKeyRole {
+    /// Narrow a `Role` to a key-mintable role, rejecting `admin`/`owner`.
+    pub fn from_role(role: Role) -> Option<Self> {
+        match role {
+            Role::Read => Some(MintableKeyRole::Read),
+            Role::Write => Some(MintableKeyRole::Write),
+            Role::Admin | Role::Owner => None,
+        }
+    }
+
+    pub fn role(self) -> Role {
+        match self {
+            MintableKeyRole::Read => Role::Read,
+            MintableKeyRole::Write => Role::Write,
+        }
+    }
+}
+
+#[cfg(test)]
+mod test {
+    use super::*;
+
+    #[test]
+    fn ordering_is_total_and_correct() {
+        assert!(Role::Read < Role::Write);
+        assert!(Role::Write < Role::Admin);
+        assert!(Role::Admin < Role::Owner);
+        assert!(Role::Owner.satisfies(Role::Read));
+        assert!(!Role::Read.satisfies(Role::Write));
+        assert!(Role::Write.satisfies(Role::Write));
+    }
+
+    #[test]
+    fn parse_roundtrips_and_rejects_unknown() {
+        for r in [Role::Read, Role::Write, Role::Admin, Role::Owner] {
+            assert_eq!(Role::from_str(r.as_str()).unwrap(), r);
+        }
+        assert!(Role::from_str("superuser").is_err());
+        assert!(Role::from_str("").is_err());
+    }
+
+    #[test]
+    fn owner_and_admin_are_not_key_mintable() {
+        assert_eq!(
+            MintableKeyRole::from_role(Role::Read).map(|m| m.role()),
+            Some(Role::Read)
+        );
+        assert_eq!(
+            MintableKeyRole::from_role(Role::Write).map(|m| m.role()),
+            Some(Role::Write)
+        );
+        assert!(MintableKeyRole::from_role(Role::Admin).is_none());
+        assert!(MintableKeyRole::from_role(Role::Owner).is_none());
+    }
+}
diff --git a/crates/pipeline-manager/src/db/types/user.rs b/crates/pipeline-manager/src/db/types/user.rs
new file mode 100644
index 00000000000..55acf20b758
--- /dev/null
+++ b/crates/pipeline-manager/src/db/types/user.rs
@@ -0,0 +1,48 @@
+//! User identity and tenant membership types for RBAC.
+
+use crate::db::types::role::Role;
+use crate::db::types::tenant::TenantId;
+use serde::{Deserialize, Serialize};
+use std::fmt;
+use utoipa::ToSchema;
+use uuid::Uuid;
+
+/// Identifier of a persisted user (the principal behind an OIDC `sub`).
+#[derive(
+    Clone, Copy, Debug, PartialEq, Eq, Ord, PartialOrd, Hash, Serialize, Deserialize, ToSchema,
+)]
+#[cfg_attr(test, derive(proptest_derive::Arbitrary))]
+#[repr(transparent)]
+#[serde(transparent)]
+pub struct UserId(
+    #[cfg_attr(test, proptest(strategy = "crate::db::test::limited_uuid()"))] pub Uuid,
+);
+
+impl fmt::Display for UserId {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.fmt(f)
+    }
+}
+
+/// A member of a tenant, as returned by the user-management API.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, ToSchema)]
+pub struct TenantMember {
+    pub user_id: UserId,
+    /// OIDC issuer the user authenticates through.
+    pub provider: String,
+    /// OIDC subject.
+    pub subject: String,
+    /// Email, if the identity provider supplied one.
+    #[serde(default)]
+    pub email: Option<String>,
+    /// The user's role within this tenant.
+    pub role: Role,
+}
+
+/// A tenant, as returned by the platform (owner-only) tenant list.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, ToSchema)]
+pub struct TenantInfo {
+    pub id: TenantId,
+    pub name: String,
+    pub provider: String,
+}
diff --git a/crates/pipeline-manager/src/db/types/utils.rs b/crates/pipeline-manager/src/db/types/utils.rs
index 22f7273a4a1..258b0915cd4 100644
--- a/crates/pipeline-manager/src/db/types/utils.rs
+++ b/crates/pipeline-manager/src/db/types/utils.rs
@@ -61,6 +61,19 @@ pub fn validate_pipeline_name(name: &str) -> Result<(), DBError> {
     )
 }
 
+/// Maximum OIDC trust relationship name length.
+pub(crate) const MAXIMUM_OIDC_TRUST_NAME_LENGTH: usize = 100;
+
+/// Checks the provided OIDC trust relationship name is valid.
+pub fn validate_oidc_trust_name(name: &str) -> Result<(), DBError> {
+    validate_name(
+        name,
+        MAXIMUM_OIDC_TRUST_NAME_LENGTH,
+        PATTERN_NON_EMPTY_ALPHANUMERIC_UNDERSCORE_HYPHEN,
+        PATTERN_NON_EMPTY_ALPHANUMERIC_UNDERSCORE_HYPHEN_DESCRIPTION,
+    )
+}
+
 /// Checks the provided connector name is valid.
 pub fn validate_connector_name(name: &str) -> Result<(), DBError> {
     validate_name(
diff --git a/js-packages/web-console/src/lib/components/admin/AdminPage.svelte b/js-packages/web-console/src/lib/components/admin/AdminPage.svelte
new file mode 100644
index 00000000000..02b14f88d49
--- /dev/null
+++ b/js-packages/web-console/src/lib/components/admin/AdminPage.svelte
@@ -0,0 +1,120 @@
+<script lang="ts">
+  import { asyncReadable } from '@square/svelte-store'
+  import { page } from '$app/state'
+  import TenantList from '$lib/components/admin/TenantList.svelte'
+  import UserRoleTable from '$lib/components/admin/UserRoleTable.svelte'
+  import GenericDialog from '$lib/components/dialogs/GenericDialog.svelte'
+  import NewOidcTrustForm from '$lib/components/oidcTrust/NewOidcTrustForm.svelte'
+  import { useGlobalDialog } from '$lib/compositions/layout/useGlobalDialog.svelte'
+  import {
+    deleteOidcTrust,
+    getOidcTrustList,
+    type OidcTrustDescr
+  } from '$lib/services/pipelineManager'
+  import type { Snippet } from '$lib/types/svelte'
+
+  const isOwner = $derived(page.data.feldera?.isOwner ?? false)
+  const globalDialog = useGlobalDialog()
+  let errorMessage = $state('')
+
+  // OIDC trust list reused inline (admin/owner are granted to non-human
+  // principals through trust relationships).
+  const trusts = asyncReadable<OidcTrustDescr[]>([], getOidcTrustList, { reloadable: true })
+</script>
+
+{#snippet section(title: string, description: string, body: Snippet)}
+  <section class="flex flex-col gap-3 rounded-container bg-surface-50-950 p-4 md:p-6">
+    <div>
+      <h2 class="h3">{title}</h2>
+      <p class="text-sm opacity-70">{description}</p>
+    </div>
+    {@render body()}
+  </section>
+{/snippet}
+
+<div class="mx-auto flex w-full max-w-4xl flex-col gap-6 px-2 pb-10 md:px-8">
+  <h1 class="h2">Administration</h1>
+
+  {#if errorMessage}
+    <div class="rounded preset-outlined-error-600-400 p-2 text-sm">{errorMessage}</div>
+  {/if}
+
+  {#snippet usersBody()}
+    <UserRoleTable></UserRoleTable>
+  {/snippet}
+  {@render section('Users & roles', 'Manage tenant members and their roles.', usersBody)}
+
+  {#snippet oidcBody()}
+    <div class="scrollbar flex max-h-[40vh] flex-col gap-2 overflow-auto">
+      {#each $trusts as trust (trust.id)}
+        {#snippet deleteTrustDialog()}
+          <GenericDialog
+            content={{
+              title: `Delete trust '${trust.name}'?`,
+              description:
+                'Tokens matching this trust immediately lose access. This cannot be undone.',
+              onSuccess: {
+                name: 'Delete',
+                callback: async () => {
+                  try {
+                    await deleteOidcTrust(trust.name)
+                    trusts.reload?.()
+                  } catch (e) {
+                    errorMessage = e instanceof Error ? e.message : String(e)
+                  }
+                  globalDialog.dialog = null
+                }
+              },
+              onCancel: {
+                callback: () => {
+                  globalDialog.dialog = null
+                }
+              }
+            }}
+            noclose
+            danger
+          ></GenericDialog>
+        {/snippet}
+        <div class="flex flex-nowrap items-center gap-2 border-b border-surface-100-900 py-2">
+          <div class="w-full">
+            <div>
+              {trust.name}
+              <span class="text-xs opacity-70">[{trust.role}]</span>
+            </div>
+            <div class="text-sm opacity-70">
+              <code>{trust.issuer}</code> · sub=<code>{trust.subject}</code>{#if trust.audience}
+                · aud=<code>{trust.audience}</code>{/if}
+            </div>
+            {#if trust.description}
+              <div class="text-xs opacity-70">{trust.description}</div>
+            {/if}
+          </div>
+          <button
+            class="fd fd-trash-2 btn-icon text-[20px]"
+            aria-label="Delete {trust.name} trust relationship"
+            onclick={() => (globalDialog.dialog = deleteTrustDialog)}
+          ></button>
+        </div>
+      {:else}
+        <div class="opacity-70">No OIDC trust relationships configured</div>
+      {/each}
+    </div>
+    <NewOidcTrustForm onSuccess={() => trusts.reload?.()}></NewOidcTrustForm>
+  {/snippet}
+  {@render section(
+    'Admin & owner access (OIDC trust)',
+    'Grant roles to non-human principals (CI, services) by trusting JWTs from an issuer.',
+    oidcBody
+  )}
+
+  {#if isOwner}
+    {#snippet tenantsBody()}
+      <TenantList></TenantList>
+    {/snippet}
+    {@render section(
+      'Tenants',
+      'Owner-only: list and create tenants, and switch the active tenant.',
+      tenantsBody
+    )}
+  {/if}
+</div>
diff --git a/js-packages/web-console/src/lib/components/admin/TenantList.svelte b/js-packages/web-console/src/lib/components/admin/TenantList.svelte
new file mode 100644
index 00000000000..2f441a5b33a
--- /dev/null
+++ b/js-packages/web-console/src/lib/components/admin/TenantList.svelte
@@ -0,0 +1,101 @@
+<script lang="ts">
+  import { asyncReadable } from '@square/svelte-store'
+  import { goto, invalidateAll } from '$app/navigation'
+  import { page } from '$app/state'
+  import { clearConfigCaches } from '$lib/compositions/configCache'
+  import { resolve } from '$lib/functions/svelte'
+  import { setSelectedTenant } from '$lib/services/auth'
+  import { createTenant, getTenants, type Tenant } from '$lib/services/pipelineManager'
+
+  const tenants = asyncReadable<Tenant[]>([], getTenants, { reloadable: true })
+
+  // Compare/select by tenant id (UUID). Names are unique only per provider, so
+  // an owner-created ('manual') tenant and an OIDC-issuer tenant can share a
+  // name; the id is globally unique and the backend's Feldera-Tenant resolver
+  // accepts it unambiguously.
+  const currentTenantId = $derived(page.data.feldera?.tenantId)
+
+  let newName = $state('')
+  let newProvider = $state('')
+  let creating = $state(false)
+  let errorMessage = $state('')
+
+  const create = async () => {
+    if (!newName.trim()) {
+      errorMessage = 'Specify a tenant name'
+      return
+    }
+    errorMessage = ''
+    creating = true
+    try {
+      await createTenant(newName.trim(), newProvider.trim() || undefined)
+      newName = ''
+      newProvider = ''
+      tenants.reload?.()
+    } catch (e) {
+      errorMessage = e instanceof Error ? e.message : String(e)
+    } finally {
+      creating = false
+    }
+  }
+
+  // Switch the active tenant via the `Feldera-Tenant` header. Clearing the
+  // cached config/session forces the next load to re-fetch /config/session
+  // under the new header (the warm cache would otherwise keep reporting the
+  // previous acting tenant), then navigate home and re-run loaders so the whole
+  // UI (incl. the top-right tenant indicator) reflects the new tenant.
+  const actAs = async (tenant: Tenant) => {
+    setSelectedTenant(tenant.id)
+    clearConfigCaches()
+    await goto(resolve('/'))
+    await invalidateAll()
+  }
+</script>
+
+<div class="flex flex-col gap-3">
+  {#if errorMessage}
+    <div class="rounded preset-outlined-error-600-400 p-2 text-sm">{errorMessage}</div>
+  {/if}
+  <div class="scrollbar flex flex-col gap-2 overflow-auto">
+    {#each $tenants as tenant (tenant.id)}
+      <div class="flex flex-nowrap items-center gap-2 border-b border-surface-100-900 py-2">
+        <div class="w-full">
+          <div class="font-medium">
+            {tenant.name}
+            {#if tenant.id === currentTenantId}
+              <span class="text-xs opacity-70">(current)</span>
+            {/if}
+          </div>
+          <div class="text-sm opacity-70"><code>{tenant.provider}</code> · {tenant.id}</div>
+        </div>
+        <button
+          class="btn preset-filled-surface-50-950"
+          disabled={tenant.id === currentTenantId}
+          onclick={() => actAs(tenant)}
+        >
+          Act as this tenant
+        </button>
+      </div>
+    {:else}
+      <div class="opacity-70">No tenants found</div>
+    {/each}
+  </div>
+
+  <form
+    class="flex items-end gap-2"
+    onsubmit={(e) => {
+      e.preventDefault()
+      create()
+    }}
+  >
+    <label class="label w-full">
+      <span>New tenant name</span>
+      <input class="input w-full" placeholder="acme-prod" bind:value={newName} />
+    </label>
+    <label class="label w-48">
+      <span>Provider (optional)</span>
+      <input class="input w-full" placeholder="GenericOidc" bind:value={newProvider} />
+    </label>
+    <button class="btn preset-filled-surface-50-950" disabled={creating}>Create</button>
+  </form>
+</div>
diff --git a/js-packages/web-console/src/lib/components/admin/UserRoleTable.svelte b/js-packages/web-console/src/lib/components/admin/UserRoleTable.svelte
new file mode 100644
index 00000000000..b940cb02eee
--- /dev/null
+++ b/js-packages/web-console/src/lib/components/admin/UserRoleTable.svelte
@@ -0,0 +1,222 @@
+<script lang="ts">
+  import { asyncReadable } from '@square/svelte-store'
+  import { Select } from 'common-ui'
+  import GenericDialog from '$lib/components/dialogs/GenericDialog.svelte'
+  import { useGlobalDialog } from '$lib/compositions/layout/useGlobalDialog.svelte'
+  import {
+    addTenantUser,
+    getTenantUsers,
+    removeTenantUser,
+    setTenantUserRole,
+    type TenantUser
+  } from '$lib/services/pipelineManager'
+
+  const users = asyncReadable<TenantUser[]>([], getTenantUsers, { reloadable: true })
+
+  const globalDialog = useGlobalDialog()
+
+  // Pending per-row role edits, keyed by user_id. Absent means unchanged.
+  let pendingRole = $state<Record<string, 'read' | 'write' | 'admin'>>({})
+  let savingUserId = $state<string | null>(null)
+  let errorMessage = $state('')
+
+  // Pre-provision (add-member) form state.
+  let newProvider = $state('')
+  let newSubject = $state('')
+  let newEmail = $state('')
+  let newRole = $state<'read' | 'write' | 'admin'>('read')
+  let adding = $state(false)
+
+  // A member the IdP resolved as owner can appear in the list; owner is not
+  // assignable here, so show it read-only rather than a blank select.
+  const roleOptions = ['read', 'write', 'admin'] as const
+  const isAssignable = (role: string): role is 'read' | 'write' | 'admin' =>
+    (roleOptions as readonly string[]).includes(role)
+
+  const roleOf = (user: TenantUser) => pendingRole[user.user_id] ?? user.role
+
+  const addMember = async () => {
+    errorMessage = ''
+    adding = true
+    try {
+      await addTenantUser({
+        provider: newProvider.trim(),
+        subject: newSubject.trim(),
+        email: newEmail.trim() || undefined,
+        role: newRole
+      })
+      newProvider = ''
+      newSubject = ''
+      newEmail = ''
+      newRole = 'read'
+      users.reload?.()
+    } catch (e) {
+      errorMessage = e instanceof Error ? e.message : String(e)
+    } finally {
+      adding = false
+    }
+  }
+
+  const save = async (user: TenantUser) => {
+    const role = roleOf(user)
+    if (!isAssignable(role)) {
+      return // owner is not assignable here
+    }
+    errorMessage = ''
+    savingUserId = user.user_id
+    try {
+      await setTenantUserRole(user.user_id, role)
+      delete pendingRole[user.user_id]
+      users.reload?.()
+    } catch (e) {
+      errorMessage = e instanceof Error ? e.message : String(e)
+    } finally {
+      savingUserId = null
+    }
+  }
+</script>
+
+<div class="flex flex-col gap-3">
+  <p class="text-sm opacity-70">
+    Members appear here after their first login. Assign read, write, or admin; remove a member to
+    revoke access. Pre-provision a member below to grant a role before their first login.
+  </p>
+  {#if errorMessage}
+    <div class="rounded preset-outlined-error-600-400 p-2 text-sm">{errorMessage}</div>
+  {/if}
+
+  <!-- Pre-provision by identity: create the membership before the user's first
+       login. The grant is dormant until that identity signs in to the tenant. -->
+  <div class="rounded border border-surface-100-900 p-3">
+    <div class="mb-2">
+      <div class="font-medium">Pre-provision a member</div>
+      <p class="text-sm opacity-70">
+        Grant a role before the user's first login. <b>Provider</b> and <b>Subject</b> must exactly
+        match the <code>iss</code> and <code>sub</code> claims of the JWT the user will present (from
+        your identity provider) — otherwise the grant will not attach at login. Email is for display only.
+      </p>
+    </div>
+    <form
+      class="flex flex-wrap items-end gap-2"
+      onsubmit={(e) => {
+        e.preventDefault()
+        addMember()
+      }}
+    >
+      <label class="flex flex-col text-sm">
+        <span class="opacity-70">Provider — OIDC issuer (<code>iss</code>)</span>
+        <input
+          class="input w-64"
+          bind:value={newProvider}
+          placeholder="https://accounts.google.com"
+        />
+      </label>
+      <label class="flex flex-col text-sm">
+        <span class="opacity-70">Subject — OIDC <code>sub</code></span>
+        <input
+          class="input w-56"
+          bind:value={newSubject}
+          placeholder="10769150350006150715113082367"
+        />
+      </label>
+      <label class="flex flex-col text-sm">
+        <span class="opacity-70">Email (display only)</span>
+        <input class="input w-56" bind:value={newEmail} placeholder="user@acme.com" />
+      </label>
+      <label class="flex flex-col text-sm">
+        <span class="opacity-70">Role</span>
+        <Select bind:value={newRole} class="w-28">
+          <option value="read">read</option>
+          <option value="write">write</option>
+          <option value="admin">admin</option>
+        </Select>
+      </label>
+      <button
+        type="submit"
+        class="btn preset-filled-primary-500"
+        disabled={adding || !newProvider.trim() || !newSubject.trim()}
+      >
+        Add member
+      </button>
+    </form>
+  </div>
+  <div class="scrollbar flex flex-col gap-2 overflow-auto">
+    {#each $users as user (user.user_id)}
+      {#snippet removeDialog()}
+        <GenericDialog
+          content={{
+            title: `Remove ${user.email ?? user.subject}?`,
+            description:
+              'They lose their role in this tenant until re-added or they log in again. Continue?',
+            onSuccess: {
+              name: 'Remove',
+              callback: async () => {
+                // Surface failures instead of swallowing them and leaving the
+                // dialog stuck; only close on success.
+                try {
+                  await removeTenantUser(user.user_id)
+                  users.reload?.()
+                  globalDialog.dialog = null
+                } catch (e) {
+                  errorMessage = e instanceof Error ? e.message : String(e)
+                  globalDialog.dialog = null
+                }
+              },
+              'data-testid': 'button-confirm-remove'
+            },
+            onCancel: {
+              callback: () => {
+                globalDialog.dialog = null
+              }
+            }
+          }}
+          noclose
+          danger
+        ></GenericDialog>
+      {/snippet}
+      <div class="flex flex-nowrap items-center gap-2 border-b border-surface-100-900 py-2">
+        <div class="w-full">
+          <div class="font-medium">{user.email ?? user.subject}</div>
+          <div class="text-sm opacity-70">
+            <code>{user.provider}</code> · sub=<code>{user.subject}</code>
+          </div>
+        </div>
+        {#if isAssignable(user.role)}
+          <Select
+            value={roleOf(user)}
+            onchange={(e) => {
+              pendingRole[user.user_id] = (e.currentTarget as HTMLSelectElement).value as
+                | 'read'
+                | 'write'
+                | 'admin'
+            }}
+            class="w-28"
+            aria-label="Role for {user.email ?? user.subject}"
+          >
+            <option value="read">read</option>
+            <option value="write">write</option>
+            <option value="admin">admin</option>
+          </Select>
+          <button
+            class="btn preset-filled-surface-50-950"
+            disabled={pendingRole[user.user_id] === undefined || savingUserId === user.user_id}
+            onclick={() => save(user)}
+          >
+            Save
+          </button>
+        {:else}
+          <!-- owner is platform-wide, not a tenant membership, so it is shown
+               read-only here. -->
+          <span class="w-28 text-center opacity-70">{user.role}</span>
+        {/if}
+        <button
+          class="fd fd-trash-2 btn-icon text-[20px]"
+          aria-label="Remove {user.email ?? user.subject}"
+          onclick={() => (globalDialog.dialog = removeDialog)}
+        ></button>
+      </div>
+    {:else}
+      <div class="opacity-70">No members yet. Users appear after their first login.</div>
+    {/each}
+  </div>
+</div>
diff --git a/js-packages/web-console/src/lib/components/apiKey/NewApiKeyForm.svelte b/js-packages/web-console/src/lib/components/apiKey/NewApiKeyForm.svelte
index 3893aa83034..b1cf4edd540 100644
--- a/js-packages/web-console/src/lib/components/apiKey/NewApiKeyForm.svelte
+++ b/js-packages/web-console/src/lib/components/apiKey/NewApiKeyForm.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-  import { Tooltip } from 'common-ui'
+  import { Select, Tooltip } from 'common-ui'
   import { Control, Field, FieldErrors, Label } from 'formsnap'
   import { setError, superForm } from 'sveltekit-superforms'
   import { valibot } from 'sveltekit-superforms/adapters'
@@ -9,12 +9,14 @@
 
   const { onSubmit, onSuccess }: { onSubmit?: () => void; onSuccess?: () => void } = $props()
 
+  // API keys may only grant read or write; admin/owner are not valid here.
   const schema = va.object({
-    name: va.pipe(va.string(), va.minLength(1, 'Specify API key name'))
+    name: va.pipe(va.string(), va.minLength(1, 'Specify API key name')),
+    role: va.picklist(['read', 'write'] as const)
   })
   const api = usePipelineManager()
   const form = superForm(
-    { name: '' },
+    { name: '', role: 'read' as 'read' | 'write' },
     {
       SPA: true,
       validators: valibot(schema),
@@ -23,7 +25,7 @@
           return
         }
         onSubmit?.()
-        api.postApiKey(form.data.name).then(
+        api.postApiKey(form.data.name, form.data.role).then(
           (response) => {
             lastGenerated.push({ name: response.name, key: response.api_key })
             onSuccess?.()
@@ -66,6 +68,10 @@
               bind:value={$formData.name}
               autofocus
             />
+            <Select bind:value={$formData.role} class="w-28" aria-label="API key role">
+              <option value="read">read</option>
+              <option value="write">write</option>
+            </Select>
             <div class="">
               <button class="btn preset-filled-surface-50-950">Generate</button>
             </div>
diff --git a/js-packages/web-console/src/lib/components/auth/ProfileButton.svelte b/js-packages/web-console/src/lib/components/auth/ProfileButton.svelte
index 3d36be2f1cc..cce84e764d7 100644
--- a/js-packages/web-console/src/lib/components/auth/ProfileButton.svelte
+++ b/js-packages/web-console/src/lib/components/auth/ProfileButton.svelte
@@ -19,6 +19,8 @@
     healthStatus
   }: { compactBreakpoint?: string; healthStatus: ClusterHealthStatus } = $props()
   const auth = page.data.auth as AuthDetails | undefined
+  const role = $derived(page.data.feldera?.role)
+  const canAdminister = $derived(role === 'admin' || role === 'owner')
 
   const globalDialog = useGlobalDialog()
 
@@ -81,14 +83,24 @@
         {#snippet oidcTrustIcon()}
           <div class="fd fd-user text-[20px]"></div>
         {/snippet}
+        {#snippet adminIcon()}
+          <div class="fd fd-shield text-[20px]"></div>
+        {/snippet}
 
         {#if typeof auth === 'object' && 'logout' in auth}
+          {#if canAdminister}
+            {@render profileItemButton('Admin', adminIcon, { href: resolve('/admin') })}
+          {/if}
           {@render profileItemButton('Manage API keys', apiKeysIcon, {
             onclick: () => (globalDialog.dialog = apiKeyDialog)
           })}
-          {@render profileItemButton('Manage OIDC trust', oidcTrustIcon, {
-            onclick: () => (globalDialog.dialog = oidcTrustDialog)
-          })}
+          <!-- OIDC trust management is admin-only (the endpoints require admin),
+               so only surface it when the caller can actually use it. -->
+          {#if canAdminister}
+            {@render profileItemButton('Manage OIDC trust', oidcTrustIcon, {
+              onclick: () => (globalDialog.dialog = oidcTrustDialog)
+            })}
+          {/if}
 
           <div class="hr"></div>
         {/if}
diff --git a/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte b/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte
index 7e8487bde79..c51d0326b82 100644
--- a/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte
+++ b/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte
@@ -1,38 +1,63 @@
 <script lang="ts">
+  import { Select } from 'common-ui'
   import { Control, Field, FieldErrors, Label } from 'formsnap'
-  import { setError, superForm } from 'sveltekit-superforms'
+  import { superForm } from 'sveltekit-superforms'
   import { valibot } from 'sveltekit-superforms/adapters'
 
   import * as va from 'valibot'
-  import { postOidcTrust } from '$lib/services/pipelineManager'
+  import { page } from '$app/state'
+  import { postOidcTrust, type Role } from '$lib/services/pipelineManager'
 
   const { onSubmit, onSuccess }: { onSubmit?: () => void; onSuccess?: () => void } = $props()
 
+  // Backend rejections (role cap, wildcard/audience breadth, duplicate name,
+  // ...) can concern any field, so show them as a form-level error rather than
+  // pinning every one to the Name field.
+  let submitError = $state('')
+
+  // The backend caps the granted role at the caller's role; only an owner may
+  // grant `owner`, so offer it only then.
+  const isOwner = page.data.feldera?.isOwner ?? false
+
   const schema = va.object({
     name: va.pipe(va.string(), va.minLength(1, 'Specify a name')),
     issuer: va.pipe(va.string(), va.minLength(1, 'Specify the issuer URL')),
     subject: va.pipe(va.string(), va.minLength(1, 'Specify a subject pattern')),
     audience: va.string(),
-    description: va.string()
+    description: va.string(),
+    role: va.picklist(['read', 'write', 'admin', 'owner'] as const)
   })
 
   const form = superForm(
-    { name: '', issuer: '', subject: '', audience: '', description: '' },
+    {
+      name: '',
+      issuer: '',
+      subject: '',
+      audience: '',
+      description: '',
+      role: 'read' as Role
+    },
     {
       SPA: true,
       validators: valibot(schema),
       onUpdate({ form: f }) {
-        if (!f.valid) return
+        if (!f.valid) {
+          return
+        }
+        submitError = ''
         onSubmit?.()
         postOidcTrust({
           name: f.data.name,
           issuer: f.data.issuer,
           subject: f.data.subject,
           audience: f.data.audience || undefined,
-          description: f.data.description || undefined
+          description: f.data.description || undefined,
+          role: f.data.role
         }).then(
           () => onSuccess?.(),
-          (e) => setError(f, 'name', 'message' in e ? e.message : String(e))
+          (e) => {
+            submitError = e instanceof Error ? e.message : String(e)
+          }
         )
       }
     }
@@ -127,13 +152,32 @@
     </Control>
   </Field>
 
+  <Field {form} name="role">
+    <Control>
+      {#snippet children(attrs)}
+        <Label>Role</Label>
+        <Select class="w-full" {...attrs} bind:value={$formData.role}>
+          <option value="read">read</option>
+          <option value="write">write</option>
+          <option value="admin">admin</option>
+          {#if isOwner}
+            <option value="owner">owner</option>
+          {/if}
+        </Select>
+      {/snippet}
+    </Control>
+  </Field>
+
   <p class="text-xs opacity-70">
     JWTs from <code>Issuer</code> whose <code>sub</code> matches
     <code>Subject pattern</code> (and, if specified, whose <code>aud</code> matches
-    <code>Audience pattern</code>) authorize requests as this tenant. <code>*</code> is a
-    wildcard.
+    <code>Audience pattern</code>) authorize requests as this tenant. <code>*</code> is a wildcard.
   </p>
 
+  {#if submitError}
+    <div class="rounded preset-outlined-error-600-400 p-2 text-sm">{submitError}</div>
+  {/if}
+
   <div class="flex justify-end">
     <button class="btn preset-filled-surface-50-950">Create</button>
   </div>
diff --git a/js-packages/web-console/src/lib/components/other/ApiKeyMenu.svelte b/js-packages/web-console/src/lib/components/other/ApiKeyMenu.svelte
index 53a9d022a5a..ec8444e8386 100644
--- a/js-packages/web-console/src/lib/components/other/ApiKeyMenu.svelte
+++ b/js-packages/web-console/src/lib/components/other/ApiKeyMenu.svelte
@@ -42,7 +42,7 @@
         <div class=" w-full">
           <div>
             {key.name}
-            [{key.scopes}]
+            <span class="text-xs opacity-70">[{key.role}]</span>
           </div>
 
           <div class="text-sm">{key.id}</div>
diff --git a/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte b/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte
index 1037b683a73..0724d2aaf7d 100644
--- a/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte
+++ b/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
   import { asyncReadable } from '@square/svelte-store'
-  import NewOidcTrustForm from '$lib/components/oidcTrust/NewOidcTrustForm.svelte'
   import GenericDialog from '$lib/components/dialogs/GenericDialog.svelte'
+  import NewOidcTrustForm from '$lib/components/oidcTrust/NewOidcTrustForm.svelte'
   import { useGlobalDialog } from '$lib/compositions/layout/useGlobalDialog.svelte'
   import {
     deleteOidcTrust,
@@ -45,11 +45,10 @@
         <div class="w-full">
           <div>
             {trust.name}
-            <span class="text-xs opacity-70">[{trust.scopes.join(', ')}]</span>
+            <span class="text-xs opacity-70">[{trust.role}]</span>
           </div>
           <div class="text-sm">
-            <code>{trust.issuer}</code> · sub=<code>{trust.subject}</code
-            >{#if trust.audience}
+            <code>{trust.issuer}</code> · sub=<code>{trust.subject}</code>{#if trust.audience}
               · aud=<code>{trust.audience}</code>{/if}
           </div>
           {#if trust.description}
diff --git a/js-packages/web-console/src/lib/compositions/usePipelineManager.svelte.ts b/js-packages/web-console/src/lib/compositions/usePipelineManager.svelte.ts
index e39fbbc19ca..182f279b6c4 100644
--- a/js-packages/web-console/src/lib/compositions/usePipelineManager.svelte.ts
+++ b/js-packages/web-console/src/lib/compositions/usePipelineManager.svelte.ts
@@ -218,9 +218,14 @@ export const usePipelineManager = (options?: FetchOptions) => {
         () => 'Failed to fetch session configuration'
       ),
       getApiKeys: reportError(getApiKeys, () => 'Failed to fetch API keys'),
-      postApiKey: async (name: string, options?: FetchOptions | undefined) => {
+      postApiKey: async (
+        name: string,
+        role: 'read' | 'write' = 'read',
+        options?: FetchOptions | undefined
+      ) => {
         const x = await reportError(postApiKey, (keyName) => `Failed to create ${keyName} API key`)(
           name,
+          role,
           options
         )
         return x
diff --git a/js-packages/web-console/src/lib/services/manager/index.ts b/js-packages/web-console/src/lib/services/manager/index.ts
index 288ae1c42b6..0785e7ec28e 100644
--- a/js-packages/web-console/src/lib/services/manager/index.ts
+++ b/js-packages/web-console/src/lib/services/manager/index.ts
@@ -1,13 +1,17 @@
 // This file is auto-generated by @hey-api/openapi-ts
 
 export {
+  addTenantUser,
   checkpointPipeline,
   clockAdvance,
   commitTransaction,
   completionStatus,
   completionToken,
+  createTenant,
   deleteApiKey,
+  deleteOidcTrust,
   deletePipeline,
+  deleteTenantUser,
   getApiKey,
   getCheckpointStatus,
   getCheckpointSyncStatus,
@@ -19,6 +23,7 @@ export {
   getConfigDemos,
   getConfigSession,
   getMetrics,
+  getOidcTrust,
   getPipeline,
   getPipelineCircuitJsonProfile,
   getPipelineCircuitProfile,
@@ -39,16 +44,21 @@ export {
   httpOutput,
   listApiKeys,
   listClusterEvents,
+  listOidcTrust,
   listPipelineEvents,
   listPipelines,
+  listTenants,
+  listTenantUsers,
   type Options,
   patchPipeline,
   pipelineAdhocSql,
   postApiKey,
+  postOidcTrust,
   postPipeline,
   postPipelineActivate,
   postPipelineApprove,
   postPipelineClear,
+  postPipelineDiff,
   postPipelineDismissError,
   postPipelineInputConnectorAction,
   postPipelinePause,
@@ -58,18 +68,26 @@ export {
   postPipelineStartCompaction,
   postPipelineStop,
   postUpdateRuntime,
+  postValidateProgram,
   putPipeline,
+  putTenantUser,
   startSamplyProfile,
   startTransaction,
   syncCheckpoint
 } from './sdk.gen'
 export type {
+  AddMemberRequest,
+  AddMemberResponse,
+  AddTenantUserData,
+  AddTenantUserError,
+  AddTenantUserErrors,
+  AddTenantUserResponse,
+  AddTenantUserResponses,
   AdHocInputConfig,
   AdHocResultFormat,
   AdhocQueryArgs,
   ApiKeyDescr,
   ApiKeyId,
-  ApiPermission,
   Auth,
   AuthProvider,
   BootstrapPolicy,
@@ -142,6 +160,11 @@ export type {
   ConnectorTransactionPhase,
   ConsumerConfig,
   ControllerStatus,
+  CreateTenantData,
+  CreateTenantError,
+  CreateTenantErrors,
+  CreateTenantResponse,
+  CreateTenantResponses,
   Credentials,
   Dataflow,
   DatagenInputConfig,
@@ -150,10 +173,18 @@ export type {
   DeleteApiKeyError,
   DeleteApiKeyErrors,
   DeleteApiKeyResponses,
+  DeleteOidcTrustData,
+  DeleteOidcTrustError,
+  DeleteOidcTrustErrors,
+  DeleteOidcTrustResponses,
   DeletePipelineData,
   DeletePipelineError,
   DeletePipelineErrors,
   DeletePipelineResponses,
+  DeleteTenantUserData,
+  DeleteTenantUserError,
+  DeleteTenantUserErrors,
+  DeleteTenantUserResponses,
   DeliverPolicy,
   DeltaTableIngestMode,
   DeltaTableReaderConfig,
@@ -229,6 +260,11 @@ export type {
   GetMetricsData,
   GetMetricsResponse,
   GetMetricsResponses,
+  GetOidcTrustData,
+  GetOidcTrustError,
+  GetOidcTrustErrors,
+  GetOidcTrustResponse,
+  GetOidcTrustResponses,
   GetPipelineCircuitJsonProfileData,
   GetPipelineCircuitJsonProfileError,
   GetPipelineCircuitJsonProfileErrors,
@@ -356,6 +392,11 @@ export type {
   ListClusterEventsErrors,
   ListClusterEventsResponse,
   ListClusterEventsResponses,
+  ListOidcTrustData,
+  ListOidcTrustError,
+  ListOidcTrustErrors,
+  ListOidcTrustResponse,
+  ListOidcTrustResponses,
   ListPipelineEventsData,
   ListPipelineEventsError,
   ListPipelineEventsErrors,
@@ -366,6 +407,16 @@ export type {
   ListPipelinesErrors,
   ListPipelinesResponse,
   ListPipelinesResponses,
+  ListTenantsData,
+  ListTenantsError,
+  ListTenantsErrors,
+  ListTenantsResponse,
+  ListTenantsResponses,
+  ListTenantUsersData,
+  ListTenantUsersError,
+  ListTenantUsersErrors,
+  ListTenantUsersResponse,
+  ListTenantUsersResponses,
   MemoryPressure,
   MergerType,
   MetricsFormat,
@@ -377,10 +428,16 @@ export type {
   NatsInputConfig,
   NewApiKeyRequest,
   NewApiKeyResponse,
+  NewOidcTrustRequest,
+  NewOidcTrustResponse,
+  NewTenantRequest,
+  NewTenantResponse,
   NexmarkInputConfig,
   NexmarkInputOptions,
   NexmarkTable,
   ObjectStorageConfig,
+  OidcTrustDescr,
+  OidcTrustId,
   Op,
   Operand,
   OutputBufferConfig,
@@ -403,6 +460,7 @@ export type {
   PipelineAdhocSqlResponses,
   PipelineConfig,
   PipelineDiff,
+  PipelineDiffRequest,
   PipelineFieldSelector,
   PipelineId,
   PipelineInfo,
@@ -422,6 +480,11 @@ export type {
   PostgresTlsConfig,
   PostgresWriteMode,
   PostgresWriterConfig,
+  PostOidcTrustData,
+  PostOidcTrustError,
+  PostOidcTrustErrors,
+  PostOidcTrustResponse,
+  PostOidcTrustResponses,
   PostPipelineActivateData,
   PostPipelineActivateError,
   PostPipelineActivateErrors,
@@ -437,6 +500,11 @@ export type {
   PostPipelineClearErrors,
   PostPipelineClearResponses,
   PostPipelineData,
+  PostPipelineDiffData,
+  PostPipelineDiffError,
+  PostPipelineDiffErrors,
+  PostPipelineDiffResponse,
+  PostPipelineDiffResponses,
   PostPipelineDismissErrorData,
   PostPipelineDismissErrorError,
   PostPipelineDismissErrorErrors,
@@ -481,6 +549,11 @@ export type {
   PostUpdateRuntimeErrors,
   PostUpdateRuntimeResponse,
   PostUpdateRuntimeResponses,
+  PostValidateProgramData,
+  PostValidateProgramError,
+  PostValidateProgramErrors,
+  PostValidateProgramResponse,
+  PostValidateProgramResponses,
   PreprocessorConfig,
   ProgramConfig,
   ProgramDiff,
@@ -498,6 +571,10 @@ export type {
   PutPipelineErrors,
   PutPipelineResponse,
   PutPipelineResponses,
+  PutTenantUserData,
+  PutTenantUserError,
+  PutTenantUserErrors,
+  PutTenantUserResponses,
   RedisOutputConfig,
   Rel,
   Relation,
@@ -508,6 +585,7 @@ export type {
   ResourcesStatus,
   RestCatalogConfig,
   RngFieldSettings,
+  Role,
   RuntimeConfig,
   RuntimeDesiredStatus,
   RuntimeStatus,
@@ -518,6 +596,7 @@ export type {
   SampleStatistics,
   ServiceStatus,
   SessionInfo,
+  SetMemberRoleRequest,
   ShortEndpointConfig,
   SourcePosition,
   SqlCompilationInfo,
@@ -551,6 +630,8 @@ export type {
   SyncConfig,
   TemporarySuspendError,
   TenantId,
+  TenantInfo,
+  TenantMember,
   TimeSeries,
   TransactionInitiators,
   TransactionPhase,
@@ -559,5 +640,8 @@ export type {
   UpdateInformation,
   UrlInputConfig,
   UserAndPassword,
+  UserId,
+  ValidateProgramRequest,
+  ValidateProgramResponse,
   Version
 } from './types.gen'
diff --git a/js-packages/web-console/src/lib/services/manager/sdk.gen.ts b/js-packages/web-console/src/lib/services/manager/sdk.gen.ts
index c0e5be987dd..69887d111b9 100644
--- a/js-packages/web-console/src/lib/services/manager/sdk.gen.ts
+++ b/js-packages/web-console/src/lib/services/manager/sdk.gen.ts
@@ -3,6 +3,9 @@
 import type { Client, Options as Options2, TDataShape } from './client'
 import { client } from './client.gen'
 import type {
+  AddTenantUserData,
+  AddTenantUserErrors,
+  AddTenantUserResponses,
   CheckpointPipelineData,
   CheckpointPipelineErrors,
   CheckpointPipelineResponses,
@@ -18,12 +21,21 @@ import type {
   CompletionTokenData,
   CompletionTokenErrors,
   CompletionTokenResponses,
+  CreateTenantData,
+  CreateTenantErrors,
+  CreateTenantResponses,
   DeleteApiKeyData,
   DeleteApiKeyErrors,
   DeleteApiKeyResponses,
+  DeleteOidcTrustData,
+  DeleteOidcTrustErrors,
+  DeleteOidcTrustResponses,
   DeletePipelineData,
   DeletePipelineErrors,
   DeletePipelineResponses,
+  DeleteTenantUserData,
+  DeleteTenantUserErrors,
+  DeleteTenantUserResponses,
   GetApiKeyData,
   GetApiKeyErrors,
   GetApiKeyResponses,
@@ -56,6 +68,9 @@ import type {
   GetConfigSessionResponses,
   GetMetricsData,
   GetMetricsResponses,
+  GetOidcTrustData,
+  GetOidcTrustErrors,
+  GetOidcTrustResponses,
   GetPipelineCircuitJsonProfileData,
   GetPipelineCircuitJsonProfileErrors,
   GetPipelineCircuitJsonProfileResponses,
@@ -116,12 +131,21 @@ import type {
   ListClusterEventsData,
   ListClusterEventsErrors,
   ListClusterEventsResponses,
+  ListOidcTrustData,
+  ListOidcTrustErrors,
+  ListOidcTrustResponses,
   ListPipelineEventsData,
   ListPipelineEventsErrors,
   ListPipelineEventsResponses,
   ListPipelinesData,
   ListPipelinesErrors,
   ListPipelinesResponses,
+  ListTenantsData,
+  ListTenantsErrors,
+  ListTenantsResponses,
+  ListTenantUsersData,
+  ListTenantUsersErrors,
+  ListTenantUsersResponses,
   PatchPipelineData,
   PatchPipelineErrors,
   PatchPipelineResponses,
@@ -131,6 +155,9 @@ import type {
   PostApiKeyData,
   PostApiKeyErrors,
   PostApiKeyResponses,
+  PostOidcTrustData,
+  PostOidcTrustErrors,
+  PostOidcTrustResponses,
   PostPipelineActivateData,
   PostPipelineActivateErrors,
   PostPipelineActivateResponses,
@@ -141,6 +168,9 @@ import type {
   PostPipelineClearErrors,
   PostPipelineClearResponses,
   PostPipelineData,
+  PostPipelineDiffData,
+  PostPipelineDiffErrors,
+  PostPipelineDiffResponses,
   PostPipelineDismissErrorData,
   PostPipelineDismissErrorErrors,
   PostPipelineDismissErrorResponses,
@@ -170,9 +200,15 @@ import type {
   PostUpdateRuntimeData,
   PostUpdateRuntimeErrors,
   PostUpdateRuntimeResponses,
+  PostValidateProgramData,
+  PostValidateProgramErrors,
+  PostValidateProgramResponses,
   PutPipelineData,
   PutPipelineErrors,
   PutPipelineResponses,
+  PutTenantUserData,
+  PutTenantUserErrors,
+  PutTenantUserResponses,
   StartSamplyProfileData,
   StartSamplyProfileErrors,
   StartSamplyProfileResponses,
@@ -439,6 +475,77 @@ export const getMetrics = <ThrowOnError extends boolean = true>(
     ...options
   })
 
+/**
+ * List OIDC trust relationships
+ */
+export const listOidcTrust = <ThrowOnError extends boolean = true>(
+  options?: Options<ListOidcTrustData, ThrowOnError>
+) =>
+  (options?.client ?? client).get<
+    ListOidcTrustResponses,
+    ListOidcTrustErrors,
+    ThrowOnError,
+    'data'
+  >({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v0/oidc_trust',
+    ...options
+  })
+
+/**
+ * Create OIDC trust relationship
+ */
+export const postOidcTrust = <ThrowOnError extends boolean = true>(
+  options: Options<PostOidcTrustData, ThrowOnError>
+) =>
+  (options.client ?? client).post<
+    PostOidcTrustResponses,
+    PostOidcTrustErrors,
+    ThrowOnError,
+    'data'
+  >({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v0/oidc_trust',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers
+    }
+  })
+
+/**
+ * Delete OIDC trust relationship
+ */
+export const deleteOidcTrust = <ThrowOnError extends boolean = true>(
+  options: Options<DeleteOidcTrustData, ThrowOnError>
+) =>
+  (options.client ?? client).delete<
+    DeleteOidcTrustResponses,
+    DeleteOidcTrustErrors,
+    ThrowOnError,
+    'data'
+  >({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v0/oidc_trust/{name}',
+    ...options
+  })
+
+/**
+ * Get OIDC trust relationship
+ */
+export const getOidcTrust = <ThrowOnError extends boolean = true>(
+  options: Options<GetOidcTrustData, ThrowOnError>
+) =>
+  (options.client ?? client).get<GetOidcTrustResponses, GetOidcTrustErrors, ThrowOnError, 'data'>({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v0/oidc_trust/{name}',
+    ...options
+  })
+
 /**
  * List Pipelines
  *
@@ -902,6 +1009,39 @@ export const getPipelineDataflowGraph = <ThrowOnError extends boolean = true>(
     ...options
   })
 
+/**
+ * Compute Program Diff
+ *
+ * Compute the diff between the pipeline's current program and a proposed new
+ * version, without modifying or restarting the pipeline.
+ *
+ * The diff lists the tables, views, and connectors that would be added,
+ * removed, or modified. It is the same diff shown when approving changes during
+ * bootstrapping, letting you preview the effect of a change before applying it.
+ *
+ * The baseline is the pipeline's currently configured program compiled with its
+ * runtime, not necessarily the program in the latest checkpoint (which may have
+ * been produced by a different program or runtime version).
+ */
+export const postPipelineDiff = <ThrowOnError extends boolean = true>(
+  options: Options<PostPipelineDiffData, ThrowOnError>
+) =>
+  (options.client ?? client).post<
+    PostPipelineDiffResponses,
+    PostPipelineDiffErrors,
+    ThrowOnError,
+    'data'
+  >({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v0/pipelines/{pipeline_name}/diff',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers
+    }
+  })
+
 /**
  * Dismiss Pipeline Deployment Error
  *
@@ -1598,3 +1738,157 @@ export const getPipelineOutputConnectorStatus = <ThrowOnError extends boolean =
     url: '/v0/pipelines/{pipeline_name}/views/{view_name}/connectors/{connector_name}/stats',
     ...options
   })
+
+/**
+ * List tenant members
+ *
+ * List the users that are members of the acting tenant and their roles.
+ */
+export const listTenantUsers = <ThrowOnError extends boolean = true>(
+  options?: Options<ListTenantUsersData, ThrowOnError>
+) =>
+  (options?.client ?? client).get<
+    ListTenantUsersResponses,
+    ListTenantUsersErrors,
+    ThrowOnError,
+    'data'
+  >({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v0/tenant/users',
+    ...options
+  })
+
+/**
+ * Pre-provision a tenant member
+ *
+ * Add a member to the acting tenant by identity, before the user's first
+ * login. The grant is dormant until that identity authenticates into the
+ * tenant through the IdP. The role is capped at the caller's own role and may
+ * not be `owner`.
+ */
+export const addTenantUser = <ThrowOnError extends boolean = true>(
+  options: Options<AddTenantUserData, ThrowOnError>
+) =>
+  (options.client ?? client).post<
+    AddTenantUserResponses,
+    AddTenantUserErrors,
+    ThrowOnError,
+    'data'
+  >({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v0/tenant/users',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers
+    }
+  })
+
+/**
+ * Remove a tenant member
+ *
+ * Remove a user from the acting tenant.
+ */
+export const deleteTenantUser = <ThrowOnError extends boolean = true>(
+  options: Options<DeleteTenantUserData, ThrowOnError>
+) =>
+  (options.client ?? client).delete<
+    DeleteTenantUserResponses,
+    DeleteTenantUserErrors,
+    ThrowOnError,
+    'data'
+  >({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v0/tenant/users/{user_id}',
+    ...options
+  })
+
+/**
+ * Assign a member role
+ *
+ * Assign or change a user's role in the acting tenant. The role is capped at
+ * the caller's own role and may not be `owner`.
+ */
+export const putTenantUser = <ThrowOnError extends boolean = true>(
+  options: Options<PutTenantUserData, ThrowOnError>
+) =>
+  (options.client ?? client).put<PutTenantUserResponses, PutTenantUserErrors, ThrowOnError, 'data'>(
+    {
+      responseStyle: 'data',
+      security: [{ scheme: 'bearer', type: 'http' }],
+      url: '/v0/tenant/users/{user_id}',
+      ...options,
+      headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+      }
+    }
+  )
+
+/**
+ * List tenants
+ *
+ * List all tenants in the installation. Owner-only platform view.
+ */
+export const listTenants = <ThrowOnError extends boolean = true>(
+  options?: Options<ListTenantsData, ThrowOnError>
+) =>
+  (options?.client ?? client).get<ListTenantsResponses, ListTenantsErrors, ThrowOnError, 'data'>({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v0/tenants',
+    ...options
+  })
+
+/**
+ * Create a tenant
+ *
+ * Explicitly create a tenant (owner-only), rather than relying on first login.
+ * Fails with a conflict if a tenant with the same name and provider exists.
+ */
+export const createTenant = <ThrowOnError extends boolean = true>(
+  options: Options<CreateTenantData, ThrowOnError>
+) =>
+  (options.client ?? client).post<CreateTenantResponses, CreateTenantErrors, ThrowOnError, 'data'>({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v0/tenants',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers
+    }
+  })
+
+/**
+ * Validate Program
+ *
+ * Validate a SQL program by compiling it, without creating a pipeline or
+ * building the pipeline binary. Reports SQL errors and warnings and the derived
+ * schema and connectors. Set `ir` to also return the program IR (dataflow).
+ *
+ * Note that this endpoint returns HTTP 200, regardless of whether validation
+ * succeeds or fails. The validation result, including any compiler warnings and errors,
+ * is encoded in the `ValidateProgramResponse` response body.
+ */
+export const postValidateProgram = <ThrowOnError extends boolean = true>(
+  options: Options<PostValidateProgramData, ThrowOnError>
+) =>
+  (options.client ?? client).post<
+    PostValidateProgramResponses,
+    PostValidateProgramErrors,
+    ThrowOnError,
+    'data'
+  >({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v0/validate_program',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers
+    }
+  })
diff --git a/js-packages/web-console/src/lib/services/manager/types.gen.ts b/js-packages/web-console/src/lib/services/manager/types.gen.ts
index edeeb91a40c..3c2df7adb79 100644
--- a/js-packages/web-console/src/lib/services/manager/types.gen.ts
+++ b/js-packages/web-console/src/lib/services/manager/types.gen.ts
@@ -23,6 +23,33 @@ export type AdHocInputConfig = {
  */
 export type AdHocResultFormat = 'text' | 'json' | 'parquet' | 'arrow_ipc' | 'hash'
 
+/**
+ * Request to pre-provision a tenant member by identity, before the user's
+ * first login.
+ */
+export type AddMemberRequest = {
+  /**
+   * Optional email for display in the member list.
+   */
+  email?: string | null
+  /**
+   * OIDC issuer the user authenticates through (matches the JWT `iss` claim).
+   */
+  provider: string
+  role: Role
+  /**
+   * OIDC subject (matches the JWT `sub` claim).
+   */
+  subject: string
+}
+
+/**
+ * Response to a successful member pre-provisioning.
+ */
+export type AddMemberResponse = {
+  user_id: UserId
+}
+
 /**
  * Arguments to the `/query` endpoint.
  *
@@ -45,11 +72,14 @@ export type AdhocQueryArgs = {
 
 /**
  * API key descriptor.
+ *
+ * A key carries a single [`Role`], capped at `write`: `admin` and `owner` are
+ * never issuable as static keys (see [`crate::db::types::role::MintableKeyRole`]).
  */
 export type ApiKeyDescr = {
   id: ApiKeyId
   name: string
-  scopes: Array<ApiPermission>
+  role: Role
 }
 
 /**
@@ -57,11 +87,6 @@ export type ApiKeyDescr = {
  */
 export type ApiKeyId = string
 
-/**
- * Permission types for invoking API endpoints.
- */
-export type ApiPermission = 'Read' | 'Write'
-
 export type Auth = {
   credentials?: Credentials | null
   jwt?: string | null
@@ -1702,6 +1727,10 @@ export type DevTweaks = {
    * | no offset | offset    | wall-clock pace from the last journaled value; the new offset value is ignored |
    */
   now_offset?: string | null
+  /**
+   * Optimize input operators during transaction commit.
+   */
+  optimize_input_during_commit?: boolean | null
   /**
    * Controls the maximal number of records output by splitter operators
    * (joins, distinct, aggregation, rolling window and group operators) at
@@ -1725,8 +1754,6 @@ export type DevTweaks = {
   storage_mb_max?: number | null
   /**
    * Enable streaming exchange.
-   *
-   * `false`
    */
   streaming_exchange?: boolean | null
   [key: string]: unknown
@@ -1780,6 +1807,18 @@ export type DynamoDbWriterConfig = {
    * the selected `write_mode`.
    */
   batch_size?: number | null
+  /**
+   * [Condition expression] evaluated before each delete.
+   *
+   * When the condition is false, the delete is skipped without failing the
+   * connector. This option requires `transactional` [`write_mode`]. The
+   * expression cannot use `ExpressionAttributeNames` or
+   * `ExpressionAttributeValues` placeholders.
+   *
+   * [Condition expression]: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Expressions.ConditionExpressions.html
+   * [`write_mode`]: Self::write_mode
+   */
+  delete_condition_expression?: string | null
   /**
    * Optional endpoint URL, for example when using a local
    * DynamoDB-compatible service.
@@ -1817,6 +1856,25 @@ export type DynamoDbWriterConfig = {
    * Defaults to `10`.
    */
   max_retries?: number | null
+  /**
+   * [Condition expression] evaluated before each put (insert or upsert).
+   *
+   * When the condition is false, the record is skipped without failing the
+   * connector. This option requires `transactional` [`write_mode`].
+   *
+   * The condition gates every value write, and the connector cannot tell a
+   * replayed insert from a legitimate update: both arrive as puts. A guard
+   * such as `attribute_not_exists(id)` therefore also suppresses updates to
+   * existing keys, not just replayed duplicates. Choose the expression
+   * accordingly.
+   *
+   * The connector does not currently support `ExpressionAttributeNames` or
+   * `ExpressionAttributeValues`, so the expression cannot use placeholders.
+   *
+   * [Condition expression]: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Expressions.ConditionExpressions.html
+   * [`write_mode`]: Self::write_mode
+   */
+  put_condition_expression?: string | null
   /**
    * AWS region.
    */
@@ -3118,6 +3176,7 @@ export type NewApiKeyRequest = {
    * Key name.
    */
   name: string
+  role?: Role | null
 }
 
 /**
@@ -3136,6 +3195,63 @@ export type NewApiKeyResponse = {
   name: string
 }
 
+/**
+ * Request to create a new OIDC trust relationship.
+ */
+export type NewOidcTrustRequest = {
+  /**
+   * Optional audience claim pattern. `*` matches any sequence of characters.
+   * If omitted, the audience claim is not checked.
+   */
+  audience?: string | null
+  /**
+   * Optional human-readable description.
+   */
+  description?: string | null
+  /**
+   * Issuer URL exactly as it appears in the `iss` claim.
+   * JWKS are discovered at `<issuer>/.well-known/openid-configuration`.
+   */
+  issuer: string
+  /**
+   * Trust relationship name. Unique within the tenant.
+   */
+  name: string
+  role?: Role | null
+  /**
+   * Subject claim pattern. `*` matches any sequence of characters.
+   */
+  subject: string
+}
+
+/**
+ * Response to a successful create.
+ */
+export type NewOidcTrustResponse = {
+  id: OidcTrustId
+  name: string
+}
+
+/**
+ * Request to create a tenant (owner-only).
+ */
+export type NewTenantRequest = {
+  name: string
+  /**
+   * Identity provider the tenant is keyed under. Defaults to `manual` for
+   * tenants created out of band by an owner.
+   */
+  provider?: string | null
+}
+
+/**
+ * Response to a successful tenant creation.
+ */
+export type NewTenantResponse = {
+  id: TenantId
+  name: string
+}
+
 /**
  * Configuration for generating Nexmark input data.
  *
@@ -3222,6 +3338,27 @@ export type ObjectStorageConfig = {
   [key: string]: string
 }
 
+/**
+ * Trust relationship descriptor returned to clients.
+ *
+ * Wildcards: a `*` in `subject` or `audience` matches any sequence of
+ * characters; all other characters must match exactly.
+ */
+export type OidcTrustDescr = {
+  audience?: string | null
+  description?: string | null
+  id: OidcTrustId
+  issuer: string
+  name: string
+  role: Role
+  subject: string
+}
+
+/**
+ * Trust relationship identifier.
+ */
+export type OidcTrustId = string
+
 export type Op = {
   kind: string
   name: string
@@ -3726,6 +3863,23 @@ export type PipelineDiff = {
   removed_output_connectors: Array<string>
 }
 
+/**
+ * Request body for the pipeline diff endpoint.
+ */
+export type PipelineDiffRequest = {
+  /**
+   * New SQL program code to compare against. If omitted, the pipeline's
+   * current program code is used.
+   */
+  program_code?: string | null
+  /**
+   * Runtime version to compile the new program with: a version tag
+   * (`vX.Y.Z`) or a 40-character git SHA. If omitted, the platform's default
+   * runtime is used.
+   */
+  runtime_version?: string | null
+}
+
 export type PipelineFieldSelector = 'all' | 'status' | 'status_with_connectors'
 
 /**
@@ -4756,6 +4910,11 @@ export type RngFieldSettings = {
   }> | null
 }
 
+/**
+ * A role in the RBAC model. Declaration order defines the privilege order.
+ */
+export type Role = 'read' | 'write' | 'admin' | 'owner'
+
 /**
  * Global pipeline configuration settings. This is the publicly
  * exposed type for users to configure pipelines.
@@ -5148,6 +5307,11 @@ export type ServiceStatus = {
 }
 
 export type SessionInfo = {
+  /**
+   * Whether the caller is a platform owner.
+   */
+  is_owner: boolean
+  role: Role
   tenant_id: TenantId
   /**
    * Current user's tenant name
@@ -5155,6 +5319,13 @@ export type SessionInfo = {
   tenant_name: string
 }
 
+/**
+ * Request to assign a role to a user within a tenant.
+ */
+export type SetMemberRoleRequest = {
+  role: Role
+}
+
 /**
  * Schema definition for endpoint config that only includes the stream field.
  */
@@ -5593,6 +5764,35 @@ export type TemporarySuspendError =
 
 export type TenantId = string
 
+/**
+ * A tenant, as returned by the platform (owner-only) tenant list.
+ */
+export type TenantInfo = {
+  id: TenantId
+  name: string
+  provider: string
+}
+
+/**
+ * A member of a tenant, as returned by the user-management API.
+ */
+export type TenantMember = {
+  /**
+   * Email, if the identity provider supplied one.
+   */
+  email?: string | null
+  /**
+   * OIDC issuer the user authenticates through.
+   */
+  provider: string
+  role: Role
+  /**
+   * OIDC subject.
+   */
+  subject: string
+  user_id: UserId
+}
+
 /**
  * Time series to make graphs in the web console easier.
  */
@@ -5779,6 +5979,62 @@ export type UserAndPassword = {
   user: string
 }
 
+/**
+ * Identifier of a persisted user (the principal behind an OIDC `sub`).
+ */
+export type UserId = string
+
+/**
+ * Request body for the program validation endpoint.
+ */
+export type ValidateProgramRequest = {
+  /**
+   * Return the program IR (dataflow) in the response. `false` by default;
+   * most callers only need to know whether the program is valid.
+   */
+  ir?: boolean
+  /**
+   * SQL program code to validate.
+   */
+  program_code: string
+  /**
+   * Runtime version to compile with: a version tag (`vX.Y.Z`) or a
+   * 40-character git SHA. If omitted, the platform's default runtime is used.
+   */
+  runtime_version?: string | null
+}
+
+/**
+ * Outcome of validating a SQL program.
+ */
+export type ValidateProgramResponse =
+  | {
+      /**
+       * Validation succeeded; `program_info` is the serialized `ProgramInfo` with
+       * the Rust artifacts omitted (and the dataflow omitted unless `ir` was set).
+       */
+      Success: {
+        program_info: unknown
+      }
+    }
+  | {
+      /**
+       * The SQL program failed to compile.
+       */
+      SqlError: {
+        info: SqlCompilationInfo
+      }
+    }
+  | {
+      /**
+       * A system error prevented validation (e.g., the runtime-specific SQL
+       * compiler could not be downloaded).
+       */
+      SystemError: {
+        error: string
+      }
+    }
+
 /**
  * Version number.
  */
@@ -6086,6 +6342,115 @@ export type GetMetricsResponses = {
 
 export type GetMetricsResponse = GetMetricsResponses[keyof GetMetricsResponses]
 
+export type ListOidcTrustData = {
+  body?: never
+  path?: never
+  query?: never
+  url: '/v0/oidc_trust'
+}
+
+export type ListOidcTrustErrors = {
+  500: ErrorResponse
+}
+
+export type ListOidcTrustError = ListOidcTrustErrors[keyof ListOidcTrustErrors]
+
+export type ListOidcTrustResponses = {
+  /**
+   * Trust relationships retrieved
+   */
+  200: Array<OidcTrustDescr>
+}
+
+export type ListOidcTrustResponse = ListOidcTrustResponses[keyof ListOidcTrustResponses]
+
+export type PostOidcTrustData = {
+  body: NewOidcTrustRequest
+  path?: never
+  query?: never
+  url: '/v0/oidc_trust'
+}
+
+export type PostOidcTrustErrors = {
+  /**
+   * Invalid request
+   */
+  400: ErrorResponse
+  /**
+   * Name already in use
+   */
+  409: ErrorResponse
+}
+
+export type PostOidcTrustError = PostOidcTrustErrors[keyof PostOidcTrustErrors]
+
+export type PostOidcTrustResponses = {
+  /**
+   * Trust relationship created
+   */
+  201: NewOidcTrustResponse
+}
+
+export type PostOidcTrustResponse = PostOidcTrustResponses[keyof PostOidcTrustResponses]
+
+export type DeleteOidcTrustData = {
+  body?: never
+  path: {
+    /**
+     * Trust relationship name
+     */
+    name: string
+  }
+  query?: never
+  url: '/v0/oidc_trust/{name}'
+}
+
+export type DeleteOidcTrustErrors = {
+  /**
+   * No relationship with that name
+   */
+  404: ErrorResponse
+}
+
+export type DeleteOidcTrustError = DeleteOidcTrustErrors[keyof DeleteOidcTrustErrors]
+
+export type DeleteOidcTrustResponses = {
+  /**
+   * Trust relationship deleted
+   */
+  200: unknown
+}
+
+export type GetOidcTrustData = {
+  body?: never
+  path: {
+    /**
+     * Trust relationship name
+     */
+    name: string
+  }
+  query?: never
+  url: '/v0/oidc_trust/{name}'
+}
+
+export type GetOidcTrustErrors = {
+  /**
+   * No relationship with that name
+   */
+  404: ErrorResponse
+}
+
+export type GetOidcTrustError = GetOidcTrustErrors[keyof GetOidcTrustErrors]
+
+export type GetOidcTrustResponses = {
+  /**
+   * Trust relationship retrieved
+   */
+  200: OidcTrustDescr
+}
+
+export type GetOidcTrustResponse = GetOidcTrustResponses[keyof GetOidcTrustResponses]
+
 export type ListPipelinesData = {
   body?: never
   path?: never
@@ -6823,6 +7188,52 @@ export type GetPipelineDataflowGraphResponses = {
 export type GetPipelineDataflowGraphResponse =
   GetPipelineDataflowGraphResponses[keyof GetPipelineDataflowGraphResponses]
 
+export type PostPipelineDiffData = {
+  /**
+   * The proposed new SQL program and/or runtime version (both optional)
+   */
+  body: PipelineDiffRequest
+  path: {
+    /**
+     * Unique pipeline name
+     */
+    pipeline_name: string
+  }
+  query?: never
+  url: '/v0/pipelines/{pipeline_name}/diff'
+}
+
+export type PostPipelineDiffErrors = {
+  /**
+   * The new program failed to compile or the change cannot be bootstrapped
+   */
+  400: ErrorResponse
+  /**
+   * Pipeline does not exist or its current program has not been compiled
+   */
+  404: ErrorResponse
+  500: ErrorResponse
+  /**
+   * The compiler service is unavailable
+   */
+  503: ErrorResponse
+  /**
+   * The compiler did not respond within the configured timeout
+   */
+  504: ErrorResponse
+}
+
+export type PostPipelineDiffError = PostPipelineDiffErrors[keyof PostPipelineDiffErrors]
+
+export type PostPipelineDiffResponses = {
+  /**
+   * Diff successfully computed
+   */
+  200: PipelineDiff
+}
+
+export type PostPipelineDiffResponse = PostPipelineDiffResponses[keyof PostPipelineDiffResponses]
+
 export type PostPipelineDismissErrorData = {
   body?: never
   path: {
@@ -7933,3 +8344,191 @@ export type GetPipelineOutputConnectorStatusResponses = {
 
 export type GetPipelineOutputConnectorStatusResponse =
   GetPipelineOutputConnectorStatusResponses[keyof GetPipelineOutputConnectorStatusResponses]
+
+export type ListTenantUsersData = {
+  body?: never
+  path?: never
+  query?: never
+  url: '/v0/tenant/users'
+}
+
+export type ListTenantUsersErrors = {
+  500: ErrorResponse
+}
+
+export type ListTenantUsersError = ListTenantUsersErrors[keyof ListTenantUsersErrors]
+
+export type ListTenantUsersResponses = {
+  /**
+   * Members retrieved
+   */
+  200: Array<TenantMember>
+}
+
+export type ListTenantUsersResponse = ListTenantUsersResponses[keyof ListTenantUsersResponses]
+
+export type AddTenantUserData = {
+  body: AddMemberRequest
+  path?: never
+  query?: never
+  url: '/v0/tenant/users'
+}
+
+export type AddTenantUserErrors = {
+  /**
+   * Requested role exceeds caller's role or is owner
+   */
+  403: ErrorResponse
+}
+
+export type AddTenantUserError = AddTenantUserErrors[keyof AddTenantUserErrors]
+
+export type AddTenantUserResponses = {
+  /**
+   * Member added
+   */
+  200: AddMemberResponse
+}
+
+export type AddTenantUserResponse = AddTenantUserResponses[keyof AddTenantUserResponses]
+
+export type DeleteTenantUserData = {
+  body?: never
+  path: {
+    /**
+     * User identifier
+     */
+    user_id: string
+  }
+  query?: never
+  url: '/v0/tenant/users/{user_id}'
+}
+
+export type DeleteTenantUserErrors = {
+  /**
+   * User is not a member
+   */
+  404: ErrorResponse
+}
+
+export type DeleteTenantUserError = DeleteTenantUserErrors[keyof DeleteTenantUserErrors]
+
+export type DeleteTenantUserResponses = {
+  /**
+   * Member removed
+   */
+  200: unknown
+}
+
+export type PutTenantUserData = {
+  body: SetMemberRoleRequest
+  path: {
+    /**
+     * User identifier
+     */
+    user_id: string
+  }
+  query?: never
+  url: '/v0/tenant/users/{user_id}'
+}
+
+export type PutTenantUserErrors = {
+  /**
+   * Requested role exceeds caller's role or is owner
+   */
+  403: ErrorResponse
+}
+
+export type PutTenantUserError = PutTenantUserErrors[keyof PutTenantUserErrors]
+
+export type PutTenantUserResponses = {
+  /**
+   * Role assigned
+   */
+  200: unknown
+}
+
+export type ListTenantsData = {
+  body?: never
+  path?: never
+  query?: never
+  url: '/v0/tenants'
+}
+
+export type ListTenantsErrors = {
+  500: ErrorResponse
+}
+
+export type ListTenantsError = ListTenantsErrors[keyof ListTenantsErrors]
+
+export type ListTenantsResponses = {
+  /**
+   * Tenants retrieved
+   */
+  200: Array<TenantInfo>
+}
+
+export type ListTenantsResponse = ListTenantsResponses[keyof ListTenantsResponses]
+
+export type CreateTenantData = {
+  body: NewTenantRequest
+  path?: never
+  query?: never
+  url: '/v0/tenants'
+}
+
+export type CreateTenantErrors = {
+  /**
+   * A tenant with that name and provider already exists
+   */
+  409: ErrorResponse
+}
+
+export type CreateTenantError = CreateTenantErrors[keyof CreateTenantErrors]
+
+export type CreateTenantResponses = {
+  /**
+   * Tenant created
+   */
+  201: NewTenantResponse
+}
+
+export type CreateTenantResponse = CreateTenantResponses[keyof CreateTenantResponses]
+
+export type PostValidateProgramData = {
+  /**
+   * The SQL program to validate, an optional runtime version, and whether to return the IR
+   */
+  body: ValidateProgramRequest
+  path?: never
+  query?: never
+  url: '/v0/validate_program'
+}
+
+export type PostValidateProgramErrors = {
+  /**
+   * The requested runtime version is invalid
+   */
+  400: ErrorResponse
+  500: ErrorResponse
+  /**
+   * The compiler service is unavailable
+   */
+  503: ErrorResponse
+  /**
+   * The compiler did not respond within the configured timeout
+   */
+  504: ErrorResponse
+}
+
+export type PostValidateProgramError = PostValidateProgramErrors[keyof PostValidateProgramErrors]
+
+export type PostValidateProgramResponses = {
+  /**
+   * Validation completed; the body reports success, SQL errors, or a system error
+   */
+  200: ValidateProgramResponse
+}
+
+export type PostValidateProgramResponse =
+  PostValidateProgramResponses[keyof PostValidateProgramResponses]
diff --git a/js-packages/web-console/src/lib/services/pipelineManager.ts b/js-packages/web-console/src/lib/services/pipelineManager.ts
index 80cde74deb0..84a5a61bdc6 100644
--- a/js-packages/web-console/src/lib/services/pipelineManager.ts
+++ b/js-packages/web-console/src/lib/services/pipelineManager.ts
@@ -1,27 +1,37 @@
 import {
+  addTenantUser as _addTenantUser,
   type CombinedDesiredStatus as _CombinedDesiredStatus,
   type CombinedStatus as _CombinedStatus,
   checkpointPipeline as _checkpointPipeline,
+  createTenant as _createTenant,
   deleteApiKey as _deleteApiKey,
+  deleteOidcTrust as _deleteOidcTrust,
   deletePipeline as _deletePipeline,
+  deleteTenantUser as _deleteTenantUser,
   getCheckpointStatus as _getCheckpointStatus,
   getCheckpointSyncStatus as _getCheckpointSyncStatus,
   getCheckpoints as _getCheckpoints,
   getClusterEvent as _getClusterEvent,
   getConfig as _getConfig,
   getConfigSession as _getConfigSession,
+  getOidcTrust as _getOidcTrust,
   getPipeline as _getPipeline,
   getPipelineDataflowGraph as _getPipelineDataflowGraph,
   getPipelineEvent as _getPipelineEvent,
   getPipelineInputConnectorStatus as _getPipelineInputConnectorStatus,
   getPipelineOutputConnectorStatus as _getPipelineOutputConnectorStatus,
   getPipelineStats as _getPipelineStats,
+  listOidcTrust as _listOidcTrust,
+  listTenants as _listTenants,
+  listTenantUsers as _listTenantUsers,
   type ProgramStatus as _ProgramStatus,
   patchPipeline as _patchPipeline,
   postApiKey as _postApiKey,
+  postOidcTrust as _postOidcTrust,
   postPipeline as _postPipeline,
   postUpdateRuntime as _postUpdateRuntime,
   putPipeline as _putPipeline,
+  putTenantUser as _putTenantUser,
   syncCheckpoint as _syncCheckpoint,
   type CheckpointMetadata,
   type CheckpointResponse,
@@ -36,6 +46,7 @@ import {
   listClusterEvents,
   listPipelineEvents,
   listPipelines,
+  type NewOidcTrustRequest,
   type PatchPipeline,
   type PipelineSelectedInfo,
   type PostPutPipeline,
@@ -48,7 +59,9 @@ import {
   postPipelineResume,
   postPipelineStart,
   postPipelineStop,
-  startSamplyProfile
+  startSamplyProfile,
+  type TenantInfo,
+  type TenantMember
 } from '$lib/services/manager'
 
 export type {
@@ -59,8 +72,12 @@ export type {
   CheckpointStatus,
   InputEndpointConfig,
   InputEndpointStatus,
+  NewOidcTrustRequest,
+  // RBAC/OIDC-trust/tenant admin types (generated from the manager's OpenAPI).
+  OidcTrustDescr,
   OutputEndpointConfig,
   OutputEndpointStatus,
+  Role,
   RuntimeConfig,
   SqlCompilerMessage
 } from '$lib/services/manager'
@@ -593,8 +610,10 @@ export const getConfigSession = (options?: FetchOptions) =>
 
 export const getApiKeys = (options?: FetchOptions) => mapResponse(listApiKeys(options), (v) => v)
 
-export const postApiKey = (name: string, options?: FetchOptions) =>
-  mapResponse(_postApiKey({ body: { name }, ...options }), (v) => v)
+export type ApiKeyRole = 'read' | 'write'
+
+export const postApiKey = (name: string, role: ApiKeyRole = 'read', options?: FetchOptions) =>
+  mapResponse(_postApiKey({ body: { name, role }, ...options }), (v) => v)
 
 export const deleteApiKey = (name: string, options?: FetchOptions) =>
   mapResponse(
@@ -605,72 +624,57 @@ export const deleteApiKey = (name: string, options?: FetchOptions) =>
     }
   )
 
-// OIDC trust relationships
-//
-// These wrappers talk to the manager directly instead of going through the
-// generated client because the SDK has not yet been regenerated against the
-// new endpoints. After running `bun run generate-openapi`, these can be
-// replaced with calls to the generated `listOidcTrust` / `postOidcTrust` /
-// `deleteOidcTrust` functions.
-import { getAuthorizationHeaders } from '$lib/services/auth'
-
-export type OidcTrustDescr = {
-  id: string
-  name: string
-  description?: string | null
-  issuer: string
-  subject: string
-  audience?: string | null
-  scopes: ('Read' | 'Write')[]
-}
+// A tenant member (generated `TenantMember`). Members appear after their first
+// login or via pre-provisioning; `role` is normally read/write/admin, but an
+// owner resolved by the IdP can also appear and is shown read-only.
+export type TenantUser = TenantMember
+export type Tenant = TenantInfo
 
-export type NewOidcTrustRequest = {
-  name: string
-  issuer: string
-  subject: string
-  audience?: string
-  description?: string
-}
+// OIDC trust relationships, tenant users, and tenant administration. These go
+// through the generated client (same auth + 401-refresh interceptors as every
+// other call), wrapped in `mapResponse` for uniform error handling.
 
-const oidcTrustFetch = async (path: string, init?: RequestInit) => {
-  const authHeaders = await getAuthorizationHeaders()
-  const res = await fetch(`${felderaEndpoint}/v0${path}`, {
-    ...init,
-    headers: {
-      Accept: 'application/json',
-      'Content-Type': 'application/json',
-      ...authHeaders,
-      ...(init?.headers ?? {})
-    }
-  })
-  if (!res.ok) {
-    const body = await res.text()
-    let message = `Request to ${path} failed: ${res.status}`
-    try {
-      const parsed = JSON.parse(body)
-      if (parsed?.message) message = parsed.message
-    } catch {
-      // ignore
-    }
-    throw new Error(message)
-  }
-  if (res.status === 204 || res.headers.get('content-length') === '0') return null
-  return res.json()
-}
+export const getOidcTrustList = (options?: FetchOptions) =>
+  mapResponse(_listOidcTrust({ ...options }), (v) => v ?? [])
 
-export const getOidcTrustList = (): Promise<OidcTrustDescr[]> =>
-  oidcTrustFetch('/oidc_trust').then((v) => (v as OidcTrustDescr[]) ?? [])
+export const postOidcTrust = (body: NewOidcTrustRequest, options?: FetchOptions) =>
+  mapResponse(_postOidcTrust({ body, ...options }), (v) => v)
 
-export const postOidcTrust = (
-  body: NewOidcTrustRequest
-): Promise<{ id: string; name: string }> =>
-  oidcTrustFetch('/oidc_trust', {
-    method: 'POST',
-    body: JSON.stringify(body)
-  })
+export const deleteOidcTrust = (name: string, options?: FetchOptions) =>
+  mapResponse(_deleteOidcTrust({ path: { name }, ...options }), (v) => v)
+
+// Tenant users & roles (min role: admin).
 
-export const deleteOidcTrust = (name: string): Promise<unknown> =>
-  oidcTrustFetch(`/oidc_trust/${encodeURIComponent(name)}`, { method: 'DELETE' })
+export const getTenantUsers = (options?: FetchOptions) =>
+  mapResponse(_listTenantUsers({ ...options }), (v) => v ?? [])
+
+// Pre-provision a member by identity, before their first login. The grant is
+// dormant until that identity authenticates into the tenant through the IdP.
+export const addTenantUser = (
+  body: { provider: string; subject: string; email?: string; role: 'read' | 'write' | 'admin' },
+  options?: FetchOptions
+) => mapResponse(_addTenantUser({ body, ...options }), (v) => v)
+
+export const setTenantUserRole = (
+  userId: string,
+  role: 'read' | 'write' | 'admin',
+  options?: FetchOptions
+) =>
+  mapResponse(_putTenantUser({ path: { user_id: userId }, body: { role }, ...options }), (v) => v)
+
+export const removeTenantUser = (userId: string, options?: FetchOptions) =>
+  mapResponse(_deleteTenantUser({ path: { user_id: userId }, ...options }), (v) => v)
+
+// Tenant administration (min role: owner).
+
+export const getTenants = (options?: FetchOptions) =>
+  mapResponse(_listTenants({ ...options }), (v) => v ?? [])
+
+export const createTenant = (name: string, provider?: string, options?: FetchOptions) =>
+  mapResponse(
+    _createTenant({ body: { name, ...(provider ? { provider } : {}) }, ...options }),
+    (v) => v
+  )
 
 export const dismissDeploymentError = (pipeline_name: string) =>
   mapResponse(postPipelineDismissError({ path: { pipeline_name } }), (v) => v)
diff --git a/js-packages/web-console/src/routes/(system)/(authenticated)/admin/+page.svelte b/js-packages/web-console/src/routes/(system)/(authenticated)/admin/+page.svelte
new file mode 100644
index 00000000000..55ec3ea28bb
--- /dev/null
+++ b/js-packages/web-console/src/routes/(system)/(authenticated)/admin/+page.svelte
@@ -0,0 +1,27 @@
+<script lang="ts">
+  import AdminPage from '$lib/components/admin/AdminPage.svelte'
+  import AppHeader from '$lib/components/layout/AppHeader.svelte'
+  import PipelineBreadcrumbs from '$lib/components/layout/PipelineBreadcrumbs.svelte'
+  import { resolve } from '$lib/functions/svelte'
+</script>
+
+<svelte:head>
+  <title>Administration — Feldera</title>
+</svelte:head>
+
+<div class="flex h-screen flex-col overflow-hidden">
+  <AppHeader>
+    {#snippet afterStart()}
+      <PipelineBreadcrumbs
+        breadcrumbs={[
+          { text: 'Home', href: resolve('/') },
+          { text: 'Admin', href: resolve('/admin') }
+        ]}
+      ></PipelineBreadcrumbs>
+    {/snippet}
+  </AppHeader>
+
+  <div class="scrollbar flex-1 overflow-auto pt-4">
+    <AdminPage></AdminPage>
+  </div>
+</div>
diff --git a/js-packages/web-console/src/routes/(system)/(authenticated)/admin/+page.ts b/js-packages/web-console/src/routes/(system)/(authenticated)/admin/+page.ts
new file mode 100644
index 00000000000..8a6fe282d7b
--- /dev/null
+++ b/js-packages/web-console/src/routes/(system)/(authenticated)/admin/+page.ts
@@ -0,0 +1,13 @@
+import type { LoadEvent } from '@sveltejs/kit'
+import { redirect } from '@sveltejs/kit'
+import { resolve } from '$lib/functions/svelte'
+
+// Gate the admin area: only admins and owners may enter; everyone else goes home.
+export const load = async ({ parent }: LoadEvent) => {
+  const data = await parent()
+  const role = data.feldera?.role
+  if (role !== 'admin' && role !== 'owner') {
+    throw redirect(307, resolve('/'))
+  }
+  return {}
+}
diff --git a/js-packages/web-console/src/routes/+layout.ts b/js-packages/web-console/src/routes/+layout.ts
index 7e01509db32..2a1ce43b681 100644
--- a/js-packages/web-console/src/routes/+layout.ts
+++ b/js-packages/web-console/src/routes/+layout.ts
@@ -99,6 +99,14 @@ export type LayoutData = {
         }
         tenantId: string
         tenantName: string
+        /**
+         * Caller's RBAC role in the current tenant: read < write < admin < owner.
+         */
+        role: 'read' | 'write' | 'admin' | 'owner'
+        /**
+         * True when the caller owns the tenant (gates owner-only admin UI).
+         */
+        isOwner: boolean
         /**
          * Only available if authenticated and using multi-tenant authorization
          */
@@ -130,13 +138,17 @@ const computeAuthorizedTenants = (auth: AuthDetails): string[] | undefined => {
 }
 
 const applyTenantSelection = (authorizedTenants: string[] | undefined) => {
-  if (authorizedTenants) {
-    const savedTenant = getSelectedTenant()
-    if (!savedTenant || !authorizedTenants.includes(savedTenant)) {
-      setSelectedTenant(authorizedTenants[0])
-    }
-  } else {
-    setSelectedTenant(undefined)
+  // Only a claim-based authorized list clamps the selection (a multi-tenant
+  // user must land on a tenant the IdP actually authorizes). When there is no
+  // such list, e.g. a platform owner whose token carries no `tenants` claim,
+  // leave the saved selection untouched so the owner's "act as <tenant>" choice
+  // persists across loads instead of being cleared on every navigation.
+  if (!authorizedTenants) {
+    return
+  }
+  const savedTenant = getSelectedTenant()
+  if (!savedTenant || !authorizedTenants.includes(savedTenant)) {
+    setSelectedTenant(authorizedTenants[0])
   }
 }
 
@@ -404,6 +416,10 @@ function buildFelderaData(
     revision: config.revision,
     tenantId: sessionConfig?.tenant_id || '',
     tenantName: sessionConfig?.tenant_name || '',
+    // `role`/`is_owner` are added by the RBAC backend; the SDK type lags, so read
+    // them off the session payload and default to the least-privileged role.
+    role: sessionConfig?.role || 'read',
+    isOwner: Boolean(sessionConfig?.is_owner),
     authorizedTenants: computeAuthorizedTenants(auth),
     unstableFeatures: config.unstable_features?.split(',').map((f: string) => f.trim()) || [],
     config
diff --git a/openapi.json b/openapi.json
index 60708a8cf3b..a2394b9841f 100644
--- a/openapi.json
+++ b/openapi.json
@@ -7278,6 +7278,266 @@
         ]
       }
     },
+    "/v0/tenant/users": {
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "List tenant members",
+        "description": "List the users that are members of the acting tenant and their roles.",
+        "operationId": "list_tenant_users",
+        "responses": {
+          "200": {
+            "description": "Members retrieved",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/TenantMember"
+                  }
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "JSON web token (JWT) or API key": []
+          }
+        ]
+      },
+      "post": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Pre-provision a tenant member",
+        "description": "Add a member to the acting tenant by identity, before the user's first\nlogin. The grant is dormant until that identity authenticates into the\ntenant through the IdP. The role is capped at the caller's own role and may\nnot be `owner`.",
+        "operationId": "add_tenant_user",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AddMemberRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "description": "Member added",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AddMemberResponse"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Requested role exceeds caller's role or is owner",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "JSON web token (JWT) or API key": []
+          }
+        ]
+      }
+    },
+    "/v0/tenant/users/{user_id}": {
+      "put": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Assign a member role",
+        "description": "Assign or change a user's role in the acting tenant. The role is capped at\nthe caller's own role and may not be `owner`.",
+        "operationId": "put_tenant_user",
+        "parameters": [
+          {
+            "name": "user_id",
+            "in": "path",
+            "description": "User identifier",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SetMemberRoleRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "description": "Role assigned"
+          },
+          "403": {
+            "description": "Requested role exceeds caller's role or is owner",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "JSON web token (JWT) or API key": []
+          }
+        ]
+      },
+      "delete": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Remove a tenant member",
+        "description": "Remove a user from the acting tenant.",
+        "operationId": "delete_tenant_user",
+        "parameters": [
+          {
+            "name": "user_id",
+            "in": "path",
+            "description": "User identifier",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Member removed"
+          },
+          "404": {
+            "description": "User is not a member",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "JSON web token (JWT) or API key": []
+          }
+        ]
+      }
+    },
+    "/v0/tenants": {
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "List tenants",
+        "description": "List all tenants in the installation. Owner-only platform view.",
+        "operationId": "list_tenants",
+        "responses": {
+          "200": {
+            "description": "Tenants retrieved",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/TenantInfo"
+                  }
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "JSON web token (JWT) or API key": []
+          }
+        ]
+      },
+      "post": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Create a tenant",
+        "description": "Explicitly create a tenant (owner-only), rather than relying on first login.\nFails with a conflict if a tenant with the same name and provider exists.",
+        "operationId": "create_tenant",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/NewTenantRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "description": "Tenant created",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NewTenantResponse"
+                }
+              }
+            }
+          },
+          "409": {
+            "description": "A tenant with that name and provider already exists",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "JSON web token (JWT) or API key": []
+          }
+        ]
+      }
+    },
     "/v0/validate_program": {
       "post": {
         "tags": [
@@ -7383,6 +7643,47 @@
           "hash"
         ]
       },
+      "AddMemberRequest": {
+        "type": "object",
+        "description": "Request to pre-provision a tenant member by identity, before the user's\nfirst login.",
+        "required": [
+          "provider",
+          "subject",
+          "role"
+        ],
+        "properties": {
+          "email": {
+            "type": "string",
+            "description": "Optional email for display in the member list.",
+            "nullable": true
+          },
+          "provider": {
+            "type": "string",
+            "description": "OIDC issuer the user authenticates through (matches the JWT `iss` claim).",
+            "example": "https://accounts.google.com"
+          },
+          "role": {
+            "$ref": "#/components/schemas/Role"
+          },
+          "subject": {
+            "type": "string",
+            "description": "OIDC subject (matches the JWT `sub` claim).",
+            "example": "user@acme.com"
+          }
+        }
+      },
+      "AddMemberResponse": {
+        "type": "object",
+        "description": "Response to a successful member pre-provisioning.",
+        "required": [
+          "user_id"
+        ],
+        "properties": {
+          "user_id": {
+            "$ref": "#/components/schemas/UserId"
+          }
+        }
+      },
       "AdhocQueryArgs": {
         "type": "object",
         "description": "Arguments to the `/query` endpoint.\n\nThe arguments can be provided in two ways:\n\n- In case a normal HTTP connection is established to the endpoint,\nthese arguments are passed as URL-encoded parameters.\nNote: this mode is deprecated and will be removed in the future.\n\n- If a Websocket connection is opened to `/query`, the arguments are passed\nto the server over the websocket as a JSON encoded string.",
@@ -7398,11 +7699,11 @@
       },
       "ApiKeyDescr": {
         "type": "object",
-        "description": "API key descriptor.",
+        "description": "API key descriptor.\n\nA key carries a single [`Role`], capped at `write`: `admin` and `owner` are\nnever issuable as static keys (see [`crate::db::types::role::MintableKeyRole`]).",
         "required": [
           "id",
           "name",
-          "scopes"
+          "role"
         ],
         "properties": {
           "id": {
@@ -7411,11 +7712,8 @@
           "name": {
             "type": "string"
           },
-          "scopes": {
-            "type": "array",
-            "items": {
-              "$ref": "#/components/schemas/ApiPermission"
-            }
+          "role": {
+            "$ref": "#/components/schemas/Role"
           }
         }
       },
@@ -7424,14 +7722,6 @@
         "format": "uuid",
         "description": "API key identifier."
       },
-      "ApiPermission": {
-        "type": "string",
-        "description": "Permission types for invoking API endpoints.",
-        "enum": [
-          "Read",
-          "Write"
-        ]
-      },
       "Auth": {
         "type": "object",
         "properties": {
@@ -11006,6 +11296,14 @@
             "type": "string",
             "description": "Key name.",
             "example": "my-api-key"
+          },
+          "role": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/Role"
+              }
+            ],
+            "nullable": true
           }
         }
       },
@@ -11064,6 +11362,14 @@
             "description": "Trust relationship name. Unique within the tenant.",
             "example": "github-actions-prod"
           },
+          "role": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/Role"
+              }
+            ],
+            "nullable": true
+          },
           "subject": {
             "type": "string",
             "description": "Subject claim pattern. `*` matches any sequence of characters.",
@@ -11087,6 +11393,40 @@
           }
         }
       },
+      "NewTenantRequest": {
+        "type": "object",
+        "description": "Request to create a tenant (owner-only).",
+        "required": [
+          "name"
+        ],
+        "properties": {
+          "name": {
+            "type": "string",
+            "example": "acme"
+          },
+          "provider": {
+            "type": "string",
+            "description": "Identity provider the tenant is keyed under. Defaults to `manual` for\ntenants created out of band by an owner.",
+            "nullable": true
+          }
+        }
+      },
+      "NewTenantResponse": {
+        "type": "object",
+        "description": "Response to a successful tenant creation.",
+        "required": [
+          "id",
+          "name"
+        ],
+        "properties": {
+          "id": {
+            "$ref": "#/components/schemas/TenantId"
+          },
+          "name": {
+            "type": "string"
+          }
+        }
+      },
       "NexmarkInputConfig": {
         "type": "object",
         "description": "Configuration for generating Nexmark input data.\n\nThis connector must be used exactly three times in a pipeline if it is used\nat all, once for each [`NexmarkTable`].",
@@ -11173,7 +11513,7 @@
           "name",
           "issuer",
           "subject",
-          "scopes"
+          "role"
         ],
         "properties": {
           "audience": {
@@ -11193,11 +11533,8 @@
           "name": {
             "type": "string"
           },
-          "scopes": {
-            "type": "array",
-            "items": {
-              "$ref": "#/components/schemas/ApiPermission"
-            }
+          "role": {
+            "$ref": "#/components/schemas/Role"
           },
           "subject": {
             "type": "string"
@@ -13532,6 +13869,16 @@
         },
         "additionalProperties": false
       },
+      "Role": {
+        "type": "string",
+        "description": "A role in the RBAC model. Declaration order defines the privilege order.",
+        "enum": [
+          "read",
+          "write",
+          "admin",
+          "owner"
+        ]
+      },
       "RuntimeConfig": {
         "type": "object",
         "description": "Global pipeline configuration settings. This is the publicly\nexposed type for users to configure pipelines.",
@@ -13977,9 +14324,18 @@
         "type": "object",
         "required": [
           "tenant_id",
-          "tenant_name"
+          "tenant_name",
+          "role",
+          "is_owner"
         ],
         "properties": {
+          "is_owner": {
+            "type": "boolean",
+            "description": "Whether the caller is a platform owner."
+          },
+          "role": {
+            "$ref": "#/components/schemas/Role"
+          },
           "tenant_id": {
             "$ref": "#/components/schemas/TenantId"
           },
@@ -13989,6 +14345,18 @@
           }
         }
       },
+      "SetMemberRoleRequest": {
+        "type": "object",
+        "description": "Request to assign a role to a user within a tenant.",
+        "required": [
+          "role"
+        ],
+        "properties": {
+          "role": {
+            "$ref": "#/components/schemas/Role"
+          }
+        }
+      },
       "ShortEndpointConfig": {
         "type": "object",
         "description": "Schema definition for endpoint config that only includes the stream field.",
@@ -14564,6 +14932,57 @@
         "type": "string",
         "format": "uuid"
       },
+      "TenantInfo": {
+        "type": "object",
+        "description": "A tenant, as returned by the platform (owner-only) tenant list.",
+        "required": [
+          "id",
+          "name",
+          "provider"
+        ],
+        "properties": {
+          "id": {
+            "$ref": "#/components/schemas/TenantId"
+          },
+          "name": {
+            "type": "string"
+          },
+          "provider": {
+            "type": "string"
+          }
+        }
+      },
+      "TenantMember": {
+        "type": "object",
+        "description": "A member of a tenant, as returned by the user-management API.",
+        "required": [
+          "user_id",
+          "provider",
+          "subject",
+          "role"
+        ],
+        "properties": {
+          "email": {
+            "type": "string",
+            "description": "Email, if the identity provider supplied one.",
+            "nullable": true
+          },
+          "provider": {
+            "type": "string",
+            "description": "OIDC issuer the user authenticates through."
+          },
+          "role": {
+            "$ref": "#/components/schemas/Role"
+          },
+          "subject": {
+            "type": "string",
+            "description": "OIDC subject."
+          },
+          "user_id": {
+            "$ref": "#/components/schemas/UserId"
+          }
+        }
+      },
       "TimeSeries": {
         "type": "object",
         "description": "Time series to make graphs in the web console easier.",
@@ -15125,6 +15544,11 @@
           }
         }
       },
+      "UserId": {
+        "type": "string",
+        "format": "uuid",
+        "description": "Identifier of a persisted user (the principal behind an OIDC `sub`)."
+      },
       "ValidateProgramRequest": {
         "type": "object",
         "description": "Request body for the program validation endpoint.",
diff --git a/python/feldera/rest/_httprequests.py b/python/feldera/rest/_httprequests.py
index bba72c6a3b5..8c9353404df 100644
--- a/python/feldera/rest/_httprequests.py
+++ b/python/feldera/rest/_httprequests.py
@@ -77,11 +77,14 @@ def _resolve_bearer(self) -> Optional[str]:
         return key
 
     def _headers_with_auth(self) -> dict:
-        """Headers for the next request, with a freshly-resolved bearer."""
+        """Headers for the next request, with a freshly-resolved bearer and the
+        selected tenant (if any)."""
         headers = dict(self.headers)
         token = self._resolve_bearer()
         if token:
             headers["Authorization"] = f"Bearer {token}"
+        if self.config.tenant:
+            headers["Feldera-Tenant"] = self.config.tenant
         return headers
 
     def _check_cluster_health(self) -> bool:
@@ -93,7 +96,7 @@ def _check_cluster_health(self) -> bool:
             response = requests.get(
                 health_path,
                 timeout=(self.config.connection_timeout, self.config.timeout),
-                headers=self.headers,
+                headers=self._headers_with_auth(),
                 verify=self.requests_verify,
             )
 
@@ -210,7 +213,6 @@ def send_request(
           (capped at `max_backoff`).
         - All other errors are raised immediately.
         """
-        self.headers["Content-Type"] = content_type
         request_path = self.config.url + "/" + self.config.version + path
 
         # Serialize the body once, not per retry. None / bytes / `serialize=False`
diff --git a/python/feldera/rest/config.py b/python/feldera/rest/config.py
index d7da4964c8d..ac620c2b9c1 100644
--- a/python/feldera/rest/config.py
+++ b/python/feldera/rest/config.py
@@ -27,6 +27,7 @@ def __init__(
         connection_timeout: Optional[float] = None,
         requests_verify: Optional[bool | str] = None,
         retry_config: Optional[RetryConfig] = None,
+        tenant: Optional[str] = None,
     ) -> None:
         """
         See documentation of the `FelderaClient` constructor for the other arguments.
@@ -35,10 +36,15 @@ def __init__(
             Default: `v0`.
         :param retry_config: (Optional) Retry behavior for transient HTTP failures.
             Default: `RetryConfig()` — 3 retries with exponential backoff starting at 2 seconds.
+        :param tenant: (Optional) Tenant to act in, sent as the `Feldera-Tenant`
+            header. A platform owner uses this to select any tenant (by name or
+            UUID); a regular user, to disambiguate among the tenants their token
+            authorizes. Default: the token's own/home tenant.
         """
         self.url: str = url or os.environ.get("FELDERA_HOST") or "http://localhost:8080"
         self.api_key: Optional[ApiKey] = api_key or os.environ.get("FELDERA_API_KEY")
         self.version: str = version or "v0"
+        self.tenant: Optional[str] = tenant or os.environ.get("FELDERA_TENANT")
         self.timeout: Optional[float] = timeout
         self.connection_timeout: Optional[float] = connection_timeout
         self.retry_config: RetryConfig = retry_config or RetryConfig()
diff --git a/python/feldera/rest/errors.py b/python/feldera/rest/errors.py
index 79199432f89..1f9acab913a 100644
--- a/python/feldera/rest/errors.py
+++ b/python/feldera/rest/errors.py
@@ -79,18 +79,24 @@ def __init__(self, error: str, request: Response) -> None:
         if int(request.status_code) == 401:
             parsed = urlparse(request.request.url)
 
-            auth_err = f"\nAuthorization error: Failed to connect to '{parsed.scheme}://{parsed.hostname}': "
+            auth_err = f"\nAuthorization error at '{parsed.scheme}://{parsed.hostname}': "
             auth = request.request.headers.get("Authorization")
             if auth is None:
-                err_msg += f"{auth_err} API key not set"
+                err_msg += f"{auth_err}no credential provided"
             else:
-                err_msg += f"{auth_err} invalid API key"
+                # The credential may be an API key or a JWT/bearer token; do not
+                # assume which. The server `message` above carries the specifics.
+                err_msg += f"{auth_err}credential rejected (invalid or expired token / API key)"
 
         err_msg = err_msg.strip()
 
         super().__init__(err_msg)
 
 
+# Compatibility alias: the RFC and some docs refer to this as `FelderaApiError`.
+FelderaApiError = FelderaAPIError
+
+
 class FelderaTimeoutError(FelderaError):
     """Error when Feldera operation takes longer than expected"""
 
diff --git a/python/feldera/rest/feldera_client.py b/python/feldera/rest/feldera_client.py
index d2bda473053..fa228dd1cd5 100644
--- a/python/feldera/rest/feldera_client.py
+++ b/python/feldera/rest/feldera_client.py
@@ -63,6 +63,7 @@ def __init__(
         connection_timeout: Optional[float] = None,
         requests_verify: Optional[bool | str] = None,
         retry_config: Optional[RetryConfig] = None,
+        tenant: Optional[str] = None,
     ) -> None:
         """
         Constructs a Feldera client.
@@ -98,6 +99,11 @@ def __init__(
         :param retry_config: (Optional) Retry behavior for transient HTTP failures
             (408, 502, 503, 504, timeouts). The default is `RetryConfig()` — 3 retries
             with exponential backoff starting at 2 seconds.
+        :param tenant: (Optional) Tenant to act in, sent as the `Feldera-Tenant`
+            header. A platform owner uses this to select any tenant (by name or
+            UUID); a regular user, to disambiguate among the tenants their token
+            authorizes. The default is read from `FELDERA_TENANT`; if unset, the
+            server uses the token's own tenant.
         """
 
         self.config = Config(
@@ -107,6 +113,7 @@ def __init__(
             connection_timeout=connection_timeout,
             requests_verify=requests_verify,
             retry_config=retry_config,
+            tenant=tenant,
         )
         self.http = HttpRequests(self.config)
 
@@ -1616,24 +1623,31 @@ def get_config(self) -> FelderaConfig:
 
         return FelderaConfig(resp)
 
-    def create_api_key(self, name: str) -> dict:
+    def create_api_key(self, name: str, role: str = "write") -> dict:
         """
-        Create a new API key with the specified name.
+        Create a new API key with the specified name and role.
 
         The generated API key is returned in the response and cannot be retrieved
         again later, so store it securely.
 
         :param name: The API key name to create.
+        :param role: The role the key carries, ``"read"`` or ``"write"``. The
+            role may not exceed the caller's own role, and ``admin``/``owner``
+            are never issuable as API keys. Defaults to ``"write"`` to preserve
+            the read+write access earlier SDK versions granted implicitly.
         :returns: A dict with keys: `id` (UUID string), `name`, and `api_key`.
-        :raises FelderaAPIError: If a key with the same name already exists.
+        :raises FelderaAPIError: If a key with the same name already exists, or
+            the requested role exceeds the caller's role.
         """
 
         if not name:
             raise ValueError("API key name must be a non-empty string")
+        if role not in ("read", "write"):
+            raise ValueError("API key role must be 'read' or 'write'")
 
         return self.http.post(
             path="/api_keys",
-            body={"name": name},
+            body={"name": name, "role": role},
         )
 
     def list_oidc_trust(self) -> List[dict]:
@@ -1642,7 +1656,7 @@ def list_oidc_trust(self) -> List[dict]:
 
         :returns: A list of dicts each describing a trust relationship
                   (`id`, `name`, `description`, `issuer`, `subject`,
-                  `audience`, `scopes`).
+                  `audience`, `role`).
         """
         return self.http.get(path="/oidc_trust")
 
@@ -1652,7 +1666,7 @@ def get_oidc_trust(self, name: str) -> dict:
 
         :param name: Trust relationship name.
         """
-        return self.http.get(path=f"/oidc_trust/{name}")
+        return self.http.get(path=f"/oidc_trust/{quote(name, safe='')}")
 
     def create_oidc_trust(
         self,
@@ -1661,14 +1675,15 @@ def create_oidc_trust(
         subject: str,
         audience: Optional[str] = None,
         description: Optional[str] = None,
+        role: Optional[str] = None,
     ) -> dict:
         """
         Register a new OIDC trust relationship.
 
         Any JWT signed by `issuer` whose `sub` claim matches `subject`
         (and, if specified, `aud` claim matches `audience`) is authorized
-        as the current tenant with read/write scopes. `*` is a wildcard
-        in `subject` and `audience`.
+        to act as the current tenant with the granted `role`. `*` is a
+        wildcard in `subject` and `audience`.
 
         :param name: Unique name within the tenant.
         :param issuer: Issuer URL exactly as it appears in the `iss` claim.
@@ -1676,6 +1691,9 @@ def create_oidc_trust(
         :param audience: Pattern matched against the JWT `aud` claim. Omit
                          to skip audience matching.
         :param description: Free-text description.
+        :param role: Role granted to a matching token (`read`, `write`, or
+                     `admin`; `owner` only for a platform owner). Capped at the
+                     caller's role. Defaults to `read` server-side when omitted.
         :returns: A dict with keys `id` and `name`.
         :raises FelderaAPIError: If `name` is already in use or fields are
                                  invalid.
@@ -1695,13 +1713,15 @@ def create_oidc_trust(
             body["audience"] = audience
         if description is not None:
             body["description"] = description
+        if role is not None:
+            body["role"] = role
         return self.http.post(path="/oidc_trust", body=body)
 
     def delete_oidc_trust(self, name: str) -> None:
         """
         Delete an OIDC trust relationship by name.
         """
-        self.http.delete(path=f"/oidc_trust/{name}")
+        self.http.delete(path=f"/oidc_trust/{quote(name, safe='')}")
 
     def get_pipeline_support_bundle(
         self, pipeline_name: str, params: Optional[Dict[str, Any]] = None
diff --git a/python/tests/unit/test_callable_api_key.py b/python/tests/unit/test_callable_api_key.py
new file mode 100644
index 00000000000..28cdfdd3bc6
--- /dev/null
+++ b/python/tests/unit/test_callable_api_key.py
@@ -0,0 +1,125 @@
+"""Tests for the callable `api_key` path: per-request resolution and the
+single re-resolve retry on a 401 (OIDC workload-identity token rotation)."""
+
+from __future__ import annotations
+
+from contextlib import contextmanager
+from typing import Iterable, List, Optional
+from unittest import mock
+
+import pytest
+import requests
+
+from feldera.rest._httprequests import HttpRequests
+from feldera.rest.config import Config
+from feldera.rest.errors import FelderaAPIError
+from feldera.rest.retry import RetryConfig
+
+
+def _make_response(status_code: int, body: bytes = b"{}") -> requests.Response:
+    resp = requests.Response()
+    resp.status_code = status_code
+    resp._content = body
+    resp.headers["content-type"] = "application/json"
+    prepared = requests.PreparedRequest()
+    prepared.prepare(method="GET", url="http://example.test/v0/x")
+    resp.request = prepared
+    return resp
+
+
+def _sequence(responses: Iterable[object]):
+    items = list(responses)
+
+    def _call(*args, **kwargs):
+        if not items:
+            raise AssertionError("exhausted mock responses")
+        nxt = items.pop(0)
+        if isinstance(nxt, Exception):
+            raise nxt
+        return nxt
+
+    return _call
+
+
+@contextmanager
+def patch_get(responses: Iterable[object]):
+    with mock.patch("requests.get") as m:
+        m.__name__ = "get"
+        m.side_effect = _sequence(responses)
+        yield m
+
+
+def _client(api_key) -> HttpRequests:
+    cfg = Config(
+        url="http://example.test",
+        api_key=api_key,
+        retry_config=RetryConfig(
+            max_retries=0,
+            initial_backoff=0.0,
+            max_backoff=0.0,
+            multiplier=1.0,
+            unhealthy_backoff=0.0,
+        ),
+    )
+    return HttpRequests(cfg)
+
+
+def _auth_of(call) -> Optional[str]:
+    return call.kwargs["headers"].get("Authorization")
+
+
+class TestResolveBearer:
+    def test_static_key_used_verbatim(self):
+        assert _client("apikey:abc")._resolve_bearer() == "apikey:abc"
+
+    def test_callable_invoked_and_stripped(self):
+        assert _client(lambda: "  tok  ")._resolve_bearer() == "tok"
+
+    def test_non_str_callable_raises(self):
+        with pytest.raises(TypeError):
+            _client(lambda: 123)._resolve_bearer()
+
+    def test_callable_invoked_per_request(self):
+        tokens = iter(["t1", "t2"])
+        http = _client(lambda: next(tokens))
+        with patch_get([_make_response(200), _make_response(200)]) as m:
+            http.get("/a")
+            http.get("/b")
+        assert _auth_of(m.call_args_list[0]) == "Bearer t1"
+        assert _auth_of(m.call_args_list[1]) == "Bearer t2"
+
+
+class TestUnauthorizedRetry:
+    def test_401_reresolves_callable_once_then_succeeds(self):
+        # First token is stale (401), the callable then yields a fresh token
+        # that succeeds. The retry must use the freshly resolved token.
+        tokens = iter(["stale", "fresh"])
+        http = _client(lambda: next(tokens))
+        with patch_get([_make_response(401), _make_response(200)]) as m:
+            http.get("/x")
+        assert len(m.call_args_list) == 2
+        assert _auth_of(m.call_args_list[0]) == "Bearer stale"
+        assert _auth_of(m.call_args_list[1]) == "Bearer fresh"
+
+    def test_second_401_propagates(self):
+        http = _client(lambda: "always-stale")
+        with patch_get([_make_response(401), _make_response(401)]):
+            with pytest.raises(FelderaAPIError):
+                http.get("/x")
+
+    def test_static_key_401_not_retried(self):
+        # A static key cannot be re-resolved, so a 401 propagates without a
+        # second attempt.
+        http = _client("apikey:static")
+        with patch_get([_make_response(401)]) as m:
+            with pytest.raises(FelderaAPIError):
+                http.get("/x")
+        assert len(m.call_args_list) == 1
+
+
+class TestHealthProbeAuth:
+    def test_cluster_health_probe_sends_bearer(self):
+        http = _client(lambda: "probe-tok")
+        with patch_get([_make_response(200, b'{"all_healthy": true}')]) as m:
+            assert http._check_cluster_health() is True
+        assert _auth_of(m.call_args_list[0]) == "Bearer probe-tok"
diff --git a/scripts/dummy_oidc.py b/scripts/dummy_oidc.py
new file mode 100755
index 00000000000..03ea262f667
--- /dev/null
+++ b/scripts/dummy_oidc.py
@@ -0,0 +1,618 @@
+# /// script
+# requires-python = ">=3.10"
+# dependencies = ["pyjwt", "cryptography"]
+# ///
+"""Dummy OIDC/OAuth2 identity provider for LOCAL TESTING of the Feldera
+pipeline-manager with authentication enabled.
+
+WARNING: DEV-ONLY, INSECURE. This issues signed JWTs for ANY user/role with no
+authentication whatsoever. Never run this in or near production. Its sole
+purpose is to exercise the manager's RBAC code paths by hand, in the web
+console login flow, and in screenshots.
+
+Two ways to obtain a token:
+
+  1. Machine mint (scripts/rbac_demo.py path):
+       GET /token?sub=&email=&tenants=a,b&groups=&aud=feldera-api&exp_secs=
+       -> {"access_token", "token_type": "Bearer", "expires_in"}
+
+  2. Browser login (web console, @axa-fr/oidc-client, code + PKCE):
+       GET /authorize  -> role-picker page -> 302 back with ?code=&state=
+       POST /token (grant_type=authorization_code) -> access_token + id_token
+       GET /userinfo with the bearer access token.
+
+The manager (crates/pipeline-manager/src/auth.rs) validates tokens by:
+  1. fetching <issuer>/.well-known/openid-configuration to read jwks_uri,
+  2. fetching the JWKS (RS256 keys: kid, kty=RSA, alg=RS256, use=sig, n, e),
+  3. verifying an RS256 JWT whose header `kid` matches a JWKS key, and whose
+     `iss` == issuer, `aud` == audience (default feldera-api), `exp` is valid.
+"""
+
+import argparse
+import base64
+import hashlib
+import html
+import json
+import secrets
+import time
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from urllib.parse import parse_qs, urlencode, urlparse
+
+import jwt
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+
+KID = "dummy-key-1"
+CODE_TTL_SECS = 600  # authorization codes live ~10 minutes
+
+# Four demo identities offered on the login page. The effective role hint shows
+# what each becomes once provisioned via scripts/rbac_demo.py.
+ROLES: dict[str, dict] = {
+    "reader": {
+        "sub": "reader",
+        "email": "reader@example.com",
+        "tenants": ["acme"],
+        "hint": "read access in tenant acme",
+    },
+    "writer": {
+        "sub": "writer",
+        "email": "writer@example.com",
+        "tenants": ["acme"],
+        "hint": "write access in tenant acme (after provisioning)",
+    },
+    "admin": {
+        "sub": "admin",
+        "email": "admin@example.com",
+        "tenants": ["acme"],
+        "hint": "admin of tenant acme",
+    },
+    "owner": {
+        "sub": "owner",
+        "email": "owner@example.com",
+        # No tenants claim: owner selects a tenant via the Feldera-Tenant header.
+        "hint": "platform owner (FELDERA_OWNERS)",
+    },
+}
+
+
+def b64url(raw: bytes) -> str:
+    """Base64url-encode without padding, as required by JWK n/e fields."""
+    return base64.urlsafe_b64encode(raw).rstrip(b"=").decode("ascii")
+
+
+def int_to_b64url(value: int) -> str:
+    """Encode a big integer as base64url big-endian bytes (JWK convention)."""
+    length = (value.bit_length() + 7) // 8
+    return b64url(value.to_bytes(length, "big"))
+
+
+class KeyMaterial:
+    """RSA-2048 keypair plus the JWK/PEM views the server needs."""
+
+    def __init__(self) -> None:
+        self.private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+        self.private_pem = self.private_key.private_bytes(
+            encoding=serialization.Encoding.PEM,
+            format=serialization.PrivateFormat.PKCS8,
+            encryption_algorithm=serialization.NoEncryption(),
+        )
+        self.public_pem = self.private_key.public_key().public_bytes(
+            encoding=serialization.Encoding.PEM,
+            format=serialization.PublicFormat.SubjectPublicKeyInfo,
+        )
+        numbers = self.private_key.public_key().public_numbers()
+        self.jwk = {
+            "kid": KID,
+            "kty": "RSA",
+            "alg": "RS256",
+            "use": "sig",
+            "n": int_to_b64url(numbers.n),
+            "e": int_to_b64url(numbers.e),
+        }
+
+
+def make_handler(keys: KeyMaterial, issuer: str, default_audience: str):
+    """Build a request handler bound to one keypair and issuer."""
+
+    # In-memory, single-process stores. Codes are single-use; refresh tokens map
+    # to the claims needed to re-mint a token pair.
+    auth_codes: dict[str, dict] = {}
+    refresh_tokens: dict[str, dict] = {}
+
+    def discovery_doc() -> dict:
+        return {
+            "issuer": issuer,
+            "authorization_endpoint": f"{issuer}/authorize",
+            "token_endpoint": f"{issuer}/token",
+            "userinfo_endpoint": f"{issuer}/userinfo",
+            "jwks_uri": f"{issuer}/.well-known/jwks.json",
+            "end_session_endpoint": f"{issuer}/logout",
+            "response_types_supported": ["code"],
+            "grant_types_supported": ["authorization_code", "refresh_token"],
+            "code_challenge_methods_supported": ["S256", "plain"],
+            "scopes_supported": ["openid", "profile", "email", "offline_access"],
+            "subject_types_supported": ["public"],
+            "id_token_signing_alg_values_supported": ["RS256"],
+            "token_endpoint_auth_methods_supported": [
+                "none",
+                "client_secret_post",
+                "client_secret_basic",
+            ],
+            "claims_supported": [
+                "sub",
+                "email",
+                "name",
+                "preferred_username",
+                "tenants",
+                "groups",
+            ],
+        }
+
+    def split_csv(value: str) -> list[str]:
+        return [item.strip() for item in value.split(",") if item.strip()]
+
+    def sign(claims: dict) -> str:
+        return jwt.encode(
+            claims, keys.private_pem, algorithm="RS256", headers={"kid": KID}
+        )
+
+    def mint_token(query: dict[str, list[str]]) -> dict:
+        """Build claims from query params, then sign an RS256 JWT (machine mint)."""
+
+        def one(name: str, default: str | None = None) -> str | None:
+            values = query.get(name)
+            return values[0] if values else default
+
+        now = int(time.time())
+        exp_secs = int(one("exp_secs", "3600"))
+        audience = one("aud", default_audience)
+        sub = one("sub", "dev-user")
+
+        # Required + AWS-cognito-style claims. token_use=access mirrors real
+        # access tokens; the manager treats it as optional for generic-oidc.
+        claims: dict[str, object] = {
+            "iss": issuer,
+            "sub": sub,
+            "aud": audience,
+            "iat": now,
+            "exp": now + exp_secs,
+            "token_use": "access",
+        }
+
+        # Optional claims: include only when the caller supplies them, so tenant
+        # resolution can fall back to `sub` when absent (individual_tenant=true).
+        if (email := one("email")) is not None:
+            claims["email"] = email
+            # The manager only trusts an email for owner designation when the
+            # provider marks it verified, so this test IdP asserts it.
+            claims["email_verified"] = True
+        if (tenant := one("tenant")) is not None:
+            claims["tenant"] = tenant
+        if (tenants := one("tenants")) is not None:
+            claims["tenants"] = split_csv(tenants)
+        if (groups := one("groups")) is not None:
+            claims["groups"] = split_csv(groups)
+
+        return {
+            "access_token": sign(claims),
+            "token_type": "Bearer",
+            "expires_in": exp_secs,
+        }
+
+    def build_access_token(stored: dict) -> str:
+        """Sign an access-token JWT from a stored authorize/refresh record."""
+        now = int(time.time())
+        claims: dict[str, object] = {
+            "iss": issuer,
+            "sub": stored["sub"],
+            "aud": stored.get("audience") or default_audience,
+            "iat": now,
+            "exp": now + 3600,
+            "token_use": "access",
+            "email": stored["email"],
+            "email_verified": True,
+            "scope": stored.get("scope", "openid profile email"),
+        }
+        if stored.get("tenants"):
+            claims["tenants"] = stored["tenants"]
+        return sign(claims)
+
+    def build_id_token(stored: dict) -> str:
+        """Sign an id-token JWT from a stored authorize/refresh record."""
+        now = int(time.time())
+        sub = stored["sub"]
+        claims: dict[str, object] = {
+            "iss": issuer,
+            "sub": sub,
+            "aud": stored.get("client_id") or "feldera",
+            "iat": now,
+            "exp": now + 3600,
+            "email": stored["email"],
+            "email_verified": True,
+            "name": sub.title(),
+            "preferred_username": sub,
+        }
+        if stored.get("nonce"):
+            claims["nonce"] = stored["nonce"]
+        return sign(claims)
+
+    def token_pair(stored: dict, refresh_token: str) -> dict:
+        return {
+            "access_token": build_access_token(stored),
+            "id_token": build_id_token(stored),
+            "token_type": "Bearer",
+            "expires_in": 3600,
+            "refresh_token": refresh_token,
+            "scope": stored.get("scope", "openid profile email"),
+        }
+
+    def verify_pkce(stored: dict, code_verifier: str | None) -> bool:
+        challenge = stored.get("code_challenge")
+        if not challenge:
+            return True  # no challenge was sent at /authorize -> nothing to verify
+        if not code_verifier:
+            return False
+        method = stored.get("code_challenge_method") or "plain"
+        if method == "S256":
+            digest = hashlib.sha256(code_verifier.encode("ascii")).digest()
+            return b64url(digest) == challenge
+        return code_verifier == challenge  # plain
+
+    def login_page_html(query: dict[str, list[str]]) -> str:
+        """Render the role picker. Every button re-hits /authorize with the
+        original params plus &login_as=<role>, preserving response_type, state,
+        nonce, code_challenge, redirect_uri, audience, etc."""
+        base_params = {k: v for k, v in query.items() if k != "login_as"}
+        buttons = []
+        for role, profile in ROLES.items():
+            qs = urlencode({**base_params, "login_as": role}, doseq=True)
+            hint = html.escape(profile["hint"])
+            buttons.append(
+                f'<a class="role" href="/authorize?{html.escape(qs)}">'
+                f'<span class="role-name">{role}</span>'
+                f'<span class="role-hint">{hint}</span></a>'
+            )
+        return f"""<!doctype html>
+<html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Feldera dev login</title>
+<style>
+  body {{ font-family: system-ui, sans-serif; background: #0f172a; color: #e2e8f0;
+          margin: 0; min-height: 100vh; display: flex; align-items: center;
+          justify-content: center; }}
+  .card {{ background: #1e293b; padding: 2.5em; border-radius: 16px;
+           box-shadow: 0 10px 40px rgba(0,0,0,.4); max-width: 28em; width: 90%; }}
+  h1 {{ margin: 0 0 .2em; font-size: 1.6em; }}
+  .sub {{ color: #94a3b8; margin: 0 0 1.5em; font-size: .9em; }}
+  .grid {{ display: grid; gap: .75em; }}
+  a.role {{ display: flex; flex-direction: column; text-decoration: none;
+            background: #334155; color: #f1f5f9; padding: 1em 1.2em;
+            border-radius: 10px; border: 1px solid #475569; transition: .15s; }}
+  a.role:hover {{ background: #475569; border-color: #38bdf8; }}
+  .role-name {{ font-size: 1.15em; font-weight: 600; text-transform: capitalize; }}
+  .role-hint {{ color: #94a3b8; font-size: .85em; margin-top: .15em; }}
+  .warn {{ margin-top: 1.5em; color: #fbbf24; font-size: .8em; text-align: center; }}
+</style></head>
+<body><div class="card">
+  <h1>Feldera dev login</h1>
+  <p class="sub">Pick a role to sign in as.</p>
+  <div class="grid">{''.join(buttons)}</div>
+  <p class="warn">DEV ONLY, INSECURE: no password, any role is granted on click.</p>
+</div></body></html>"""
+
+    def help_html() -> str:
+        token_url = f"{issuer}/token?sub=alice&amp;email=alice@example.com"
+        roles_rows = "".join(
+            f"<tr><td><code>{r}</code></td><td><code>{p['email']}</code></td>"
+            f"<td>{html.escape(p['hint'])}</td></tr>"
+            for r, p in ROLES.items()
+        )
+        return f"""<!doctype html>
+<html><head><meta charset="utf-8"><title>Dummy OIDC provider</title></head>
+<body style="font-family: monospace; max-width: 55em; margin: 2em auto;">
+<h1>Dummy OIDC provider (DEV ONLY, INSECURE)</h1>
+<p>Issuer: <code>{issuer}</code></p>
+<h2>Web console login</h2>
+<p>The web console redirects here to <a href="/authorize">/authorize</a>,
+   where you pick one of the roles below. DEV ONLY: any role is granted on click.</p>
+<table border="1" cellpadding="6" cellspacing="0">
+  <tr><th>role</th><th>email</th><th>effective role</th></tr>
+  {roles_rows}
+</table>
+<h2>Endpoints</h2>
+<ul>
+  <li><a href="/.well-known/openid-configuration">/.well-known/openid-configuration</a></li>
+  <li><a href="/.well-known/jwks.json">/.well-known/jwks.json</a></li>
+  <li><a href="/authorize">/authorize</a> &mdash; browser login (code + PKCE)</li>
+  <li><code>POST /token</code> &mdash; code / refresh-token exchange</li>
+  <li><code>GET /userinfo</code> &mdash; profile from a bearer access token</li>
+  <li><a href="/logout">/logout</a> &mdash; end session</li>
+  <li><a href="/token?sub=alice&amp;email=alice@example.com">GET /token</a>
+      &mdash; machine mint: sub, email, tenant, tenants, groups, aud, exp_secs (optional)</li>
+</ul>
+<h2>Mint a token and call the manager</h2>
+<pre>TOKEN=$(curl -s '{token_url}' \\
+  | python3 -c 'import sys,json;print(json.load(sys.stdin)["access_token"])')
+curl -H "Authorization: Bearer $TOKEN" http://localhost:8080/v0/pipelines</pre>
+</body></html>"""
+
+    def append_query(url: str, params: dict[str, str]) -> str:
+        """Append params to a URL, respecting an existing query string."""
+        sep = "&" if urlparse(url).query else "?"
+        return f"{url}{sep}{urlencode(params)}"
+
+    class Handler(BaseHTTPRequestHandler):
+        def _cors(self) -> None:
+            origin = self.headers.get("Origin") or "*"
+            self.send_header("Access-Control-Allow-Origin", origin)
+            self.send_header("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
+            self.send_header(
+                "Access-Control-Allow-Headers", "Authorization, Content-Type"
+            )
+            self.send_header("Access-Control-Allow-Credentials", "true")
+            self.send_header("Vary", "Origin")
+
+        def _send_json(self, payload: dict, status: int = 200) -> None:
+            body = json.dumps(payload, indent=2).encode("utf-8")
+            self.send_response(status)
+            self.send_header("Content-Type", "application/json")
+            self.send_header("Content-Length", str(len(body)))
+            self._cors()
+            self.end_headers()
+            self.wfile.write(body)
+
+        def _send_html(self, page: str, status: int = 200) -> None:
+            body = page.encode("utf-8")
+            self.send_response(status)
+            self.send_header("Content-Type", "text/html; charset=utf-8")
+            self.send_header("Content-Length", str(len(body)))
+            self.end_headers()
+            self.wfile.write(body)
+
+        def _redirect(self, location: str) -> None:
+            self.send_response(302)
+            self.send_header("Location", location)
+            self.send_header("Content-Length", "0")
+            self.end_headers()
+
+        # ---- /authorize: login page + code issuance --------------------------
+
+        def _handle_authorize(self, query: dict[str, list[str]]) -> None:
+            def one(name: str) -> str | None:
+                values = query.get(name)
+                return values[0] if values else None
+
+            login_as = one("login_as")
+            if login_as is None:
+                self._send_html(login_page_html(query))
+                return
+            if login_as not in ROLES:
+                self._send_json({"error": "invalid_request", "error_description": f"unknown role {login_as}"}, 400)
+                return
+
+            redirect_uri = one("redirect_uri")
+            if not redirect_uri:
+                self._send_json({"error": "invalid_request", "error_description": "missing redirect_uri"}, 400)
+                return
+
+            profile = ROLES[login_as]
+            code = secrets.token_urlsafe(32)
+            auth_codes[code] = {
+                "sub": profile["sub"],
+                "email": profile["email"],
+                "tenants": profile.get("tenants"),
+                "code_challenge": one("code_challenge"),
+                "code_challenge_method": one("code_challenge_method"),
+                "redirect_uri": redirect_uri,
+                "nonce": one("nonce"),
+                "scope": one("scope") or "openid profile email",
+                "audience": one("audience") or default_audience,
+                "client_id": one("client_id"),
+                "expires_at": time.time() + CODE_TTL_SECS,
+            }
+            params = {"code": code}
+            if (state := one("state")) is not None:
+                params["state"] = state
+            self._redirect(append_query(redirect_uri, params))
+
+        # ---- POST /token: code / refresh exchange ----------------------------
+
+        def _read_body_params(self) -> dict[str, str]:
+            length = int(self.headers.get("Content-Length") or 0)
+            raw = self.rfile.read(length) if length else b""
+            ctype = (self.headers.get("Content-Type") or "").split(";")[0].strip()
+            if ctype == "application/json":
+                try:
+                    obj = json.loads(raw.decode("utf-8") or "{}")
+                    return {k: str(v) for k, v in obj.items()}
+                except (ValueError, TypeError):
+                    return {}
+            # default: application/x-www-form-urlencoded
+            parsed = parse_qs(raw.decode("utf-8"))
+            return {k: v[0] for k, v in parsed.items() if v}
+
+        def _handle_token_post(self) -> None:
+            params = self._read_body_params()
+            grant_type = params.get("grant_type")
+
+            if grant_type == "authorization_code":
+                code = params.get("code")
+                stored = auth_codes.pop(code, None) if code else None
+                if not stored or stored["expires_at"] < time.time():
+                    self._send_json({"error": "invalid_grant", "error_description": "code missing, expired, or already used"}, 400)
+                    return
+                if params.get("redirect_uri") != stored["redirect_uri"]:
+                    self._send_json({"error": "invalid_grant", "error_description": "redirect_uri mismatch"}, 400)
+                    return
+                if not verify_pkce(stored, params.get("code_verifier")):
+                    self._send_json({"error": "invalid_grant", "error_description": "PKCE verification failed"}, 400)
+                    return
+                refresh = secrets.token_urlsafe(32)
+                refresh_tokens[refresh] = stored
+                self._send_json(token_pair(stored, refresh))
+                return
+
+            if grant_type == "refresh_token":
+                refresh = params.get("refresh_token")
+                stored = refresh_tokens.get(refresh) if refresh else None
+                if not stored:
+                    self._send_json({"error": "invalid_grant", "error_description": "unknown refresh_token"}, 400)
+                    return
+                # Reuse the same refresh token (sufficient for dev).
+                self._send_json(token_pair(stored, refresh))
+                return
+
+            self._send_json({"error": "unsupported_grant_type", "error_description": f"grant_type={grant_type}"}, 400)
+
+        # ---- GET /userinfo ---------------------------------------------------
+
+        def _handle_userinfo(self) -> None:
+            auth = self.headers.get("Authorization", "")
+            if not auth.startswith("Bearer "):
+                self._send_json({"error": "invalid_token", "error_description": "missing bearer token"}, 401)
+                return
+            token = auth[len("Bearer "):].strip()
+            try:
+                claims = jwt.decode(
+                    token,
+                    keys.public_pem,
+                    algorithms=["RS256"],
+                    options={"verify_aud": False},
+                )
+            except jwt.PyJWTError as err:
+                self._send_json({"error": "invalid_token", "error_description": str(err)}, 401)
+                return
+            sub = claims.get("sub", "")
+            info = {
+                "sub": sub,
+                "email": claims.get("email"),
+                "name": sub.title(),
+                "preferred_username": sub,
+            }
+            if claims.get("tenants"):
+                info["tenants"] = claims["tenants"]
+            self._send_json(info)
+
+        # ---- /logout ---------------------------------------------------------
+
+        def _handle_logout(self, query: dict[str, list[str]]) -> None:
+            target = (query.get("post_logout_redirect_uri") or query.get("redirect_uri") or [None])[0]
+            if target:
+                self._redirect(target)
+                return
+            self._send_html(
+                "<!doctype html><html><head><meta charset='utf-8'>"
+                "<title>Logged out</title></head><body style='font-family:system-ui'>"
+                "<h1>Logged out</h1><p>You may close this window.</p></body></html>"
+            )
+
+        # ---- dispatch --------------------------------------------------------
+
+        def do_OPTIONS(self) -> None:  # noqa: N802 (http.server API)
+            self.send_response(204)
+            self._cors()
+            self.send_header("Content-Length", "0")
+            self.end_headers()
+
+        def do_POST(self) -> None:  # noqa: N802 (http.server API)
+            path = urlparse(self.path).path
+            if path == "/token":
+                self._handle_token_post()
+            else:
+                self._send_json({"error": "not found"}, status=404)
+
+        def do_GET(self) -> None:  # noqa: N802 (http.server API)
+            parsed = urlparse(self.path)
+            path = parsed.path
+            query = parse_qs(parsed.query)
+            if path == "/.well-known/openid-configuration":
+                self._send_json(discovery_doc())
+            elif path == "/.well-known/jwks.json":
+                self._send_json({"keys": [keys.jwk]})
+            elif path == "/authorize":
+                self._handle_authorize(query)
+            elif path == "/token":
+                # GET /token stays the machine-mint endpoint (rbac_demo.py).
+                try:
+                    self._send_json(mint_token(query))
+                except (ValueError, TypeError) as err:
+                    self._send_json({"error": f"bad request: {err}"}, status=400)
+            elif path == "/userinfo":
+                self._handle_userinfo()
+            elif path == "/logout":
+                self._handle_logout(query)
+            elif path == "/":
+                self._send_html(help_html())
+            else:
+                self._send_json({"error": "not found"}, status=404)
+
+        def log_message(self, fmt: str, *args) -> None:
+            # Keep one-line access logs; default impl is fine but quieter here.
+            print(f"[dummy-oidc] {self.address_string()} {fmt % args}")
+
+    return Handler
+
+
+def print_startup(issuer: str, audience: str, port: int) -> None:
+    print("=" * 70)
+    print("Dummy OIDC provider running (DEV ONLY, INSECURE)")
+    print(f"  Issuer:   {issuer}")
+    print(f"  Audience: {audience}")
+    print(f"  JWKS:     {issuer}/.well-known/jwks.json")
+    print(f"  Login:    {issuer}/authorize  (web console redirects here)")
+    print("-" * 70)
+    print("Browser roles (pick one on the login page):")
+    for role, profile in ROLES.items():
+        print(f"  {role:7} {profile['email']:20} -> {profile['hint']}")
+    print("-" * 70)
+    print("Launch the pipeline-manager against it:")
+    print(
+        f"  AUTH_PROVIDER=generic-oidc FELDERA_AUTH_CLIENT_ID=feldera \\\n"
+        f"    FELDERA_AUTH_ISSUER={issuer} FELDERA_AUTH_AUDIENCE={audience} \\\n"
+        f"    FELDERA_OWNERS=owner@example.com \\\n"
+        f"    cargo run --bin pipeline-manager"
+    )
+    print("-" * 70)
+    print("Opening the web console redirects here to pick a role.")
+    print("Or mint a token directly and call the manager:")
+    print(
+        f"  TOKEN=$(curl -s '{issuer}/token?sub=alice&email=alice@example.com' \\\n"
+        f"    | python3 -c 'import sys,json;print(json.load(sys.stdin)[\"access_token\"])')"
+    )
+    print('  curl -H "Authorization: Bearer $TOKEN" http://localhost:8080/v0/pipelines')
+    print("=" * 70)
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(
+        description="Dummy OIDC/OAuth2 provider for local Feldera auth testing (DEV ONLY)."
+    )
+    parser.add_argument("--port", type=int, default=9876, help="TCP port to listen on")
+    parser.add_argument(
+        "--issuer",
+        default=None,
+        help="Issuer URL; must match FELDERA_AUTH_ISSUER (default http://localhost:<port>)",
+    )
+    parser.add_argument(
+        "--audience",
+        default="feldera-api",
+        help="Audience put in the aud claim; must match FELDERA_AUTH_AUDIENCE",
+    )
+    args = parser.parse_args()
+
+    issuer = args.issuer or f"http://localhost:{args.port}"
+    keys = KeyMaterial()
+    handler = make_handler(keys, issuer, args.audience)
+    server = ThreadingHTTPServer(("0.0.0.0", args.port), handler)
+
+    print_startup(issuer, args.audience, args.port)
+    try:
+        server.serve_forever()
+    except KeyboardInterrupt:
+        print("\nShutting down dummy OIDC provider.")
+    finally:
+        server.server_close()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/scripts/rbac_demo.py b/scripts/rbac_demo.py
new file mode 100755
index 00000000000..2c36a28ae95
--- /dev/null
+++ b/scripts/rbac_demo.py
@@ -0,0 +1,161 @@
+#!/usr/bin/env -S uv run --script
+# /// script
+# requires-python = ">=3.10"
+# dependencies = ["requests"]
+# ///
+"""
+RBAC demo provisioner: set up one user per role and prove the boundaries.
+
+DEV ONLY. Assumes two things are already running:
+
+  1. The dummy OIDC issuer:   uv run scripts/dummy_oidc.py            (:9876)
+  2. The pipeline-manager with auth enabled AND owner@example.com listed
+     as a platform owner, for example:
+
+       AUTH_PROVIDER=generic-oidc FELDERA_AUTH_CLIENT_ID=feldera \\
+       FELDERA_AUTH_ISSUER=http://localhost:9876 FELDERA_AUTH_AUDIENCE=feldera-api \\
+       FELDERA_OWNERS=owner@example.com \\
+       FELDERA_UNSTABLE_FEATURES='runtime_version,testing' \\
+       cargo run --release --bin=pipeline-manager --features feldera-enterprise \\
+         -- --runner-working-directory=/mnt/data/feldera
+
+This script then:
+  - mints tokens for four identities,
+  - provisions them into one shared tenant ("acme") with roles read/write/admin,
+  - leaves owner@example.com as the platform owner (from FELDERA_OWNERS),
+  - prints a ready-to-use token per role, and
+  - runs a request matrix showing what each role may and may not do.
+
+The four identities (all via the dummy IdP):
+
+  | role  | email             | how the role is granted                         |
+  |-------|-------------------|-------------------------------------------------|
+  | owner | owner@example.com | FELDERA_OWNERS (config); acts in any tenant     |
+  | admin | admin@example.com | owner assigns 'admin' in tenant acme            |
+  | write | writer@example.com| owner assigns 'write' in tenant acme            |
+  | read  | reader@example.com| default role on first login to acme             |
+"""
+
+import argparse
+import sys
+import requests
+
+TENANT_HEADER = "Feldera-Tenant"
+
+
+def mint(oidc: str, sub: str, email: str, tenants: list[str] | None) -> str:
+    params = {"sub": sub, "email": email, "aud": "feldera-api"}
+    if tenants:
+        params["tenants"] = ",".join(tenants)
+    r = requests.get(f"{oidc}/token", params=params, timeout=10)
+    r.raise_for_status()
+    return r.json()["access_token"]
+
+
+def call(manager, method, path, token, tenant=None, body=None):
+    headers = {"Authorization": f"Bearer {token}"}
+    if tenant:
+        headers[TENANT_HEADER] = tenant
+    resp = requests.request(
+        method, f"{manager}/v0{path}", headers=headers, json=body, timeout=15
+    )
+    return resp.status_code, resp
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument("--manager", default="http://localhost:8080")
+    ap.add_argument("--oidc", default="http://localhost:9876")
+    ap.add_argument("--tenant", default="acme")
+    args = ap.parse_args()
+    m, tenant = args.manager.rstrip("/"), args.tenant
+
+    # 1. Mint tokens. read/write/admin share tenant `acme` via the tenants claim;
+    #    owner needs no tenant claim (it selects a tenant with the header).
+    print(f"Minting tokens from {args.oidc} ...")
+    tok = {
+        "owner": mint(args.oidc, "owner", "owner@example.com", None),
+        "admin": mint(args.oidc, "admin", "admin@example.com", [tenant]),
+        "write": mint(args.oidc, "writer", "writer@example.com", [tenant]),
+        "read": mint(args.oidc, "reader", "reader@example.com", [tenant]),
+    }
+
+    # 2. admin@ logs in FIRST. Because the tenant does not exist yet, the
+    #    creator becomes its admin. Letting the login create the tenant keeps a
+    #    single (name, provider=issuer) row; pre-creating it as an owner would
+    #    use a different provider and collide on the name.
+    code, _ = call(m, "GET", "/config/session", tok["admin"], tenant=tenant)
+    print(f"  admin first login (creates '{tenant}', becomes admin): HTTP {code}")
+    if code != 200:
+        print(
+            "  !! admin login failed. Is the manager running with auth (dummy OIDC)? Aborting.",
+            file=sys.stderr,
+        )
+        return 1
+
+    # 3. writer/reader log in -> default role (read).
+    for role in ("write", "read"):
+        code, _ = call(m, "GET", "/config/session", tok[role], tenant=tenant)
+        print(f"  {role} first login -> membership (default read): HTTP {code}")
+
+    # 4. The admin promotes writer -> write (admin manages its own tenant).
+    code, resp = call(m, "GET", "/tenant/users", tok["admin"], tenant=tenant)
+    members = {u["email"]: u["user_id"] for u in resp.json()} if code == 200 else {}
+    wid = members.get("writer@example.com")
+    if wid:
+        code, _ = call(
+            m, "PUT", f"/tenant/users/{wid}", tok["admin"], tenant=tenant,
+            body={"role": "write"},
+        )
+        print(f"  admin set writer@ -> write: HTTP {code}")
+    else:
+        print("  !! writer@ not found among members; the write row may fail", file=sys.stderr)
+
+    # 5. Print ready-to-use tokens.
+    print("\n" + "=" * 72)
+    print("READY: one user per role. Export a token and call the API, e.g.")
+    print(f'  curl -H "Authorization: Bearer $READ"  {m}/v0/pipelines')
+    print("=" * 72)
+    for role in ("read", "write", "admin", "owner"):
+        print(f"\n{role.upper()}={tok[role]}")
+    if True:
+        print(f"\n(owner acts in a tenant by adding the header: -H '{TENANT_HEADER}: {tenant}')")
+
+    # 6. Verification matrix: each row is (role, method, path, expected, note).
+    #    `expected` is the status family we assert: 'ok' = not 403, 'deny' = 403.
+    print("\n" + "=" * 72)
+    print("VERIFICATION MATRIX (deny = 403 by RBAC; ok = passed RBAC)")
+    print("=" * 72)
+    checks = [
+        ("read",  "GET",  "/pipelines",     None,                  "ok",   "monitor"),
+        ("read",  "POST", "/pipelines",     {"name": "x"},         "deny", "no mutate"),
+        ("read",  "GET",  "/tenant/users",  None,                  "deny", "not admin"),
+        ("write", "GET",  "/pipelines",     None,                  "ok",   "monitor"),
+        ("write", "POST", "/api_keys",      {"name": "w1", "role": "read"},  "ok",   "mint read key"),
+        ("write", "POST", "/api_keys",      {"name": "w2", "role": "admin"}, "deny", "cannot mint admin key"),
+        ("write", "GET",  "/tenant/users",  None,                  "deny", "not admin"),
+        ("admin", "GET",  "/tenant/users",  None,                  "ok",   "manage users"),
+        ("admin", "POST", "/oidc_trust",    {"name": "t1", "issuer": "https://x", "subject": "s", "audience": "acme", "role": "write"}, "ok", "create trust (write needs concrete audience)"),
+        ("admin", "GET",  "/tenants",       None,                  "deny", "owner only"),
+        ("owner", "GET",  "/tenants",       None,                  "ok",   "platform view"),
+        ("owner", "GET",  "/tenant/users",  None,                  "ok",   "acts in tenant"),
+    ]
+    passed = failed = 0
+    for role, method, path, body, expected, note in checks:
+        tn = tenant if role in ("read", "write", "admin", "owner") else None
+        code, _ = call(m, method, path, tok[role], tenant=tn, body=body)
+        # ok = passed RBAC and the action succeeded (2xx); deny = blocked by RBAC (403).
+        # Anything else (401, 5xx) is an unexpected failure, not a pass.
+        good = (expected == "deny" and code == 403) or (
+            expected == "ok" and 200 <= code < 300
+        )
+        passed += good
+        failed += not good
+        mark = "PASS" if good else "FAIL"
+        print(f"  [{mark}] {role:5} {method:4} {path:16} -> {code:3} (want {expected:4}; {note})")
+    print(f"\n{passed} passed, {failed} failed")
+    return 0 if failed == 0 else 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/scripts/rbac_up.sh b/scripts/rbac_up.sh
new file mode 100755
index 00000000000..7070aef3df1
--- /dev/null
+++ b/scripts/rbac_up.sh
@@ -0,0 +1,89 @@
+#!/bin/bash
+# Bring up a self-contained Feldera RBAC playground for inspection:
+#   - the dummy OIDC issuer (browser login with a role picker)
+#   - the pipeline-manager with auth enabled and owner@example.com as owner
+#   - four provisioned users, one per role (read / write / admin / owner)
+#
+# Everything lives under an isolated demo directory, so it never touches your
+# real ~/.feldera data. Stop with Ctrl-C.
+#
+# Usage:  scripts/rbac_up.sh [--rebuild] [--keep-db]
+#   --rebuild   cargo build the manager first (otherwise uses target/debug)
+#   --keep-db   keep the demo database between runs (default: wipe for a clean slate)
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+DEMO="${FELDERA_RBAC_DEMO_DIR:-/tmp/feldera-rbac-demo}"
+BIN="target/debug/pipeline-manager"
+KEEP_DB=0
+REBUILD=0
+for a in "$@"; do
+  case "$a" in
+    --keep-db) KEEP_DB=1 ;;
+    --rebuild) REBUILD=1 ;;
+    *) echo "unknown arg: $a"; exit 1 ;;
+  esac
+done
+
+if [ "$REBUILD" = 1 ] || [ ! -x "$BIN" ]; then
+  echo "== building pipeline-manager (debug, with web console) =="
+  PATH="$HOME/.bun/bin:$PATH" cargo build -p pipeline-manager --features feldera-enterprise
+fi
+
+[ "$KEEP_DB" = 1 ] || rm -rf "$DEMO/pg"
+mkdir -p "$DEMO/pg" "$DEMO/runner" "$DEMO/compiler"
+
+OIDC_PID=""
+MGR_PID=""
+cleanup() { echo; echo "== shutting down =="; kill "$MGR_PID" "$OIDC_PID" 2>/dev/null || true; }
+trap cleanup EXIT INT TERM
+
+echo "== starting dummy OIDC issuer (:9876) =="
+uv run scripts/dummy_oidc.py >"$DEMO/oidc.log" 2>&1 &
+OIDC_PID=$!
+for _ in $(seq 1 30); do
+  curl -sf http://localhost:9876/.well-known/openid-configuration >/dev/null 2>&1 && break
+  sleep 0.5
+done
+
+echo "== starting pipeline-manager (:8080, auth on, owner=owner@example.com) =="
+AUTH_PROVIDER=generic-oidc \
+FELDERA_AUTH_CLIENT_ID=feldera \
+FELDERA_AUTH_ISSUER=http://localhost:9876 \
+FELDERA_AUTH_AUDIENCE=feldera-api \
+FELDERA_OWNERS=owner@example.com \
+FELDERA_UNSTABLE_FEATURES='runtime_version,testing' \
+  "$BIN" \
+    --pg-embed-working-directory="$DEMO/pg" \
+    --runner-working-directory="$DEMO/runner" \
+    --compiler-working-directory="$DEMO/compiler" \
+    >"$DEMO/manager.log" 2>&1 &
+MGR_PID=$!
+
+echo -n "   waiting for the API"
+up=0
+for _ in $(seq 1 180); do
+  if curl -sf http://localhost:8080/healthz >/dev/null 2>&1; then up=1; break; fi
+  kill -0 "$MGR_PID" 2>/dev/null || { echo " -- manager exited:"; tail -20 "$DEMO/manager.log"; exit 1; }
+  echo -n "."; sleep 1
+done
+echo
+[ "$up" = 1 ] || { echo "manager did not come up; see $DEMO/manager.log"; exit 1; }
+
+echo "== provisioning one user per role =="
+uv run scripts/rbac_demo.py --manager http://localhost:8080 --oidc http://localhost:9876 || true
+
+cat <<EOF
+
+========================================================================
+ Open the web console:   http://localhost:8080
+   It redirects to the dummy login where you PICK A ROLE
+   (reader / writer / admin / owner). The Admin UI lives under the
+   profile menu -> Admin (visible for admin and owner).
+ Tokens for CLI/curl are printed above (READ / WRITE / ADMIN / OWNER).
+ Logs: $DEMO/manager.log  and  $DEMO/oidc.log
+ Press Ctrl-C to stop everything.
+========================================================================
+EOF
+
+wait

From 80bf1d1f551f8d498b98440e85b9e12a9de6ac5a Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Thu, 23 Jul 2026 00:53:26 -0700
Subject: [PATCH 03/55] [web-console] RBAC/OIDC admin UX fixes

Owner-only per-tenant admin view plus role-scoping fixes surfaced by
browser QA of the RBAC/OIDC console.

- AdminPage: owner tenant picker drives the users and trust lists,
  managing any tenant in place via a per-call Feldera-Tenant header
  instead of the global acting-tenant switch.
- NewOidcTrustForm: offer the owner role only where owner trusts belong
  (the admin page), never in the tenant-scoped trust menu.
- NewApiKeyForm: cap the selectable key role to what the caller can
  grant, so a read-only user is not offered write (a guaranteed 403).
- auth.ts: honor an explicit Feldera-Tenant header over the global
  tenant selection, enabling the per-tenant admin view.
- pipelineManager.ts: thread an optional tenant into the admin wrappers.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 .../src/lib/components/admin/AdminPage.svelte | 47 ++++++++++++++++---
 .../lib/components/admin/UserRoleTable.svelte | 30 ++++++++----
 .../components/apiKey/NewApiKeyForm.svelte    | 12 ++++-
 .../oidcTrust/NewOidcTrustForm.svelte         | 37 ++++++++++-----
 .../web-console/src/lib/services/auth.ts      |  4 +-
 .../src/lib/services/pipelineManager.ts       | 37 ++++++++++-----
 6 files changed, 124 insertions(+), 43 deletions(-)

diff --git a/js-packages/web-console/src/lib/components/admin/AdminPage.svelte b/js-packages/web-console/src/lib/components/admin/AdminPage.svelte
index 02b14f88d49..8a73e46f6ca 100644
--- a/js-packages/web-console/src/lib/components/admin/AdminPage.svelte
+++ b/js-packages/web-console/src/lib/components/admin/AdminPage.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
   import { asyncReadable } from '@square/svelte-store'
+  import { Select } from 'common-ui'
   import { page } from '$app/state'
   import TenantList from '$lib/components/admin/TenantList.svelte'
   import UserRoleTable from '$lib/components/admin/UserRoleTable.svelte'
@@ -9,7 +10,9 @@
   import {
     deleteOidcTrust,
     getOidcTrustList,
-    type OidcTrustDescr
+    getTenants,
+    type OidcTrustDescr,
+    type Tenant
   } from '$lib/services/pipelineManager'
   import type { Snippet } from '$lib/types/svelte'
 
@@ -17,9 +20,22 @@
   const globalDialog = useGlobalDialog()
   let errorMessage = $state('')
 
+  // Owner-only per-tenant view: pick a tenant (by UUID) to inspect and manage
+  // its members and trusts in place, without changing the global acting-tenant.
+  // Empty string means the owner's own (globally selected) tenant.
+  let adminTenant = $state('')
+  const selectedTenant = $derived(adminTenant || undefined)
+  const tenants = asyncReadable<Tenant[]>([], getTenants, { reloadable: true })
+
   // OIDC trust list reused inline (admin/owner are granted to non-human
-  // principals through trust relationships).
-  const trusts = asyncReadable<OidcTrustDescr[]>([], getOidcTrustList, { reloadable: true })
+  // principals through trust relationships). Re-fetched for the selected tenant.
+  const trusts = asyncReadable<OidcTrustDescr[]>([], () => getOidcTrustList(selectedTenant), {
+    reloadable: true
+  })
+  $effect(() => {
+    selectedTenant
+    trusts.reload?.()
+  })
 </script>
 
 {#snippet section(title: string, description: string, body: Snippet)}
@@ -33,14 +49,27 @@
 {/snippet}
 
 <div class="mx-auto flex w-full max-w-4xl flex-col gap-6 px-2 pb-10 md:px-8">
-  <h1 class="h2">Administration</h1>
+  <div class="flex flex-wrap items-center justify-between gap-3">
+    <h1 class="h2">Administration</h1>
+    {#if isOwner}
+      <label class="flex items-center gap-2 text-sm">
+        <span class="opacity-70">Managing tenant</span>
+        <Select class="w-56" bind:value={adminTenant}>
+          <option value="">My tenant</option>
+          {#each $tenants as t (t.id)}
+            <option value={t.id}>{t.name}</option>
+          {/each}
+        </Select>
+      </label>
+    {/if}
+  </div>
 
   {#if errorMessage}
     <div class="rounded preset-outlined-error-600-400 p-2 text-sm">{errorMessage}</div>
   {/if}
 
   {#snippet usersBody()}
-    <UserRoleTable></UserRoleTable>
+    <UserRoleTable tenant={selectedTenant}></UserRoleTable>
   {/snippet}
   {@render section('Users & roles', 'Manage tenant members and their roles.', usersBody)}
 
@@ -57,7 +86,7 @@
                 name: 'Delete',
                 callback: async () => {
                   try {
-                    await deleteOidcTrust(trust.name)
+                    await deleteOidcTrust(trust.name, selectedTenant)
                     trusts.reload?.()
                   } catch (e) {
                     errorMessage = e instanceof Error ? e.message : String(e)
@@ -99,7 +128,11 @@
         <div class="opacity-70">No OIDC trust relationships configured</div>
       {/each}
     </div>
-    <NewOidcTrustForm onSuccess={() => trusts.reload?.()}></NewOidcTrustForm>
+    <NewOidcTrustForm
+      allowOwner={isOwner}
+      tenant={selectedTenant}
+      onSuccess={() => trusts.reload?.()}
+    ></NewOidcTrustForm>
   {/snippet}
   {@render section(
     'Admin & owner access (OIDC trust)',
diff --git a/js-packages/web-console/src/lib/components/admin/UserRoleTable.svelte b/js-packages/web-console/src/lib/components/admin/UserRoleTable.svelte
index b940cb02eee..f4baaef5855 100644
--- a/js-packages/web-console/src/lib/components/admin/UserRoleTable.svelte
+++ b/js-packages/web-console/src/lib/components/admin/UserRoleTable.svelte
@@ -11,7 +11,16 @@
     type TenantUser
   } from '$lib/services/pipelineManager'
 
-  const users = asyncReadable<TenantUser[]>([], getTenantUsers, { reloadable: true })
+  // Optional tenant (UUID/name): an owner viewing another tenant's members via
+  // the admin page's per-tenant picker, without changing the global selection.
+  const { tenant }: { tenant?: string } = $props()
+
+  const users = asyncReadable<TenantUser[]>([], () => getTenantUsers(tenant), { reloadable: true })
+  // Reload when the selected tenant changes.
+  $effect(() => {
+    tenant
+    users.reload?.()
+  })
 
   const globalDialog = useGlobalDialog()
 
@@ -39,12 +48,15 @@
     errorMessage = ''
     adding = true
     try {
-      await addTenantUser({
-        provider: newProvider.trim(),
-        subject: newSubject.trim(),
-        email: newEmail.trim() || undefined,
-        role: newRole
-      })
+      await addTenantUser(
+        {
+          provider: newProvider.trim(),
+          subject: newSubject.trim(),
+          email: newEmail.trim() || undefined,
+          role: newRole
+        },
+        tenant
+      )
       newProvider = ''
       newSubject = ''
       newEmail = ''
@@ -65,7 +77,7 @@
     errorMessage = ''
     savingUserId = user.user_id
     try {
-      await setTenantUserRole(user.user_id, role)
+      await setTenantUserRole(user.user_id, role, tenant)
       delete pendingRole[user.user_id]
       users.reload?.()
     } catch (e) {
@@ -154,7 +166,7 @@
                 // Surface failures instead of swallowing them and leaving the
                 // dialog stuck; only close on success.
                 try {
-                  await removeTenantUser(user.user_id)
+                  await removeTenantUser(user.user_id, tenant)
                   users.reload?.()
                   globalDialog.dialog = null
                 } catch (e) {
diff --git a/js-packages/web-console/src/lib/components/apiKey/NewApiKeyForm.svelte b/js-packages/web-console/src/lib/components/apiKey/NewApiKeyForm.svelte
index b1cf4edd540..8efe16852f4 100644
--- a/js-packages/web-console/src/lib/components/apiKey/NewApiKeyForm.svelte
+++ b/js-packages/web-console/src/lib/components/apiKey/NewApiKeyForm.svelte
@@ -6,9 +6,17 @@
   import * as va from 'valibot'
   import ClipboardCopyButton from '$lib/components/other/ClipboardCopyButton.svelte'
   import { usePipelineManager } from '$lib/compositions/usePipelineManager.svelte'
+  import { page } from '$app/state'
 
   const { onSubmit, onSuccess }: { onSubmit?: () => void; onSuccess?: () => void } = $props()
 
+  // A key can grant at most the caller's own role, and never above `write`
+  // (admin/owner are not mintable). So a read-only caller sees read only, and
+  // offering `write` to them (a guaranteed 403) is avoided.
+  const canGrantWrite = $derived(
+    ['write', 'admin', 'owner'].includes(page.data.feldera?.role ?? 'read')
+  )
+
   // API keys may only grant read or write; admin/owner are not valid here.
   const schema = va.object({
     name: va.pipe(va.string(), va.minLength(1, 'Specify API key name')),
@@ -70,7 +78,9 @@
             />
             <Select bind:value={$formData.role} class="w-28" aria-label="API key role">
               <option value="read">read</option>
-              <option value="write">write</option>
+              {#if canGrantWrite}
+                <option value="write">write</option>
+              {/if}
             </Select>
             <div class="">
               <button class="btn preset-filled-surface-50-950">Generate</button>
diff --git a/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte b/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte
index c51d0326b82..7239c16f911 100644
--- a/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte
+++ b/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte
@@ -8,16 +8,24 @@
   import { page } from '$app/state'
   import { postOidcTrust, type Role } from '$lib/services/pipelineManager'
 
-  const { onSubmit, onSuccess }: { onSubmit?: () => void; onSuccess?: () => void } = $props()
+  const {
+    onSubmit,
+    onSuccess,
+    allowOwner = false,
+    tenant
+  }: { onSubmit?: () => void; onSuccess?: () => void; allowOwner?: boolean; tenant?: string } =
+    $props()
 
   // Backend rejections (role cap, wildcard/audience breadth, duplicate name,
   // ...) can concern any field, so show them as a form-level error rather than
   // pinning every one to the Name field.
   let submitError = $state('')
 
-  // The backend caps the granted role at the caller's role; only an owner may
-  // grant `owner`, so offer it only then.
-  const isOwner = page.data.feldera?.isOwner ?? false
+  // `owner` is a platform-wide grant, so it is offered only to an owner AND only
+  // where owner trusts belong (the Admin page's owner-access section, which
+  // passes `allowOwner`). The tenant-scoped "Manage OIDC trust" menu never
+  // offers it. read/write/admin trusts are creatable by any tenant admin.
+  const canGrantOwner = allowOwner && (page.data.feldera?.isOwner ?? false)
 
   const schema = va.object({
     name: va.pipe(va.string(), va.minLength(1, 'Specify a name')),
@@ -46,14 +54,17 @@
         }
         submitError = ''
         onSubmit?.()
-        postOidcTrust({
-          name: f.data.name,
-          issuer: f.data.issuer,
-          subject: f.data.subject,
-          audience: f.data.audience || undefined,
-          description: f.data.description || undefined,
-          role: f.data.role
-        }).then(
+        postOidcTrust(
+          {
+            name: f.data.name,
+            issuer: f.data.issuer,
+            subject: f.data.subject,
+            audience: f.data.audience || undefined,
+            description: f.data.description || undefined,
+            role: f.data.role
+          },
+          tenant
+        ).then(
           () => onSuccess?.(),
           (e) => {
             submitError = e instanceof Error ? e.message : String(e)
@@ -160,7 +171,7 @@
           <option value="read">read</option>
           <option value="write">write</option>
           <option value="admin">admin</option>
-          {#if isOwner}
+          {#if canGrantOwner}
             <option value="owner">owner</option>
           {/if}
         </Select>
diff --git a/js-packages/web-console/src/lib/services/auth.ts b/js-packages/web-console/src/lib/services/auth.ts
index 8435c774008..a3fa0604cc2 100644
--- a/js-packages/web-console/src/lib/services/auth.ts
+++ b/js-packages/web-console/src/lib/services/auth.ts
@@ -28,8 +28,10 @@ export const applyAuthToRequest = (request: Request): Request => {
     const oidcClient = OidcClient.get()
     if (oidcClient.tokens?.accessToken) {
       request.headers.set('Authorization', `Bearer ${oidcClient.tokens.accessToken}`)
+      // A per-call `Feldera-Tenant` header (e.g. the admin page's per-tenant
+      // view) takes precedence over the global tenant selection.
       const tenant = getSelectedTenant()
-      if (tenant) {
+      if (tenant && !request.headers.has('Feldera-Tenant')) {
         request.headers.set('Feldera-Tenant', tenant)
       }
     }
diff --git a/js-packages/web-console/src/lib/services/pipelineManager.ts b/js-packages/web-console/src/lib/services/pipelineManager.ts
index 84a5a61bdc6..a5adfdf8cf3 100644
--- a/js-packages/web-console/src/lib/services/pipelineManager.ts
+++ b/js-packages/web-console/src/lib/services/pipelineManager.ts
@@ -634,36 +634,49 @@ export type Tenant = TenantInfo
 // through the generated client (same auth + 401-refresh interceptors as every
 // other call), wrapped in `mapResponse` for uniform error handling.
 
-export const getOidcTrustList = (options?: FetchOptions) =>
-  mapResponse(_listOidcTrust({ ...options }), (v) => v ?? [])
+// An optional `tenant` (name or UUID) sets a per-call `Feldera-Tenant` header,
+// letting an owner view/manage a specific tenant on the admin page without
+// changing the global acting-tenant selection. Omit it to use the current tenant.
+const tenantHdr = (tenant?: string) => (tenant ? { headers: { 'Feldera-Tenant': tenant } } : {})
 
-export const postOidcTrust = (body: NewOidcTrustRequest, options?: FetchOptions) =>
-  mapResponse(_postOidcTrust({ body, ...options }), (v) => v)
+export const getOidcTrustList = (tenant?: string, options?: FetchOptions) =>
+  mapResponse(_listOidcTrust({ ...tenantHdr(tenant), ...options }), (v) => v ?? [])
 
-export const deleteOidcTrust = (name: string, options?: FetchOptions) =>
-  mapResponse(_deleteOidcTrust({ path: { name }, ...options }), (v) => v)
+export const postOidcTrust = (body: NewOidcTrustRequest, tenant?: string, options?: FetchOptions) =>
+  mapResponse(_postOidcTrust({ body, ...tenantHdr(tenant), ...options }), (v) => v)
+
+export const deleteOidcTrust = (name: string, tenant?: string, options?: FetchOptions) =>
+  mapResponse(_deleteOidcTrust({ path: { name }, ...tenantHdr(tenant), ...options }), (v) => v)
 
 // Tenant users & roles (min role: admin).
 
-export const getTenantUsers = (options?: FetchOptions) =>
-  mapResponse(_listTenantUsers({ ...options }), (v) => v ?? [])
+export const getTenantUsers = (tenant?: string, options?: FetchOptions) =>
+  mapResponse(_listTenantUsers({ ...tenantHdr(tenant), ...options }), (v) => v ?? [])
 
 // Pre-provision a member by identity, before their first login. The grant is
 // dormant until that identity authenticates into the tenant through the IdP.
 export const addTenantUser = (
   body: { provider: string; subject: string; email?: string; role: 'read' | 'write' | 'admin' },
+  tenant?: string,
   options?: FetchOptions
-) => mapResponse(_addTenantUser({ body, ...options }), (v) => v)
+) => mapResponse(_addTenantUser({ body, ...tenantHdr(tenant), ...options }), (v) => v)
 
 export const setTenantUserRole = (
   userId: string,
   role: 'read' | 'write' | 'admin',
+  tenant?: string,
   options?: FetchOptions
 ) =>
-  mapResponse(_putTenantUser({ path: { user_id: userId }, body: { role }, ...options }), (v) => v)
+  mapResponse(
+    _putTenantUser({ path: { user_id: userId }, body: { role }, ...tenantHdr(tenant), ...options }),
+    (v) => v
+  )
 
-export const removeTenantUser = (userId: string, options?: FetchOptions) =>
-  mapResponse(_deleteTenantUser({ path: { user_id: userId }, ...options }), (v) => v)
+export const removeTenantUser = (userId: string, tenant?: string, options?: FetchOptions) =>
+  mapResponse(
+    _deleteTenantUser({ path: { user_id: userId }, ...tenantHdr(tenant), ...options }),
+    (v) => v
+  )
 
 // Tenant administration (min role: owner).
 

From 97dd62f7c8d9ffea92816b153c817965a7d84ce8 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Thu, 23 Jul 2026 09:30:41 -0700
Subject: [PATCH 04/55] [pipeline-manager] OIDC trust: header-based tenant
 selection

Decouple tenant selection from the `aud` claim. A federated token matching
trust relationships in several tenants picks one via the Feldera-Tenant
header instead of needing a tenant-specific audience.

- match_oidc_trust returns every matched tenant (was: fail closed on >1).
- auth: one match resolves directly; several require the header to name a
  matched tenant (400 when absent, 403 when the named tenant is untrusted).
  Owner trusts stay platform-wide (header selects any tenant).
- aud is now an optional match filter, not the tenant key; the trust breadth
  guards (subject/audience concreteness) are dropped accordingly.
- new errors AmbiguousOidcTenant (400) and OidcTenantNotTrusted (403);
  removed OidcTrustTooBroad.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 .../src/api/endpoints/oidc_trust.rs           |  33 +----
 crates/pipeline-manager/src/auth.rs           | 131 ++++++++++++------
 crates/pipeline-manager/src/db/error.rs       |  22 ++-
 .../src/db/operations/oidc_trust.rs           |  32 ++---
 crates/pipeline-manager/src/db/storage.rs     |   9 +-
 .../src/db/storage_postgres.rs                |   2 +-
 crates/pipeline-manager/src/db/test.rs        |  39 +++---
 7 files changed, 149 insertions(+), 119 deletions(-)

diff --git a/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs b/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
index 1a738ea3012..bd12661d90e 100644
--- a/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
+++ b/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
@@ -10,7 +10,7 @@ use crate::api::util::parse_url_parameter;
 use crate::auth::AuthenticatedPrincipal;
 use crate::db::error::DBError;
 use crate::db::storage::Storage;
-use crate::db::types::oidc_trust::{pattern_is_concrete, OidcTrustId};
+use crate::db::types::oidc_trust::OidcTrustId;
 use crate::db::types::role::Role;
 use crate::db::types::tenant::TenantId;
 use crate::error::ManagerError;
@@ -151,33 +151,10 @@ pub(crate) async fn post_oidc_trust(
         .into());
     }
 
-    // Breadth policy. `claim_matches` treats `*` anywhere in a pattern as a glob
-    // over any character run, so an unbounded pattern can authorize a wide set
-    // of tokens. `pattern_is_concrete` (defined next to the matcher) is the
-    // shared notion of "no wildcard".
-    let subject_concrete = pattern_is_concrete(&body.subject);
-    let audience_concrete = body.audience.as_deref().map(pattern_is_concrete);
-
-    // A wildcard subject with no concrete audience matches every token the
-    // issuer emits, i.e. the whole issuer acts as this tenant. Require a
-    // concrete audience to bound such a trust, at any role.
-    if !subject_concrete && audience_concrete != Some(true) {
-        return Err(DBError::OidcTrustTooBroad {
-            reason: "a wildcard 'subject' requires a concrete (non-wildcard) 'audience'"
-                .to_string(),
-        }
-        .into());
-    }
-    // Above `read`, both subject and audience must be concrete: an elevated
-    // trust must name exactly one workload identity, not a pattern.
-    if requested > Role::Read && !(subject_concrete && audience_concrete == Some(true)) {
-        return Err(DBError::OidcTrustTooBroad {
-            reason:
-                "subject and audience must be concrete (no '*' wildcard) for a role above 'read'"
-                    .to_string(),
-        }
-        .into());
-    }
+    // A trust is always scoped to a tenant (the acting tenant it is created in),
+    // and tenant selection at auth time comes from the Feldera-Tenant header when
+    // a token matches several tenants. So `subject`/`audience` carry no breadth
+    // restriction here; `audience`, if set, is only an extra match filter.
 
     state
         .db
diff --git a/crates/pipeline-manager/src/auth.rs b/crates/pipeline-manager/src/auth.rs
index 816ba3a6a12..9e677c40dc0 100644
--- a/crates/pipeline-manager/src/auth.rs
+++ b/crates/pipeline-manager/src/auth.rs
@@ -364,57 +364,102 @@ async fn oidc_trust_auth(
     }
 
     let audiences = audiences_from_claim(token_data.claims.aud.as_ref());
-    let lookup = {
+    let matches = {
         let db = state.db.lock().await;
         db.match_oidc_trust(&iss, &token_data.claims.sub, &audiences)
             .await
     };
-    match lookup {
-        Ok(Some((home_tenant, role))) => {
-            let label = format!("oidc:{}", token_data.claims.sub);
-            // An owner trust acts cross-tenant: the target tenant comes from the
-            // Feldera-Tenant header (strict lookup), defaulting to the trust's
-            // home tenant when no header is present.
-            let acting_tenant = if role == Role::Owner {
-                let acting = {
-                    let db = state.db.lock().await;
-                    resolve_owner_acting_tenant(&db, req.headers(), home_tenant).await
-                };
-                match acting {
-                    Ok(t) => t,
-                    Err(e) => return Err((e, req)),
-                }
-            } else {
-                home_tenant
-            };
-            AuthenticatedPrincipal {
-                acting_tenant,
-                home_tenant,
-                role,
-                label,
-            }
-            .install(&req);
-            Ok(req)
-        }
-        Ok(None) => {
-            let ip = req
-                .peer_addr()
-                .map(|a| a.ip().to_string())
-                .unwrap_or_else(|| "<unknown IP>".to_string());
-            error!(
-                "Federated JWT rejected: no trust relationship matches iss='{iss}' sub='{}' from {ip}",
-                token_data.claims.sub
-            );
-            unauthorized(
-                "No OIDC trust relationship matches this token".to_string(),
-                req,
-            )
-        }
+    let matches = match matches {
+        Ok(m) => m,
         Err(e) => {
             error!("Federated trust lookup failed: {e}");
-            unauthorized(format!("Database error: {e}"), req)
+            return unauthorized(format!("Database error: {e}"), req);
         }
+    };
+    if matches.is_empty() {
+        let ip = req
+            .peer_addr()
+            .map(|a| a.ip().to_string())
+            .unwrap_or_else(|| "<unknown IP>".to_string());
+        error!(
+            "Federated JWT rejected: no trust relationship matches iss='{iss}' sub='{}' from {ip}",
+            token_data.claims.sub
+        );
+        return unauthorized(
+            "No OIDC trust relationship matches this token".to_string(),
+            req,
+        );
     }
+
+    let label = format!("oidc:{}", token_data.claims.sub);
+    let db_err =
+        |e: DBError, req: ServiceRequest| Err((crate::error::ManagerError::from(e).into(), req));
+
+    // An owner trust is platform-wide: it wins over any tenant-scoped match, and
+    // the Feldera-Tenant header may select ANY existing tenant (default: the
+    // owner trust's own tenant).
+    if let Some((owner_home, _)) = matches.iter().find(|(_, r)| *r == Role::Owner).copied() {
+        let acting = {
+            let db = state.db.lock().await;
+            resolve_owner_acting_tenant(&db, req.headers(), owner_home).await
+        };
+        let acting_tenant = match acting {
+            Ok(t) => t,
+            Err(e) => return Err((e, req)),
+        };
+        AuthenticatedPrincipal {
+            acting_tenant,
+            home_tenant: owner_home,
+            role: Role::Owner,
+            label,
+        }
+        .install(&req);
+        return Ok(req);
+    }
+
+    // Tenant-scoped trust: one match is unambiguous; several require the
+    // Feldera-Tenant header to name one of the matched tenants (fail closed).
+    let (home_tenant, role) = if matches.len() == 1 {
+        matches[0]
+    } else {
+        let selector = req
+            .headers()
+            .get(TENANT_HEADER)
+            .and_then(|h| h.to_str().ok())
+            .filter(|s| !s.is_empty());
+        let Some(selector) = selector else {
+            return db_err(DBError::AmbiguousOidcTenant, req);
+        };
+        let selected = {
+            let db = state.db.lock().await;
+            db.resolve_tenant_selector(selector).await
+        };
+        // Unknown tenant name/UUID surfaces as 404; a known tenant the token is
+        // not trusted in is 403.
+        let selected = match selected {
+            Ok(t) => t,
+            Err(e) => return db_err(e, req),
+        };
+        match matches.iter().find(|(t, _)| *t == selected).copied() {
+            Some(pair) => pair,
+            None => {
+                return db_err(
+                    DBError::OidcTenantNotTrusted {
+                        tenant: selector.to_string(),
+                    },
+                    req,
+                )
+            }
+        }
+    };
+    AuthenticatedPrincipal {
+        acting_tenant: home_tenant,
+        home_tenant,
+        role,
+        label,
+    }
+    .install(&req);
+    Ok(req)
 }
 
 /// Resolve the tenant an `owner` acts in. The `Feldera-Tenant` header selects
diff --git a/crates/pipeline-manager/src/db/error.rs b/crates/pipeline-manager/src/db/error.rs
index fa235e25cdf..5bc30c83992 100644
--- a/crates/pipeline-manager/src/db/error.rs
+++ b/crates/pipeline-manager/src/db/error.rs
@@ -158,8 +158,9 @@ pub enum DBError {
     EmptyOidcTrustField {
         field: String,
     },
-    OidcTrustTooBroad {
-        reason: String,
+    AmbiguousOidcTenant,
+    OidcTenantNotTrusted {
+        tenant: String,
     },
     InvalidOidcToken {
         reason: String,
@@ -660,8 +661,15 @@ impl Display for DBError {
                     "OIDC trust relationship field '{field}' must not be empty"
                 )
             }
-            DBError::OidcTrustTooBroad { reason } => {
-                write!(f, "OIDC trust relationship is too broad: {reason}")
+            DBError::AmbiguousOidcTenant => {
+                write!(
+                    f,
+                    "Token matches trust relationships in multiple tenants; \
+                     set the Feldera-Tenant header to select one"
+                )
+            }
+            DBError::OidcTenantNotTrusted { tenant } => {
+                write!(f, "Token is not trusted in tenant '{tenant}'")
             }
             DBError::InvalidOidcToken { reason } => {
                 write!(f, "Invalid OIDC token: {reason}")
@@ -972,7 +980,8 @@ impl DetailedError for DBError {
             Self::UnknownUser { .. } => Cow::from("UnknownUser"),
             Self::UnknownOidcTrust { .. } => Cow::from("UnknownOidcTrust"),
             Self::EmptyOidcTrustField { .. } => Cow::from("EmptyOidcTrustField"),
-            Self::OidcTrustTooBroad { .. } => Cow::from("OidcTrustTooBroad"),
+            Self::AmbiguousOidcTenant => Cow::from("AmbiguousOidcTenant"),
+            Self::OidcTenantNotTrusted { .. } => Cow::from("OidcTenantNotTrusted"),
             Self::InvalidOidcToken { .. } => Cow::from("InvalidOidcToken"),
             Self::UnauthorizedOidcToken => Cow::from("UnauthorizedOidcToken"),
             Self::UnknownPipeline { .. } => Cow::from("UnknownPipeline"),
@@ -1097,7 +1106,8 @@ impl ResponseError for DBError {
             Self::UnknownUser { .. } => StatusCode::NOT_FOUND,
             Self::UnknownOidcTrust { .. } => StatusCode::NOT_FOUND,
             Self::EmptyOidcTrustField { .. } => StatusCode::BAD_REQUEST,
-            Self::OidcTrustTooBroad { .. } => StatusCode::BAD_REQUEST,
+            Self::AmbiguousOidcTenant => StatusCode::BAD_REQUEST,
+            Self::OidcTenantNotTrusted { .. } => StatusCode::FORBIDDEN,
             Self::InvalidOidcToken { .. } => StatusCode::UNAUTHORIZED,
             Self::UnauthorizedOidcToken => StatusCode::UNAUTHORIZED,
             Self::UnknownPipeline { .. } => StatusCode::NOT_FOUND,
diff --git a/crates/pipeline-manager/src/db/operations/oidc_trust.rs b/crates/pipeline-manager/src/db/operations/oidc_trust.rs
index e1bd2b5d5c9..2ef86386db8 100644
--- a/crates/pipeline-manager/src/db/operations/oidc_trust.rs
+++ b/crates/pipeline-manager/src/db/operations/oidc_trust.rs
@@ -157,19 +157,19 @@ pub async fn is_trusted_issuer(txn: &Transaction<'_>, issuer: &str) -> Result<bo
 
 /// Resolve a federated token to the tenant and role it is authorized for.
 ///
-/// All trusts registered for `issuer` whose subject pattern matches `subject`
-/// and (if present) audience pattern matches one of `audiences` are candidates.
-/// The `aud` claim is the disambiguator: a tenant scopes its trust with a
-/// tenant-specific audience. If candidates resolve to more than one distinct
-/// tenant, the match is ambiguous and rejected (fail closed) rather than
-/// silently crossing tenants. Within a single tenant the most permissive
-/// matching role wins.
+/// All tenants that trust this token, one entry each with the most permissive
+/// matching role in that tenant. A trust is a candidate when it is registered
+/// for `issuer`, its subject pattern matches `subject`, and, if it sets an
+/// audience pattern, that pattern matches one of `audiences` (the audience is a
+/// security filter, not the tenant key). When the result spans several tenants
+/// the caller disambiguates with the `Feldera-Tenant` header. Sorted by tenant
+/// for a deterministic order.
 pub async fn match_oidc_trust(
     txn: &Transaction<'_>,
     issuer: &str,
     subject: &str,
     audiences: &[String],
-) -> Result<Option<(TenantId, Role)>, DBError> {
+) -> Result<Vec<(TenantId, Role)>, DBError> {
     let stmt = txn
         .prepare_cached(
             "SELECT tenant_id, subject, audience, role \
@@ -177,7 +177,7 @@ pub async fn match_oidc_trust(
         )
         .await?;
     let rows = txn.query(&stmt, &[&issuer]).await?;
-    let mut matched: Option<(TenantId, Role)> = None;
+    let mut matched: Vec<(TenantId, Role)> = Vec::new();
     for row in rows {
         let tenant_id = TenantId(row.get(0));
         let pattern_subject: String = row.get(1);
@@ -192,17 +192,11 @@ pub async fn match_oidc_trust(
                 continue;
             }
         }
-        match matched {
-            None => matched = Some((tenant_id, role)),
-            Some((prev_tenant, prev_role)) => {
-                if prev_tenant != tenant_id {
-                    // Ambiguous cross-tenant match: fail closed. Operators must
-                    // disambiguate with tenant-specific audiences.
-                    return Err(DBError::UnauthorizedOidcToken);
-                }
-                matched = Some((tenant_id, prev_role.max(role)));
-            }
+        match matched.iter_mut().find(|(t, _)| *t == tenant_id) {
+            Some(entry) => entry.1 = entry.1.max(role),
+            None => matched.push((tenant_id, role)),
         }
     }
+    matched.sort_by_key(|(t, _)| t.0);
     Ok(matched)
 }
diff --git a/crates/pipeline-manager/src/db/storage.rs b/crates/pipeline-manager/src/db/storage.rs
index fb06ed187a4..136ce6d21cc 100644
--- a/crates/pipeline-manager/src/db/storage.rs
+++ b/crates/pipeline-manager/src/db/storage.rs
@@ -222,15 +222,16 @@ pub(crate) trait Storage {
     /// unregistered issuer never triggers an outbound request (SSRF/DoS gate).
     async fn is_trusted_issuer(&self, issuer: &str) -> Result<bool, DBError>;
 
-    /// Resolves a federated token to the tenant and role it is authorized for.
-    /// Returns `None` if no trust matches; errors if the match is ambiguous
-    /// across tenants (see [`crate::db::operations::oidc_trust::match_oidc_trust`]).
+    /// Every tenant that trusts a federated token, with the token's role in each
+    /// (see [`crate::db::operations::oidc_trust::match_oidc_trust`]). Empty when
+    /// no trust matches; more than one entry means the caller must pick a tenant
+    /// via the `Feldera-Tenant` header.
     async fn match_oidc_trust(
         &self,
         issuer: &str,
         subject: &str,
         audiences: &[String],
-    ) -> Result<Option<(TenantId, Role)>, DBError>;
+    ) -> Result<Vec<(TenantId, Role)>, DBError>;
 
     /// Retrieves a list of pipelines as extended descriptors.
     async fn list_pipelines(
diff --git a/crates/pipeline-manager/src/db/storage_postgres.rs b/crates/pipeline-manager/src/db/storage_postgres.rs
index 02a8e5137ad..2ebe0e6a42b 100644
--- a/crates/pipeline-manager/src/db/storage_postgres.rs
+++ b/crates/pipeline-manager/src/db/storage_postgres.rs
@@ -361,7 +361,7 @@ impl Storage for StoragePostgres {
         issuer: &str,
         subject: &str,
         audiences: &[String],
-    ) -> Result<Option<(TenantId, Role)>, DBError> {
+    ) -> Result<Vec<(TenantId, Role)>, DBError> {
         let mut client = self.pool.get().await?;
         let txn = client.transaction().await?;
         let result =
diff --git a/crates/pipeline-manager/src/db/test.rs b/crates/pipeline-manager/src/db/test.rs
index 905dc7910f8..1ef695310f2 100644
--- a/crates/pipeline-manager/src/db/test.rs
+++ b/crates/pipeline-manager/src/db/test.rs
@@ -881,8 +881,9 @@ async fn rbac_login_resolution_and_membership() {
 }
 
 /// Federated-token resolution: the issuer gate rejects unregistered issuers
-/// before any fetch, the audience disambiguates between tenants trusting the
-/// same identity, and an ambiguous cross-tenant match fails closed.
+/// before any fetch, an optional audience narrows candidates, and a token
+/// trusted by several tenants returns all of them (the caller disambiguates via
+/// the Feldera-Tenant header, verified at the auth layer).
 #[tokio::test]
 async fn oidc_trust_matching_and_issuer_gate() {
     let handle = test_setup().await;
@@ -915,7 +916,7 @@ async fn oidc_trust_matching_and_issuer_gate() {
         .match_oidc_trust(iss, "system:sa:app", &["a".to_string()])
         .await
         .unwrap()
-        .is_none());
+        .is_empty());
 
     // Two tenants trust the same issuer+subject, disambiguated by audience.
     let sub = "system:sa:app";
@@ -955,7 +956,7 @@ async fn oidc_trust_matching_and_issuer_gate() {
             .match_oidc_trust(iss, sub, &["a".to_string()])
             .await
             .unwrap(),
-        Some((tenant_a, Role::Write))
+        vec![(tenant_a, Role::Write)]
     );
     assert_eq!(
         handle
@@ -963,7 +964,7 @@ async fn oidc_trust_matching_and_issuer_gate() {
             .match_oidc_trust(iss, sub, &["b".to_string()])
             .await
             .unwrap(),
-        Some((tenant_b, Role::Write))
+        vec![(tenant_b, Role::Write)]
     );
     // A token whose audience matches neither trust does not resolve.
     assert!(handle
@@ -971,11 +972,12 @@ async fn oidc_trust_matching_and_issuer_gate() {
         .match_oidc_trust(iss, sub, &["c".to_string()])
         .await
         .unwrap()
-        .is_none());
+        .is_empty());
 
     // A third tenant trusts the same issuer+subject with NO audience, so it
-    // matches any token. A token now resolves to two distinct tenants: the
-    // match is ambiguous and fails closed rather than picking one arbitrarily.
+    // matches any token. A token with audience "a" now resolves to two tenants
+    // (a via its audience, c via the wildcard); both are returned so the auth
+    // layer can pick one from the Feldera-Tenant header.
     let tenant_c = mk_tenant("c").await;
     handle
         .db
@@ -991,14 +993,15 @@ async fn oidc_trust_matching_and_issuer_gate() {
         )
         .await
         .unwrap();
-    assert!(matches!(
-        handle
-            .db
-            .match_oidc_trust(iss, sub, &["a".to_string()])
-            .await
-            .unwrap_err(),
-        DBError::UnauthorizedOidcToken
-    ));
+    let mut got = handle
+        .db
+        .match_oidc_trust(iss, sub, &["a".to_string()])
+        .await
+        .unwrap();
+    got.sort_by_key(|(t, _)| t.0);
+    let mut want = vec![(tenant_a, Role::Write), (tenant_c, Role::Read)];
+    want.sort_by_key(|(t, _)| t.0);
+    assert_eq!(got, want);
 }
 
 /// Pre-provisioning: an admin grants a role by identity before first login; the
@@ -5108,8 +5111,8 @@ impl Storage for Mutex<DbModel> {
         _issuer: &str,
         _subject: &str,
         _audiences: &[String],
-    ) -> DBResult<Option<(TenantId, Role)>> {
-        Ok(None)
+    ) -> DBResult<Vec<(TenantId, Role)>> {
+        Ok(vec![])
     }
 
     // RBAC user/membership methods are not exercised by the proptest model.

From 8d661576056e5ea24ba2fbf672ffc0d9740f00da Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Thu, 23 Jul 2026 09:30:41 -0700
Subject: [PATCH 05/55] [web-console] Admin page: clearer tenant scope and
 owner-vs-tenant trust

- Prominent owner-only "Viewing & managing tenant" switcher; each section is
  titled with the tenant it applies to.
- Split OIDC trust into a tenant-scoped section (read/write/admin) and an
  owner-only platform-wide section; NewOidcTrustForm gains a fixedRole prop.
- Trust form help text: audience is an optional filter and the tenant comes
  from the Feldera-Tenant header, not the aud claim.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 .../src/lib/components/admin/AdminPage.svelte | 198 ++++++++++--------
 .../oidcTrust/NewOidcTrustForm.svelte         |  59 ++++--
 2 files changed, 150 insertions(+), 107 deletions(-)

diff --git a/js-packages/web-console/src/lib/components/admin/AdminPage.svelte b/js-packages/web-console/src/lib/components/admin/AdminPage.svelte
index 8a73e46f6ca..5f98c1e52fd 100644
--- a/js-packages/web-console/src/lib/components/admin/AdminPage.svelte
+++ b/js-packages/web-console/src/lib/components/admin/AdminPage.svelte
@@ -26,12 +26,18 @@
   let adminTenant = $state('')
   const selectedTenant = $derived(adminTenant || undefined)
   const tenants = asyncReadable<Tenant[]>([], getTenants, { reloadable: true })
+  const tenantLabel = $derived(
+    adminTenant ? ($tenants.find((t) => t.id === adminTenant)?.name ?? adminTenant) : 'current tenant'
+  )
 
-  // OIDC trust list reused inline (admin/owner are granted to non-human
-  // principals through trust relationships). Re-fetched for the selected tenant.
+  // Trusts for the selected tenant, split by grant scope: `owner` is a
+  // platform-wide grant managed in its own section; read/write/admin are
+  // tenant-scoped.
   const trusts = asyncReadable<OidcTrustDescr[]>([], () => getOidcTrustList(selectedTenant), {
     reloadable: true
   })
+  const ownerTrusts = $derived($trusts.filter((t) => t.role === 'owner'))
+  const tenantTrusts = $derived($trusts.filter((t) => t.role !== 'owner'))
   $effect(() => {
     selectedTenant
     trusts.reload?.()
@@ -48,21 +54,86 @@
   </section>
 {/snippet}
 
-<div class="mx-auto flex w-full max-w-4xl flex-col gap-6 px-2 pb-10 md:px-8">
-  <div class="flex flex-wrap items-center justify-between gap-3">
-    <h1 class="h2">Administration</h1>
-    {#if isOwner}
-      <label class="flex items-center gap-2 text-sm">
-        <span class="opacity-70">Managing tenant</span>
-        <Select class="w-56" bind:value={adminTenant}>
-          <option value="">My tenant</option>
-          {#each $tenants as t (t.id)}
-            <option value={t.id}>{t.name}</option>
-          {/each}
-        </Select>
-      </label>
-    {/if}
+{#snippet trustList(list: OidcTrustDescr[])}
+  <div class="scrollbar flex max-h-[40vh] flex-col gap-2 overflow-auto">
+    {#each list as trust (trust.id)}
+      {#snippet deleteTrustDialog()}
+        <GenericDialog
+          content={{
+            title: `Delete trust '${trust.name}'?`,
+            description: 'Tokens matching this trust immediately lose access. This cannot be undone.',
+            onSuccess: {
+              name: 'Delete',
+              callback: async () => {
+                try {
+                  await deleteOidcTrust(trust.name, selectedTenant)
+                  trusts.reload?.()
+                } catch (e) {
+                  errorMessage = e instanceof Error ? e.message : String(e)
+                }
+                globalDialog.dialog = null
+              }
+            },
+            onCancel: {
+              callback: () => {
+                globalDialog.dialog = null
+              }
+            }
+          }}
+          noclose
+          danger
+        ></GenericDialog>
+      {/snippet}
+      <div class="flex flex-nowrap items-center gap-2 border-b border-surface-100-900 py-2">
+        <div class="w-full">
+          <div>
+            {trust.name}
+            <span class="text-xs opacity-70">[{trust.role}]</span>
+          </div>
+          <div class="text-sm opacity-70">
+            <code>{trust.issuer}</code> · sub=<code>{trust.subject}</code>{#if trust.audience}
+              · aud=<code>{trust.audience}</code>{/if}
+          </div>
+          {#if trust.description}
+            <div class="text-xs opacity-70">{trust.description}</div>
+          {/if}
+        </div>
+        <button
+          class="fd fd-trash-2 btn-icon text-[20px]"
+          aria-label="Delete {trust.name} trust relationship"
+          onclick={() => (globalDialog.dialog = deleteTrustDialog)}
+        ></button>
+      </div>
+    {:else}
+      <div class="opacity-70">None configured</div>
+    {/each}
   </div>
+{/snippet}
+
+<div class="mx-auto flex w-full max-w-4xl flex-col gap-6 px-2 pb-10 md:px-8">
+  <h1 class="h2">Administration</h1>
+
+  {#if isOwner}
+    <!-- Owner-only tenant switcher. Prominent so it is not mistaken for a minor
+         control: everything below (users, trusts) reflects the chosen tenant. -->
+    <div
+      class="flex flex-wrap items-center gap-3 rounded-container preset-outlined-primary-500 p-3 md:p-4"
+    >
+      <span class="fd fd-building text-[24px]"></span>
+      <div class="flex flex-col">
+        <span class="text-xs font-semibold uppercase tracking-wide opacity-70">
+          Viewing &amp; managing tenant
+        </span>
+        <span class="text-sm opacity-70">Everything below applies to this tenant.</span>
+      </div>
+      <Select class="ml-auto w-64" bind:value={adminTenant}>
+        <option value="">Current tenant</option>
+        {#each $tenants as t (t.id)}
+          <option value={t.id}>{t.name}</option>
+        {/each}
+      </Select>
+    </div>
+  {/if}
 
   {#if errorMessage}
     <div class="rounded preset-outlined-error-600-400 p-2 text-sm">{errorMessage}</div>
@@ -71,83 +142,42 @@
   {#snippet usersBody()}
     <UserRoleTable tenant={selectedTenant}></UserRoleTable>
   {/snippet}
-  {@render section('Users & roles', 'Manage tenant members and their roles.', usersBody)}
+  {@render section(
+    `Users & roles — ${tenantLabel}`,
+    'Members of this tenant and their roles.',
+    usersBody
+  )}
 
-  {#snippet oidcBody()}
-    <div class="scrollbar flex max-h-[40vh] flex-col gap-2 overflow-auto">
-      {#each $trusts as trust (trust.id)}
-        {#snippet deleteTrustDialog()}
-          <GenericDialog
-            content={{
-              title: `Delete trust '${trust.name}'?`,
-              description:
-                'Tokens matching this trust immediately lose access. This cannot be undone.',
-              onSuccess: {
-                name: 'Delete',
-                callback: async () => {
-                  try {
-                    await deleteOidcTrust(trust.name, selectedTenant)
-                    trusts.reload?.()
-                  } catch (e) {
-                    errorMessage = e instanceof Error ? e.message : String(e)
-                  }
-                  globalDialog.dialog = null
-                }
-              },
-              onCancel: {
-                callback: () => {
-                  globalDialog.dialog = null
-                }
-              }
-            }}
-            noclose
-            danger
-          ></GenericDialog>
-        {/snippet}
-        <div class="flex flex-nowrap items-center gap-2 border-b border-surface-100-900 py-2">
-          <div class="w-full">
-            <div>
-              {trust.name}
-              <span class="text-xs opacity-70">[{trust.role}]</span>
-            </div>
-            <div class="text-sm opacity-70">
-              <code>{trust.issuer}</code> · sub=<code>{trust.subject}</code>{#if trust.audience}
-                · aud=<code>{trust.audience}</code>{/if}
-            </div>
-            {#if trust.description}
-              <div class="text-xs opacity-70">{trust.description}</div>
-            {/if}
-          </div>
-          <button
-            class="fd fd-trash-2 btn-icon text-[20px]"
-            aria-label="Delete {trust.name} trust relationship"
-            onclick={() => (globalDialog.dialog = deleteTrustDialog)}
-          ></button>
-        </div>
-      {:else}
-        <div class="opacity-70">No OIDC trust relationships configured</div>
-      {/each}
-    </div>
-    <NewOidcTrustForm
-      allowOwner={isOwner}
-      tenant={selectedTenant}
-      onSuccess={() => trusts.reload?.()}
+  {#snippet tenantTrustBody()}
+    {@render trustList(tenantTrusts)}
+    <NewOidcTrustForm allowOwner={false} tenant={selectedTenant} onSuccess={() => trusts.reload?.()}
     ></NewOidcTrustForm>
   {/snippet}
   {@render section(
-    'Admin & owner access (OIDC trust)',
-    'Grant roles to non-human principals (CI, services) by trusting JWTs from an issuer.',
-    oidcBody
+    `Tenant OIDC trust — ${tenantLabel}`,
+    'Grant read/write/admin to workloads (CI, services) in this tenant by trusting JWTs from an issuer.',
+    tenantTrustBody
   )}
 
   {#if isOwner}
-    {#snippet tenantsBody()}
-      <TenantList></TenantList>
+    {#snippet ownerTrustBody()}
+      {@render trustList(ownerTrusts)}
+      <NewOidcTrustForm
+        fixedRole="owner"
+        allowOwner={true}
+        tenant={selectedTenant}
+        onSuccess={() => trusts.reload?.()}
+      ></NewOidcTrustForm>
     {/snippet}
     {@render section(
-      'Tenants',
-      'Owner-only: list and create tenants, and switch the active tenant.',
-      tenantsBody
+      'Owner access (platform-wide)',
+      'Owner trusts grant full platform access across all tenants. Only owners manage these, and only here.',
+      ownerTrustBody
     )}
+
+    {#snippet tenantsBody()}
+      <TenantList></TenantList>
+    {/snippet}
+    {@render section('Tenants', 'Owner-only: list and create tenants.', tenantsBody)}
   {/if}
 </div>
diff --git a/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte b/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte
index 7239c16f911..2d6316697bc 100644
--- a/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte
+++ b/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte
@@ -12,13 +12,20 @@
     onSubmit,
     onSuccess,
     allowOwner = false,
+    fixedRole,
     tenant
-  }: { onSubmit?: () => void; onSuccess?: () => void; allowOwner?: boolean; tenant?: string } =
-    $props()
+  }: {
+    onSubmit?: () => void
+    onSuccess?: () => void
+    allowOwner?: boolean
+    // When set, the form creates trusts at exactly this role and hides the role
+    // picker (the admin page's owner-access section passes `fixedRole="owner"`).
+    fixedRole?: Role
+    tenant?: string
+  } = $props()
 
-  // Backend rejections (role cap, wildcard/audience breadth, duplicate name,
-  // ...) can concern any field, so show them as a form-level error rather than
-  // pinning every one to the Name field.
+  // Backend rejections (role cap, duplicate name, ...) can concern any field, so
+  // show them as a form-level error rather than pinning every one to Name.
   let submitError = $state('')
 
   // `owner` is a platform-wide grant, so it is offered only to an owner AND only
@@ -43,7 +50,7 @@
       subject: '',
       audience: '',
       description: '',
-      role: 'read' as Role
+      role: (fixedRole ?? 'read') as Role
     },
     {
       SPA: true,
@@ -163,26 +170,32 @@
     </Control>
   </Field>
 
-  <Field {form} name="role">
-    <Control>
-      {#snippet children(attrs)}
-        <Label>Role</Label>
-        <Select class="w-full" {...attrs} bind:value={$formData.role}>
-          <option value="read">read</option>
-          <option value="write">write</option>
-          <option value="admin">admin</option>
-          {#if canGrantOwner}
-            <option value="owner">owner</option>
-          {/if}
-        </Select>
-      {/snippet}
-    </Control>
-  </Field>
+  {#if fixedRole}
+    <input type="hidden" bind:value={$formData.role} />
+  {:else}
+    <Field {form} name="role">
+      <Control>
+        {#snippet children(attrs)}
+          <Label>Role</Label>
+          <Select class="w-full" {...attrs} bind:value={$formData.role}>
+            <option value="read">read</option>
+            <option value="write">write</option>
+            <option value="admin">admin</option>
+            {#if canGrantOwner}
+              <option value="owner">owner</option>
+            {/if}
+          </Select>
+        {/snippet}
+      </Control>
+    </Field>
+  {/if}
 
   <p class="text-xs opacity-70">
     JWTs from <code>Issuer</code> whose <code>sub</code> matches
-    <code>Subject pattern</code> (and, if specified, whose <code>aud</code> matches
-    <code>Audience pattern</code>) authorize requests as this tenant. <code>*</code> is a wildcard.
+    <code>Subject pattern</code> authorize requests. <code>Audience pattern</code>, if set, is an
+    extra filter on the <code>aud</code> claim (not the tenant selector). <code>*</code> is a
+    wildcard. When one identity is trusted by several tenants, the
+    <code>Feldera-Tenant</code> header picks which one.
   </p>
 
   {#if submitError}

From 136f14dc818a1d4ce8b2ac99a7c964339381ecd9 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Thu, 23 Jul 2026 16:16:43 -0700
Subject: [PATCH 06/55] [pipeline-manager] OIDC trust: platform-wide owner
 trusts + issuer lockdown

Make an owner trust genuinely platform-wide, and stop callers from choosing the
identity provider a tenant or member is keyed to.

- oidc_trust_relationship.tenant_id is nullable: NULL for a platform-wide owner
  trust, set for a tenant-scoped one, tied together by a CHECK ((tenant_id IS
  NULL) = (role = 'owner')). A partial unique index keeps owner-trust names
  globally unique; owner trusts no longer cascade-delete with a tenant.
- match_oidc_trust returns Option<TenantId> scopes. A token that matches several
  scopes selects one via the Feldera-Tenant header; an owner-trust token must
  name its acting tenant (400 OwnerTrustNeedsTenant) since it has no home tenant.
- GET/DELETE /v0/oidc_trust take a 'platform' scope (owner-only); POST infers the
  scope from the requested role.
- Tenant creation and member pre-provisioning key to the platform's configured
  issuer (AuthConfiguration), dropping the caller-settable 'provider' field.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 .../migrations/V35__oidc_trust.sql            |  24 +++-
 .../src/api/endpoints/oidc_trust.rs           |  78 +++++++++---
 .../src/api/endpoints/tenant.rs               |  43 +++++--
 crates/pipeline-manager/src/auth.rs           |  64 +++++-----
 crates/pipeline-manager/src/db/error.rs       |  10 ++
 .../src/db/operations/oidc_trust.rs           | 115 ++++++++++++------
 crates/pipeline-manager/src/db/storage.rs     |  27 ++--
 .../src/db/storage_postgres.rs                |  17 ++-
 crates/pipeline-manager/src/db/test.rs        |  82 +++++++++++--
 openapi.json                                  |  46 ++++---
 10 files changed, 361 insertions(+), 145 deletions(-)

diff --git a/crates/pipeline-manager/migrations/V35__oidc_trust.sql b/crates/pipeline-manager/migrations/V35__oidc_trust.sql
index a74f28199b0..297e5542c89 100644
--- a/crates/pipeline-manager/migrations/V35__oidc_trust.sql
+++ b/crates/pipeline-manager/migrations/V35__oidc_trust.sql
@@ -1,22 +1,34 @@
 -- Trust relationships for OIDC workload identity federation.
 --
--- A tenant registers an issuer plus subject/audience match patterns; an
--- incoming JWT from that issuer whose claims satisfy the patterns is authorized
--- to act as the tenant with the recorded role, like a signature-verified API
--- key. `role` is the RBAC role granted (see V36); it is capped at the creator's
--- role at write time and defaults to the least privilege.
+-- A trust registers an issuer plus subject/audience match patterns; an incoming
+-- JWT from that issuer whose claims satisfy the patterns is authorized with the
+-- recorded role, like a signature-verified API key. `role` is the RBAC role
+-- granted (see V36), capped at the creator's role at write time.
+--
+-- Scope follows the role. read/write/admin trusts are tenant-scoped: `tenant_id`
+-- names the tenant they authorize into. An `owner` trust is platform-wide and
+-- belongs to no tenant, so `tenant_id` is NULL; the acting tenant then comes
+-- from the Feldera-Tenant header at request time. The CHECK makes the two
+-- inseparable: tenant_id is NULL if and only if the role is owner.
 CREATE TABLE IF NOT EXISTS oidc_trust_relationship (
     id uuid PRIMARY KEY,
-    tenant_id uuid NOT NULL,
+    tenant_id uuid,
     name varchar NOT NULL,
     description varchar,
     issuer varchar NOT NULL,
     subject varchar NOT NULL,
     audience varchar,
     role text NOT NULL DEFAULT 'read' CHECK (role IN ('read', 'write', 'admin', 'owner')),
+    CONSTRAINT oidc_trust_owner_is_platform CHECK ((tenant_id IS NULL) = (role = 'owner')),
     CONSTRAINT unique_oidc_trust_name UNIQUE (tenant_id, name),
     FOREIGN KEY (tenant_id) REFERENCES tenant(id) ON DELETE CASCADE
 );
 
+-- unique_oidc_trust_name bounds tenant-scoped names per tenant, but a UNIQUE
+-- constraint treats NULL tenant_ids as distinct and so does not bound owner
+-- trusts. Name owner trusts uniquely across the platform with a partial index.
+CREATE UNIQUE INDEX IF NOT EXISTS idx_oidc_owner_trust_name
+    ON oidc_trust_relationship (name) WHERE tenant_id IS NULL;
+
 -- The auth hot path resolves a federated token by its issuer, so index it.
 CREATE INDEX IF NOT EXISTS idx_oidc_trust_issuer ON oidc_trust_relationship (issuer);
diff --git a/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs b/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
index bd12661d90e..3830339fab6 100644
--- a/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
+++ b/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
@@ -23,9 +23,39 @@ use actix_web::{
 };
 use serde::{Deserialize, Serialize};
 use tracing::info;
-use utoipa::ToSchema;
+use utoipa::{IntoParams, ToSchema};
 use uuid::Uuid;
 
+/// Selects which trusts an operation targets.
+#[derive(Debug, Default, Deserialize, IntoParams)]
+pub(crate) struct TrustScope {
+    /// Operate on platform-wide owner trusts (which belong to no tenant) instead
+    /// of the caller's tenant. Owner-only.
+    #[serde(default)]
+    platform: bool,
+}
+
+// The scope a trust operation targets: `None` (platform-wide owner trusts, which
+// only an owner may touch) when `platform` is set, else the caller's tenant.
+fn trust_scope(
+    scope: &TrustScope,
+    tenant_id: TenantId,
+    role: Role,
+) -> Result<Option<TenantId>, ManagerError> {
+    if scope.platform {
+        if role != Role::Owner {
+            return Err(DBError::InsufficientPermissions {
+                required: Role::Owner,
+                actual: role,
+            }
+            .into());
+        }
+        Ok(None)
+    } else {
+        Ok(Some(tenant_id))
+    }
+}
+
 /// Request to create a new OIDC trust relationship.
 #[derive(Debug, Deserialize, ToSchema)]
 pub(crate) struct NewOidcTrustRequest {
@@ -72,6 +102,7 @@ pub(crate) struct NewOidcTrustResponse {
 #[utoipa::path(
     context_path = "/v0",
     security(("JSON web token (JWT) or API key" = [])),
+    params(TrustScope),
     responses(
         (status = OK, description = "Trust relationships retrieved", body = [OidcTrustDescr]),
         (status = INTERNAL_SERVER_ERROR, body = ErrorResponse)
@@ -82,8 +113,11 @@ pub(crate) struct NewOidcTrustResponse {
 pub(crate) async fn list_oidc_trust(
     state: WebData<ServerState>,
     tenant_id: ReqData<TenantId>,
+    principal: ReqData<AuthenticatedPrincipal>,
+    scope: web::Query<TrustScope>,
 ) -> Result<HttpResponse, ManagerError> {
-    let items = state.db.lock().await.list_oidc_trust(*tenant_id).await?;
+    let scope = trust_scope(&scope, *tenant_id, principal.role)?;
+    let items = state.db.lock().await.list_oidc_trust(scope).await?;
     Ok(HttpResponse::Ok()
         .insert_header(CacheControl(vec![CacheDirective::NoCache]))
         .json(&items))
@@ -93,7 +127,7 @@ pub(crate) async fn list_oidc_trust(
 #[utoipa::path(
     context_path = "/v0",
     security(("JSON web token (JWT) or API key" = [])),
-    params(("name" = String, Path, description = "Trust relationship name")),
+    params(("name" = String, Path, description = "Trust relationship name"), TrustScope),
     responses(
         (status = OK, description = "Trust relationship retrieved", body = OidcTrustDescr),
         (status = NOT_FOUND, description = "No relationship with that name", body = ErrorResponse)
@@ -104,15 +138,13 @@ pub(crate) async fn list_oidc_trust(
 pub(crate) async fn get_oidc_trust(
     state: WebData<ServerState>,
     tenant_id: ReqData<TenantId>,
+    principal: ReqData<AuthenticatedPrincipal>,
+    scope: web::Query<TrustScope>,
     req: HttpRequest,
 ) -> Result<HttpResponse, ManagerError> {
     let name = parse_url_parameter(&req, "name")?;
-    let item = state
-        .db
-        .lock()
-        .await
-        .get_oidc_trust(*tenant_id, &name)
-        .await?;
+    let scope = trust_scope(&scope, *tenant_id, principal.role)?;
+    let item = state.db.lock().await.get_oidc_trust(scope, &name).await?;
     Ok(HttpResponse::Ok()
         .insert_header(CacheControl(vec![CacheDirective::NoCache]))
         .json(&item))
@@ -151,17 +183,22 @@ pub(crate) async fn post_oidc_trust(
         .into());
     }
 
-    // A trust is always scoped to a tenant (the acting tenant it is created in),
-    // and tenant selection at auth time comes from the Feldera-Tenant header when
-    // a token matches several tenants. So `subject`/`audience` carry no breadth
-    // restriction here; `audience`, if set, is only an extra match filter.
+    // Scope follows the role: an owner trust is platform-wide (no tenant), any
+    // other role is scoped to the acting tenant. `subject`/`audience` carry no
+    // breadth restriction; `audience`, if set, is only an extra match filter and
+    // tenant selection at auth time comes from the Feldera-Tenant header.
+    let scope = if requested == Role::Owner {
+        None
+    } else {
+        Some(*tenant_id)
+    };
 
     state
         .db
         .lock()
         .await
         .create_oidc_trust(
-            *tenant_id,
+            scope,
             new_id,
             &body.name,
             body.description.as_deref(),
@@ -172,8 +209,8 @@ pub(crate) async fn post_oidc_trust(
         )
         .await?;
     info!(
-        "Created OIDC trust '{}' (tenant: {}, issuer: {})",
-        body.name, *tenant_id, body.issuer
+        "Created OIDC trust '{}' (scope: {:?}, issuer: {})",
+        body.name, scope, body.issuer
     );
     Ok(HttpResponse::Created()
         .insert_header(CacheControl(vec![CacheDirective::NoCache]))
@@ -187,7 +224,7 @@ pub(crate) async fn post_oidc_trust(
 #[utoipa::path(
     context_path = "/v0",
     security(("JSON web token (JWT) or API key" = [])),
-    params(("name" = String, Path, description = "Trust relationship name")),
+    params(("name" = String, Path, description = "Trust relationship name"), TrustScope),
     responses(
         (status = OK, description = "Trust relationship deleted"),
         (status = NOT_FOUND, description = "No relationship with that name", body = ErrorResponse)
@@ -198,15 +235,18 @@ pub(crate) async fn post_oidc_trust(
 pub(crate) async fn delete_oidc_trust(
     state: WebData<ServerState>,
     tenant_id: ReqData<TenantId>,
+    principal: ReqData<AuthenticatedPrincipal>,
+    scope: web::Query<TrustScope>,
     req: HttpRequest,
 ) -> Result<HttpResponse, ManagerError> {
     let name = parse_url_parameter(&req, "name")?;
+    let scope = trust_scope(&scope, *tenant_id, principal.role)?;
     state
         .db
         .lock()
         .await
-        .delete_oidc_trust(*tenant_id, &name)
+        .delete_oidc_trust(scope, &name)
         .await?;
-    info!("Deleted OIDC trust '{name}' (tenant: {})", *tenant_id);
+    info!("Deleted OIDC trust '{name}' (scope: {scope:?})");
     Ok(HttpResponse::Ok().finish())
 }
diff --git a/crates/pipeline-manager/src/api/endpoints/tenant.rs b/crates/pipeline-manager/src/api/endpoints/tenant.rs
index 1bcf8cb4a43..62cbfd9d9e4 100644
--- a/crates/pipeline-manager/src/api/endpoints/tenant.rs
+++ b/crates/pipeline-manager/src/api/endpoints/tenant.rs
@@ -38,10 +38,9 @@ pub(crate) struct SetMemberRoleRequest {
 /// first login.
 #[derive(Debug, Deserialize, ToSchema)]
 pub(crate) struct AddMemberRequest {
-    /// OIDC issuer the user authenticates through (matches the JWT `iss` claim).
-    #[schema(example = "https://accounts.google.com")]
-    pub provider: String,
-    /// OIDC subject (matches the JWT `sub` claim).
+    /// OIDC subject (matches the JWT `sub` claim). The issuer is not settable:
+    /// members authenticate through the platform's single configured issuer, so
+    /// the grant is keyed to that issuer automatically.
     #[schema(example = "user@acme.com")]
     pub subject: String,
     /// Optional email for display in the member list.
@@ -79,10 +78,6 @@ fn check_grantable_role(requested: Role, caller: Role) -> Result<(), ManagerErro
 pub(crate) struct NewTenantRequest {
     #[schema(example = "acme")]
     pub name: String,
-    /// Identity provider the tenant is keyed under. Defaults to `manual` for
-    /// tenants created out of band by an owner.
-    #[serde(default)]
-    pub provider: Option<String>,
 }
 
 fn parse_user_id(req: &HttpRequest) -> Result<UserId, ManagerError> {
@@ -215,10 +210,18 @@ pub(crate) async fn add_tenant_user(
     tenant_id: ReqData<TenantId>,
     principal: ReqData<AuthenticatedPrincipal>,
     body: web::Json<AddMemberRequest>,
+    req: HttpRequest,
 ) -> Result<HttpResponse, ManagerError> {
     let body = body.into_inner();
     check_grantable_role(body.role, principal.role)?;
 
+    // The provider is the platform's configured issuer, not caller-set: a human
+    // login's `iss` is always that issuer, so the grant must be keyed to it to
+    // attach (mirrors tenant creation).
+    let provider = req
+        .app_data::<crate::auth::AuthConfiguration>()
+        .map(|c| c.provider.issuer().to_string())
+        .unwrap_or_else(|| "manual".to_string());
     let user_id = state
         .db
         .lock()
@@ -226,7 +229,7 @@ pub(crate) async fn add_tenant_user(
         .preprovision_member(
             Uuid::now_v7(),
             *tenant_id,
-            &body.provider,
+            &provider,
             &body.subject,
             body.email.as_deref(),
             body.role,
@@ -273,14 +276,17 @@ pub(crate) async fn list_tenants(
 /// Create a tenant
 ///
 /// Explicitly create a tenant (owner-only), rather than relying on first login.
-/// Fails with a conflict if a tenant with the same name and provider exists.
+/// The tenant is keyed to the platform's configured OIDC issuer (statically set
+/// at deploy time, e.g. via Helm), so that logins from that issuer resolve into
+/// it; the issuer is not caller-settable. Fails with a conflict if a tenant with
+/// the same name already exists for that issuer.
 #[utoipa::path(
     context_path = "/v0",
     security(("JSON web token (JWT) or API key" = [])),
     request_body = NewTenantRequest,
     responses(
         (status = CREATED, description = "Tenant created", body = NewTenantResponse),
-        (status = CONFLICT, description = "A tenant with that name and provider already exists", body = ErrorResponse),
+        (status = CONFLICT, description = "A tenant with that name already exists", body = ErrorResponse),
     ),
     tag = "Platform"
 )]
@@ -288,16 +294,27 @@ pub(crate) async fn list_tenants(
 pub(crate) async fn create_tenant(
     state: WebData<ServerState>,
     body: web::Json<NewTenantRequest>,
+    req: HttpRequest,
 ) -> Result<HttpResponse, ManagerError> {
     let body = body.into_inner();
-    let provider = body.provider.unwrap_or_else(|| "manual".to_string());
+    // The provider keys the tenant to the platform's configured issuer, so a
+    // login from that issuer resolves into it. It mirrors the token `iss` used
+    // at login (see `OidcClaim::provider`) and is deliberately not caller-set;
+    // `manual` only when auth is disabled (owner routes are then unreachable).
+    let provider = req
+        .app_data::<crate::auth::AuthConfiguration>()
+        .map(|c| c.provider.issuer().to_string())
+        .unwrap_or_else(|| "manual".to_string());
     let id = state
         .db
         .lock()
         .await
         .create_tenant(Uuid::now_v7(), &body.name, &provider)
         .await?;
-    info!("Created tenant '{}' ({id})", body.name);
+    info!(
+        "Created tenant '{}' ({id}, provider: {provider})",
+        body.name
+    );
     Ok(HttpResponse::Created()
         .insert_header(CacheControl(vec![CacheDirective::NoCache]))
         .json(&NewTenantResponse {
diff --git a/crates/pipeline-manager/src/auth.rs b/crates/pipeline-manager/src/auth.rs
index 9e677c40dc0..638519c750b 100644
--- a/crates/pipeline-manager/src/auth.rs
+++ b/crates/pipeline-manager/src/auth.rs
@@ -394,22 +394,34 @@ async fn oidc_trust_auth(
     let label = format!("oidc:{}", token_data.claims.sub);
     let db_err =
         |e: DBError, req: ServiceRequest| Err((crate::error::ManagerError::from(e).into(), req));
+    let header_tenant = |req: &ServiceRequest| {
+        req.headers()
+            .get(TENANT_HEADER)
+            .and_then(|h| h.to_str().ok())
+            .filter(|s| !s.is_empty())
+            .map(str::to_string)
+    };
 
-    // An owner trust is platform-wide: it wins over any tenant-scoped match, and
-    // the Feldera-Tenant header may select ANY existing tenant (default: the
-    // owner trust's own tenant).
-    if let Some((owner_home, _)) = matches.iter().find(|(_, r)| *r == Role::Owner).copied() {
-        let acting = {
+    // An owner trust is platform-wide with no tenant of its own, so the acting
+    // tenant must be named explicitly. It wins over any tenant-scoped match.
+    if matches
+        .iter()
+        .any(|(t, r)| t.is_none() && *r == Role::Owner)
+    {
+        let Some(selector) = header_tenant(&req) else {
+            return db_err(DBError::OwnerTrustNeedsTenant, req);
+        };
+        let resolved = {
             let db = state.db.lock().await;
-            resolve_owner_acting_tenant(&db, req.headers(), owner_home).await
+            db.resolve_tenant_selector(&selector).await
         };
-        let acting_tenant = match acting {
+        let acting = match resolved {
             Ok(t) => t,
-            Err(e) => return Err((e, req)),
+            Err(e) => return db_err(e, req),
         };
         AuthenticatedPrincipal {
-            acting_tenant,
-            home_tenant: owner_home,
+            acting_tenant: acting,
+            home_tenant: acting,
             role: Role::Owner,
             label,
         }
@@ -417,22 +429,21 @@ async fn oidc_trust_auth(
         return Ok(req);
     }
 
-    // Tenant-scoped trust: one match is unambiguous; several require the
-    // Feldera-Tenant header to name one of the matched tenants (fail closed).
-    let (home_tenant, role) = if matches.len() == 1 {
-        matches[0]
+    // Tenant-scoped matches (each carries a tenant). One is unambiguous; several
+    // require the Feldera-Tenant header to name one of them (fail closed).
+    let tenant_matches: Vec<(TenantId, Role)> = matches
+        .into_iter()
+        .filter_map(|(t, r)| t.map(|t| (t, r)))
+        .collect();
+    let (home_tenant, role) = if tenant_matches.len() == 1 {
+        tenant_matches[0]
     } else {
-        let selector = req
-            .headers()
-            .get(TENANT_HEADER)
-            .and_then(|h| h.to_str().ok())
-            .filter(|s| !s.is_empty());
-        let Some(selector) = selector else {
+        let Some(selector) = header_tenant(&req) else {
             return db_err(DBError::AmbiguousOidcTenant, req);
         };
         let selected = {
             let db = state.db.lock().await;
-            db.resolve_tenant_selector(selector).await
+            db.resolve_tenant_selector(&selector).await
         };
         // Unknown tenant name/UUID surfaces as 404; a known tenant the token is
         // not trusted in is 403.
@@ -440,16 +451,9 @@ async fn oidc_trust_auth(
             Ok(t) => t,
             Err(e) => return db_err(e, req),
         };
-        match matches.iter().find(|(t, _)| *t == selected).copied() {
+        match tenant_matches.iter().find(|(t, _)| *t == selected).copied() {
             Some(pair) => pair,
-            None => {
-                return db_err(
-                    DBError::OidcTenantNotTrusted {
-                        tenant: selector.to_string(),
-                    },
-                    req,
-                )
-            }
+            None => return db_err(DBError::OidcTenantNotTrusted { tenant: selector }, req),
         }
     };
     AuthenticatedPrincipal {
diff --git a/crates/pipeline-manager/src/db/error.rs b/crates/pipeline-manager/src/db/error.rs
index 5bc30c83992..12578303d31 100644
--- a/crates/pipeline-manager/src/db/error.rs
+++ b/crates/pipeline-manager/src/db/error.rs
@@ -159,6 +159,7 @@ pub enum DBError {
         field: String,
     },
     AmbiguousOidcTenant,
+    OwnerTrustNeedsTenant,
     OidcTenantNotTrusted {
         tenant: String,
     },
@@ -668,6 +669,13 @@ impl Display for DBError {
                      set the Feldera-Tenant header to select one"
                 )
             }
+            DBError::OwnerTrustNeedsTenant => {
+                write!(
+                    f,
+                    "Owner trust is platform-wide; set the Feldera-Tenant header \
+                     to choose the tenant to act in"
+                )
+            }
             DBError::OidcTenantNotTrusted { tenant } => {
                 write!(f, "Token is not trusted in tenant '{tenant}'")
             }
@@ -981,6 +989,7 @@ impl DetailedError for DBError {
             Self::UnknownOidcTrust { .. } => Cow::from("UnknownOidcTrust"),
             Self::EmptyOidcTrustField { .. } => Cow::from("EmptyOidcTrustField"),
             Self::AmbiguousOidcTenant => Cow::from("AmbiguousOidcTenant"),
+            Self::OwnerTrustNeedsTenant => Cow::from("OwnerTrustNeedsTenant"),
             Self::OidcTenantNotTrusted { .. } => Cow::from("OidcTenantNotTrusted"),
             Self::InvalidOidcToken { .. } => Cow::from("InvalidOidcToken"),
             Self::UnauthorizedOidcToken => Cow::from("UnauthorizedOidcToken"),
@@ -1107,6 +1116,7 @@ impl ResponseError for DBError {
             Self::UnknownOidcTrust { .. } => StatusCode::NOT_FOUND,
             Self::EmptyOidcTrustField { .. } => StatusCode::BAD_REQUEST,
             Self::AmbiguousOidcTenant => StatusCode::BAD_REQUEST,
+            Self::OwnerTrustNeedsTenant => StatusCode::BAD_REQUEST,
             Self::OidcTenantNotTrusted { .. } => StatusCode::FORBIDDEN,
             Self::InvalidOidcToken { .. } => StatusCode::UNAUTHORIZED,
             Self::UnauthorizedOidcToken => StatusCode::UNAUTHORIZED,
diff --git a/crates/pipeline-manager/src/db/operations/oidc_trust.rs b/crates/pipeline-manager/src/db/operations/oidc_trust.rs
index 2ef86386db8..54ca199bde7 100644
--- a/crates/pipeline-manager/src/db/operations/oidc_trust.rs
+++ b/crates/pipeline-manager/src/db/operations/oidc_trust.rs
@@ -35,32 +35,52 @@ fn row_to_descr(row: &tokio_postgres::Row) -> Result<OidcTrustDescr, DBError> {
     })
 }
 
+// `tenant_id` scopes the query: `Some(t)` selects that tenant's trusts;
+// `None` selects the platform-wide owner trusts (rows with NULL tenant_id).
 pub async fn list_oidc_trust(
     txn: &Transaction<'_>,
-    tenant_id: TenantId,
+    tenant_id: Option<TenantId>,
 ) -> Result<Vec<OidcTrustDescr>, DBError> {
-    let stmt = txn
-        .prepare_cached(
-            "SELECT id, name, description, issuer, subject, audience, role \
-             FROM oidc_trust_relationship WHERE tenant_id = $1",
-        )
-        .await?;
-    let rows = txn.query(&stmt, &[&tenant_id.0]).await?;
+    const COLS: &str =
+        "SELECT id, name, description, issuer, subject, audience, role FROM oidc_trust_relationship";
+    let rows = match tenant_id {
+        Some(t) => {
+            let stmt = txn
+                .prepare_cached(&format!("{COLS} WHERE tenant_id = $1"))
+                .await?;
+            txn.query(&stmt, &[&t.0]).await?
+        }
+        None => {
+            let stmt = txn
+                .prepare_cached(&format!("{COLS} WHERE tenant_id IS NULL"))
+                .await?;
+            txn.query(&stmt, &[]).await?
+        }
+    };
     rows.iter().map(row_to_descr).collect()
 }
 
 pub async fn get_oidc_trust(
     txn: &Transaction<'_>,
-    tenant_id: TenantId,
+    tenant_id: Option<TenantId>,
     name: &str,
 ) -> Result<OidcTrustDescr, DBError> {
-    let stmt = txn
-        .prepare_cached(
-            "SELECT id, name, description, issuer, subject, audience, role \
-             FROM oidc_trust_relationship WHERE tenant_id = $1 AND name = $2",
-        )
-        .await?;
-    let maybe_row = txn.query_opt(&stmt, &[&tenant_id.0, &name]).await?;
+    const COLS: &str =
+        "SELECT id, name, description, issuer, subject, audience, role FROM oidc_trust_relationship";
+    let maybe_row = match tenant_id {
+        Some(t) => {
+            let stmt = txn
+                .prepare_cached(&format!("{COLS} WHERE tenant_id = $1 AND name = $2"))
+                .await?;
+            txn.query_opt(&stmt, &[&t.0, &name]).await?
+        }
+        None => {
+            let stmt = txn
+                .prepare_cached(&format!("{COLS} WHERE tenant_id IS NULL AND name = $1"))
+                .await?;
+            txn.query_opt(&stmt, &[&name]).await?
+        }
+    };
     match maybe_row {
         Some(row) => row_to_descr(&row),
         None => Err(DBError::UnknownOidcTrust {
@@ -71,13 +91,27 @@ pub async fn get_oidc_trust(
 
 pub async fn delete_oidc_trust(
     txn: &Transaction<'_>,
-    tenant_id: TenantId,
+    tenant_id: Option<TenantId>,
     name: &str,
 ) -> Result<(), DBError> {
-    let stmt = txn
-        .prepare_cached("DELETE FROM oidc_trust_relationship WHERE tenant_id = $1 AND name = $2")
-        .await?;
-    let res = txn.execute(&stmt, &[&tenant_id.0, &name]).await?;
+    let res = match tenant_id {
+        Some(t) => {
+            let stmt = txn
+                .prepare_cached(
+                    "DELETE FROM oidc_trust_relationship WHERE tenant_id = $1 AND name = $2",
+                )
+                .await?;
+            txn.execute(&stmt, &[&t.0, &name]).await?
+        }
+        None => {
+            let stmt = txn
+                .prepare_cached(
+                    "DELETE FROM oidc_trust_relationship WHERE tenant_id IS NULL AND name = $1",
+                )
+                .await?;
+            txn.execute(&stmt, &[&name]).await?
+        }
+    };
     if res > 0 {
         Ok(())
     } else {
@@ -87,10 +121,13 @@ pub async fn delete_oidc_trust(
     }
 }
 
+// `tenant_id` is `None` for a platform-wide owner trust and `Some` for a
+// tenant-scoped one; the caller pairs it with the role (owner iff None), which
+// the `oidc_trust_owner_is_platform` CHECK also enforces.
 #[allow(clippy::too_many_arguments)]
 pub async fn create_oidc_trust(
     txn: &Transaction<'_>,
-    tenant_id: TenantId,
+    tenant_id: Option<TenantId>,
     id: Uuid,
     name: &str,
     description: Option<&str>,
@@ -122,7 +159,7 @@ pub async fn create_oidc_trust(
             &stmt,
             &[
                 &id,
-                &tenant_id.0,
+                &tenant_id.map(|t| t.0),
                 &name,
                 &description,
                 &issuer,
@@ -132,8 +169,13 @@ pub async fn create_oidc_trust(
             ],
         )
         .await
-        .map_err(maybe_unique_violation)
-        .map_err(|e| maybe_tenant_id_foreign_key_constraint_err(e, tenant_id))?;
+        .map_err(maybe_unique_violation);
+    // The FK only exists for a concrete tenant; owner trusts (NULL) cannot
+    // violate it.
+    let res = match tenant_id {
+        Some(t) => res.map_err(|e| maybe_tenant_id_foreign_key_constraint_err(e, t))?,
+        None => res?,
+    };
     if res > 0 {
         Ok(())
     } else {
@@ -157,19 +199,20 @@ pub async fn is_trusted_issuer(txn: &Transaction<'_>, issuer: &str) -> Result<bo
 
 /// Resolve a federated token to the tenant and role it is authorized for.
 ///
-/// All tenants that trust this token, one entry each with the most permissive
-/// matching role in that tenant. A trust is a candidate when it is registered
-/// for `issuer`, its subject pattern matches `subject`, and, if it sets an
-/// audience pattern, that pattern matches one of `audiences` (the audience is a
-/// security filter, not the tenant key). When the result spans several tenants
-/// the caller disambiguates with the `Feldera-Tenant` header. Sorted by tenant
-/// for a deterministic order.
+/// Every trust matching this token, one entry per scope with the most
+/// permissive matching role. A trust is a candidate when it is registered for
+/// `issuer`, its subject pattern matches `subject`, and, if it sets an audience
+/// pattern, that pattern matches one of `audiences` (the audience is a security
+/// filter, not the tenant key). The scope is the trust's `tenant_id`: `Some`
+/// for a tenant-scoped trust, `None` for a platform-wide owner trust. When the
+/// result spans several scopes the caller disambiguates with the
+/// `Feldera-Tenant` header. Sorted (owner scope first) for a deterministic order.
 pub async fn match_oidc_trust(
     txn: &Transaction<'_>,
     issuer: &str,
     subject: &str,
     audiences: &[String],
-) -> Result<Vec<(TenantId, Role)>, DBError> {
+) -> Result<Vec<(Option<TenantId>, Role)>, DBError> {
     let stmt = txn
         .prepare_cached(
             "SELECT tenant_id, subject, audience, role \
@@ -177,9 +220,9 @@ pub async fn match_oidc_trust(
         )
         .await?;
     let rows = txn.query(&stmt, &[&issuer]).await?;
-    let mut matched: Vec<(TenantId, Role)> = Vec::new();
+    let mut matched: Vec<(Option<TenantId>, Role)> = Vec::new();
     for row in rows {
-        let tenant_id = TenantId(row.get(0));
+        let tenant_id = row.get::<_, Option<Uuid>>(0).map(TenantId);
         let pattern_subject: String = row.get(1);
         let pattern_audience: Option<String> = row.get(2);
         let role = parse_role(&row.get::<_, String>(3))?;
@@ -197,6 +240,6 @@ pub async fn match_oidc_trust(
             None => matched.push((tenant_id, role)),
         }
     }
-    matched.sort_by_key(|(t, _)| t.0);
+    matched.sort_by_key(|(t, _)| t.map(|x| x.0));
     Ok(matched)
 }
diff --git a/crates/pipeline-manager/src/db/storage.rs b/crates/pipeline-manager/src/db/storage.rs
index 136ce6d21cc..c0590029431 100644
--- a/crates/pipeline-manager/src/db/storage.rs
+++ b/crates/pipeline-manager/src/db/storage.rs
@@ -190,24 +190,33 @@ pub(crate) trait Storage {
     /// against the stored value.
     async fn validate_api_key(&self, key: &str) -> Result<(TenantId, Role), DBError>;
 
-    /// Lists all OIDC trust relationships for the tenant.
-    async fn list_oidc_trust(&self, tenant_id: TenantId) -> Result<Vec<OidcTrustDescr>, DBError>;
+    /// Lists OIDC trust relationships in a scope: `Some(tenant)` for that
+    /// tenant's trusts, `None` for the platform-wide owner trusts.
+    async fn list_oidc_trust(
+        &self,
+        tenant_id: Option<TenantId>,
+    ) -> Result<Vec<OidcTrustDescr>, DBError>;
 
-    /// Retrieves a trust relationship by name.
+    /// Retrieves a trust relationship by name within a scope (see `list_oidc_trust`).
     async fn get_oidc_trust(
         &self,
-        tenant_id: TenantId,
+        tenant_id: Option<TenantId>,
         name: &str,
     ) -> Result<OidcTrustDescr, DBError>;
 
-    /// Deletes a trust relationship by name.
-    async fn delete_oidc_trust(&self, tenant_id: TenantId, name: &str) -> Result<(), DBError>;
+    /// Deletes a trust relationship by name within a scope (see `list_oidc_trust`).
+    async fn delete_oidc_trust(
+        &self,
+        tenant_id: Option<TenantId>,
+        name: &str,
+    ) -> Result<(), DBError>;
 
-    /// Persists a new trust relationship.
+    /// Persists a new trust relationship. `tenant_id` is `None` for a
+    /// platform-wide owner trust, `Some` for a tenant-scoped one.
     #[allow(clippy::too_many_arguments)]
     async fn create_oidc_trust(
         &self,
-        tenant_id: TenantId,
+        tenant_id: Option<TenantId>,
         id: Uuid,
         name: &str,
         description: Option<&str>,
@@ -231,7 +240,7 @@ pub(crate) trait Storage {
         issuer: &str,
         subject: &str,
         audiences: &[String],
-    ) -> Result<Vec<(TenantId, Role)>, DBError>;
+    ) -> Result<Vec<(Option<TenantId>, Role)>, DBError>;
 
     /// Retrieves a list of pipelines as extended descriptors.
     async fn list_pipelines(
diff --git a/crates/pipeline-manager/src/db/storage_postgres.rs b/crates/pipeline-manager/src/db/storage_postgres.rs
index 2ebe0e6a42b..c73176d97cd 100644
--- a/crates/pipeline-manager/src/db/storage_postgres.rs
+++ b/crates/pipeline-manager/src/db/storage_postgres.rs
@@ -291,7 +291,10 @@ impl Storage for StoragePostgres {
         Ok(result)
     }
 
-    async fn list_oidc_trust(&self, tenant_id: TenantId) -> Result<Vec<OidcTrustDescr>, DBError> {
+    async fn list_oidc_trust(
+        &self,
+        tenant_id: Option<TenantId>,
+    ) -> Result<Vec<OidcTrustDescr>, DBError> {
         let mut client = self.pool.get().await?;
         let txn = client.transaction().await?;
         let result = operations::oidc_trust::list_oidc_trust(&txn, tenant_id).await?;
@@ -301,7 +304,7 @@ impl Storage for StoragePostgres {
 
     async fn get_oidc_trust(
         &self,
-        tenant_id: TenantId,
+        tenant_id: Option<TenantId>,
         name: &str,
     ) -> Result<OidcTrustDescr, DBError> {
         let mut client = self.pool.get().await?;
@@ -311,7 +314,11 @@ impl Storage for StoragePostgres {
         Ok(result)
     }
 
-    async fn delete_oidc_trust(&self, tenant_id: TenantId, name: &str) -> Result<(), DBError> {
+    async fn delete_oidc_trust(
+        &self,
+        tenant_id: Option<TenantId>,
+        name: &str,
+    ) -> Result<(), DBError> {
         let mut client = self.pool.get().await?;
         let txn = client.transaction().await?;
         let result = operations::oidc_trust::delete_oidc_trust(&txn, tenant_id, name).await?;
@@ -321,7 +328,7 @@ impl Storage for StoragePostgres {
 
     async fn create_oidc_trust(
         &self,
-        tenant_id: TenantId,
+        tenant_id: Option<TenantId>,
         id: Uuid,
         name: &str,
         description: Option<&str>,
@@ -361,7 +368,7 @@ impl Storage for StoragePostgres {
         issuer: &str,
         subject: &str,
         audiences: &[String],
-    ) -> Result<Vec<(TenantId, Role)>, DBError> {
+    ) -> Result<Vec<(Option<TenantId>, Role)>, DBError> {
         let mut client = self.pool.get().await?;
         let txn = client.transaction().await?;
         let result =
diff --git a/crates/pipeline-manager/src/db/test.rs b/crates/pipeline-manager/src/db/test.rs
index 1ef695310f2..0c6f76cba1b 100644
--- a/crates/pipeline-manager/src/db/test.rs
+++ b/crates/pipeline-manager/src/db/test.rs
@@ -923,7 +923,7 @@ async fn oidc_trust_matching_and_issuer_gate() {
     handle
         .db
         .create_oidc_trust(
-            tenant_a,
+            Some(tenant_a),
             Uuid::now_v7(),
             "ta",
             None,
@@ -937,7 +937,7 @@ async fn oidc_trust_matching_and_issuer_gate() {
     handle
         .db
         .create_oidc_trust(
-            tenant_b,
+            Some(tenant_b),
             Uuid::now_v7(),
             "tb",
             None,
@@ -956,7 +956,7 @@ async fn oidc_trust_matching_and_issuer_gate() {
             .match_oidc_trust(iss, sub, &["a".to_string()])
             .await
             .unwrap(),
-        vec![(tenant_a, Role::Write)]
+        vec![(Some(tenant_a), Role::Write)]
     );
     assert_eq!(
         handle
@@ -964,7 +964,7 @@ async fn oidc_trust_matching_and_issuer_gate() {
             .match_oidc_trust(iss, sub, &["b".to_string()])
             .await
             .unwrap(),
-        vec![(tenant_b, Role::Write)]
+        vec![(Some(tenant_b), Role::Write)]
     );
     // A token whose audience matches neither trust does not resolve.
     assert!(handle
@@ -982,7 +982,7 @@ async fn oidc_trust_matching_and_issuer_gate() {
     handle
         .db
         .create_oidc_trust(
-            tenant_c,
+            Some(tenant_c),
             Uuid::now_v7(),
             "tc",
             None,
@@ -998,10 +998,66 @@ async fn oidc_trust_matching_and_issuer_gate() {
         .match_oidc_trust(iss, sub, &["a".to_string()])
         .await
         .unwrap();
-    got.sort_by_key(|(t, _)| t.0);
-    let mut want = vec![(tenant_a, Role::Write), (tenant_c, Role::Read)];
-    want.sort_by_key(|(t, _)| t.0);
+    got.sort_by_key(|(t, _)| t.map(|x| x.0));
+    let mut want = vec![(Some(tenant_a), Role::Write), (Some(tenant_c), Role::Read)];
+    want.sort_by_key(|(t, _)| t.map(|x| x.0));
     assert_eq!(got, want);
+
+    // An owner trust is platform-wide: it has NULL tenant and matches with scope
+    // None. The `oidc_trust_owner_is_platform` CHECK ties the two together, so a
+    // tenant-scoped owner trust and a tenant-less non-owner trust are both
+    // rejected.
+    let owner_iss = "https://owner.example";
+    handle
+        .db
+        .create_oidc_trust(
+            None,
+            Uuid::now_v7(),
+            "plat",
+            None,
+            owner_iss,
+            "root",
+            None,
+            Role::Owner,
+        )
+        .await
+        .unwrap();
+    assert_eq!(
+        handle
+            .db
+            .match_oidc_trust(owner_iss, "root", &[])
+            .await
+            .unwrap(),
+        vec![(None, Role::Owner)]
+    );
+    assert!(handle
+        .db
+        .create_oidc_trust(
+            Some(tenant_a),
+            Uuid::now_v7(),
+            "bad1",
+            None,
+            owner_iss,
+            "x",
+            None,
+            Role::Owner
+        )
+        .await
+        .is_err());
+    assert!(handle
+        .db
+        .create_oidc_trust(
+            None,
+            Uuid::now_v7(),
+            "bad2",
+            None,
+            owner_iss,
+            "y",
+            None,
+            Role::Read
+        )
+        .await
+        .is_err());
 }
 
 /// Pre-provisioning: an admin grants a role by identity before first login; the
@@ -5067,14 +5123,14 @@ impl Storage for Mutex<DbModel> {
     // OIDC trust relationships are not exercised by the proptest model.
     async fn list_oidc_trust(
         &self,
-        _tenant_id: TenantId,
+        _tenant_id: Option<TenantId>,
     ) -> DBResult<Vec<crate::db::types::oidc_trust::OidcTrustDescr>> {
         Ok(vec![])
     }
 
     async fn get_oidc_trust(
         &self,
-        _tenant_id: TenantId,
+        _tenant_id: Option<TenantId>,
         name: &str,
     ) -> DBResult<crate::db::types::oidc_trust::OidcTrustDescr> {
         Err(DBError::UnknownOidcTrust {
@@ -5082,7 +5138,7 @@ impl Storage for Mutex<DbModel> {
         })
     }
 
-    async fn delete_oidc_trust(&self, _tenant_id: TenantId, name: &str) -> DBResult<()> {
+    async fn delete_oidc_trust(&self, _tenant_id: Option<TenantId>, name: &str) -> DBResult<()> {
         Err(DBError::UnknownOidcTrust {
             name: name.to_string(),
         })
@@ -5090,7 +5146,7 @@ impl Storage for Mutex<DbModel> {
 
     async fn create_oidc_trust(
         &self,
-        _tenant_id: TenantId,
+        _tenant_id: Option<TenantId>,
         _id: Uuid,
         _name: &str,
         _description: Option<&str>,
@@ -5111,7 +5167,7 @@ impl Storage for Mutex<DbModel> {
         _issuer: &str,
         _subject: &str,
         _audiences: &[String],
-    ) -> DBResult<Vec<(TenantId, Role)>> {
+    ) -> DBResult<Vec<(Option<TenantId>, Role)>> {
         Ok(vec![])
     }
 
diff --git a/openapi.json b/openapi.json
index a2394b9841f..3f2d688be81 100644
--- a/openapi.json
+++ b/openapi.json
@@ -553,6 +553,17 @@
         ],
         "summary": "List OIDC trust relationships",
         "operationId": "list_oidc_trust",
+        "parameters": [
+          {
+            "name": "platform",
+            "in": "query",
+            "description": "Operate on platform-wide owner trusts (which belong to no tenant) instead\nof the caller's tenant. Owner-only.",
+            "required": false,
+            "schema": {
+              "type": "boolean"
+            }
+          }
+        ],
         "responses": {
           "200": {
             "description": "Trust relationships retrieved",
@@ -655,6 +666,15 @@
             "schema": {
               "type": "string"
             }
+          },
+          {
+            "name": "platform",
+            "in": "query",
+            "description": "Operate on platform-wide owner trusts (which belong to no tenant) instead\nof the caller's tenant. Owner-only.",
+            "required": false,
+            "schema": {
+              "type": "boolean"
+            }
           }
         ],
         "responses": {
@@ -700,6 +720,15 @@
             "schema": {
               "type": "string"
             }
+          },
+          {
+            "name": "platform",
+            "in": "query",
+            "description": "Operate on platform-wide owner trusts (which belong to no tenant) instead\nof the caller's tenant. Owner-only.",
+            "required": false,
+            "schema": {
+              "type": "boolean"
+            }
           }
         ],
         "responses": {
@@ -7497,7 +7526,7 @@
           "Platform"
         ],
         "summary": "Create a tenant",
-        "description": "Explicitly create a tenant (owner-only), rather than relying on first login.\nFails with a conflict if a tenant with the same name and provider exists.",
+        "description": "Explicitly create a tenant (owner-only), rather than relying on first login.\nThe tenant is keyed to the platform's configured OIDC issuer (statically set\nat deploy time, e.g. via Helm), so that logins from that issuer resolve into\nit; the issuer is not caller-settable. Fails with a conflict if a tenant with\nthe same name already exists for that issuer.",
         "operationId": "create_tenant",
         "requestBody": {
           "content": {
@@ -7521,7 +7550,7 @@
             }
           },
           "409": {
-            "description": "A tenant with that name and provider already exists",
+            "description": "A tenant with that name already exists",
             "content": {
               "application/json": {
                 "schema": {
@@ -7647,7 +7676,6 @@
         "type": "object",
         "description": "Request to pre-provision a tenant member by identity, before the user's\nfirst login.",
         "required": [
-          "provider",
           "subject",
           "role"
         ],
@@ -7657,17 +7685,12 @@
             "description": "Optional email for display in the member list.",
             "nullable": true
           },
-          "provider": {
-            "type": "string",
-            "description": "OIDC issuer the user authenticates through (matches the JWT `iss` claim).",
-            "example": "https://accounts.google.com"
-          },
           "role": {
             "$ref": "#/components/schemas/Role"
           },
           "subject": {
             "type": "string",
-            "description": "OIDC subject (matches the JWT `sub` claim).",
+            "description": "OIDC subject (matches the JWT `sub` claim). The issuer is not settable:\nmembers authenticate through the platform's single configured issuer, so\nthe grant is keyed to that issuer automatically.",
             "example": "user@acme.com"
           }
         }
@@ -11403,11 +11426,6 @@
           "name": {
             "type": "string",
             "example": "acme"
-          },
-          "provider": {
-            "type": "string",
-            "description": "Identity provider the tenant is keyed under. Defaults to `manual` for\ntenants created out of band by an owner.",
-            "nullable": true
           }
         }
       },

From 271b8b10b43510282c0cd9c8f531795e6a27e415 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Thu, 23 Jul 2026 16:16:43 -0700
Subject: [PATCH 07/55] [web-console] Admin OIDC/tenant UX: owner-vs-tenant
 trust, read-only issuer

- Admin page manages only platform-wide owner trusts (fetched with the platform
  scope); per-tenant trusts stay in the tenant-scoped 'Manage OIDC trust' menu.
- Tenant switcher pre-selects the active tenant by name; sections are labeled
  with the tenant they apply to.
- Tenant-create and pre-provision-member forms show the configured OIDC issuer
  read-only (set at deploy time, not caller-settable).
- Hide 'Manage API keys' for read-only members (every api_keys route needs
  write), and note that removing a member is not durable if the IdP still grants
  access.
- Regenerated client + wrappers for the platform scope and the dropped provider
  fields.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 .../src/lib/components/admin/AdminPage.svelte | 177 ++++++++----------
 .../lib/components/admin/TenantList.svelte    |  41 +++-
 .../lib/components/admin/UserRoleTable.svelte |  40 ++--
 .../components/apiKey/NewApiKeyForm.svelte    |   2 +-
 .../lib/components/auth/ProfileButton.svelte  |  11 +-
 .../lib/components/other/OidcTrustMenu.svelte |   8 +-
 .../src/lib/services/manager/sdk.gen.ts       |   5 +-
 .../src/lib/services/manager/types.gen.ts     |  39 ++--
 .../src/lib/services/pipelineManager.ts       |  41 +++-
 9 files changed, 209 insertions(+), 155 deletions(-)

diff --git a/js-packages/web-console/src/lib/components/admin/AdminPage.svelte b/js-packages/web-console/src/lib/components/admin/AdminPage.svelte
index 5f98c1e52fd..69d2fa41136 100644
--- a/js-packages/web-console/src/lib/components/admin/AdminPage.svelte
+++ b/js-packages/web-console/src/lib/components/admin/AdminPage.svelte
@@ -20,28 +20,23 @@
   const globalDialog = useGlobalDialog()
   let errorMessage = $state('')
 
-  // Owner-only per-tenant view: pick a tenant (by UUID) to inspect and manage
-  // its members and trusts in place, without changing the global acting-tenant.
-  // Empty string means the owner's own (globally selected) tenant.
-  let adminTenant = $state('')
+  // Owner-only: pick a tenant (by UUID) to inspect its members in place, without
+  // changing the global acting-tenant. Empty string means the current tenant.
+  let adminTenant = $state(page.data.feldera?.tenantId ?? '')
   const selectedTenant = $derived(adminTenant || undefined)
   const tenants = asyncReadable<Tenant[]>([], getTenants, { reloadable: true })
   const tenantLabel = $derived(
-    adminTenant ? ($tenants.find((t) => t.id === adminTenant)?.name ?? adminTenant) : 'current tenant'
+    $tenants.find((t) => t.id === adminTenant)?.name ??
+      page.data.feldera?.tenantName ??
+      'current tenant'
   )
 
-  // Trusts for the selected tenant, split by grant scope: `owner` is a
-  // platform-wide grant managed in its own section; read/write/admin are
-  // tenant-scoped.
-  const trusts = asyncReadable<OidcTrustDescr[]>([], () => getOidcTrustList(selectedTenant), {
+  // Owner (platform-wide) trusts belong to no tenant, so they are fetched with
+  // the platform scope and are independent of the tenant switcher. Per-tenant
+  // trusts are managed from the "Manage OIDC trust" menu, not here.
+  const ownerTrusts = asyncReadable<OidcTrustDescr[]>([], () => getOidcTrustList(undefined, true), {
     reloadable: true
   })
-  const ownerTrusts = $derived($trusts.filter((t) => t.role === 'owner'))
-  const tenantTrusts = $derived($trusts.filter((t) => t.role !== 'owner'))
-  $effect(() => {
-    selectedTenant
-    trusts.reload?.()
-  })
 </script>
 
 {#snippet section(title: string, description: string, body: Snippet)}
@@ -54,80 +49,27 @@
   </section>
 {/snippet}
 
-{#snippet trustList(list: OidcTrustDescr[])}
-  <div class="scrollbar flex max-h-[40vh] flex-col gap-2 overflow-auto">
-    {#each list as trust (trust.id)}
-      {#snippet deleteTrustDialog()}
-        <GenericDialog
-          content={{
-            title: `Delete trust '${trust.name}'?`,
-            description: 'Tokens matching this trust immediately lose access. This cannot be undone.',
-            onSuccess: {
-              name: 'Delete',
-              callback: async () => {
-                try {
-                  await deleteOidcTrust(trust.name, selectedTenant)
-                  trusts.reload?.()
-                } catch (e) {
-                  errorMessage = e instanceof Error ? e.message : String(e)
-                }
-                globalDialog.dialog = null
-              }
-            },
-            onCancel: {
-              callback: () => {
-                globalDialog.dialog = null
-              }
-            }
-          }}
-          noclose
-          danger
-        ></GenericDialog>
-      {/snippet}
-      <div class="flex flex-nowrap items-center gap-2 border-b border-surface-100-900 py-2">
-        <div class="w-full">
-          <div>
-            {trust.name}
-            <span class="text-xs opacity-70">[{trust.role}]</span>
-          </div>
-          <div class="text-sm opacity-70">
-            <code>{trust.issuer}</code> · sub=<code>{trust.subject}</code>{#if trust.audience}
-              · aud=<code>{trust.audience}</code>{/if}
-          </div>
-          {#if trust.description}
-            <div class="text-xs opacity-70">{trust.description}</div>
-          {/if}
-        </div>
-        <button
-          class="fd fd-trash-2 btn-icon text-[20px]"
-          aria-label="Delete {trust.name} trust relationship"
-          onclick={() => (globalDialog.dialog = deleteTrustDialog)}
-        ></button>
-      </div>
-    {:else}
-      <div class="opacity-70">None configured</div>
-    {/each}
-  </div>
-{/snippet}
-
 <div class="mx-auto flex w-full max-w-4xl flex-col gap-6 px-2 pb-10 md:px-8">
   <h1 class="h2">Administration</h1>
 
+  {#if errorMessage}
+    <div class="rounded preset-outlined-error-600-400 p-2 text-sm">{errorMessage}</div>
+  {/if}
+
   {#if isOwner}
-    <!-- Owner-only tenant switcher. Prominent so it is not mistaken for a minor
-         control: everything below (users, trusts) reflects the chosen tenant. -->
+    <!-- Owner-only tenant switcher for the members view below. Prominent so it
+         is not mistaken for a minor control. -->
     <div
       class="flex flex-wrap items-center gap-3 rounded-container preset-outlined-primary-500 p-3 md:p-4"
     >
-      <span class="fd fd-building text-[24px]"></span>
+      <span class="fd fd-users text-[24px]"></span>
       <div class="flex flex-col">
-        <span class="text-xs font-semibold uppercase tracking-wide opacity-70">
-          Viewing &amp; managing tenant
+        <span class="text-xs font-semibold tracking-wide uppercase opacity-70">
+          View members of tenant
         </span>
-        <span class="text-sm opacity-70">Everything below applies to this tenant.</span>
+        <span class="text-sm opacity-70">The users list below reflects this tenant.</span>
       </div>
       <Select class="ml-auto w-64" bind:value={adminTenant}>
-        <option value="">Current tenant</option>
         {#each $tenants as t (t.id)}
           <option value={t.id}>{t.name}</option>
         {/each}
@@ -135,43 +77,74 @@
     </div>
   {/if}
 
-  {#if errorMessage}
-    <div class="rounded preset-outlined-error-600-400 p-2 text-sm">{errorMessage}</div>
-  {/if}
-
   {#snippet usersBody()}
     <UserRoleTable tenant={selectedTenant}></UserRoleTable>
   {/snippet}
   {@render section(
     `Users & roles — ${tenantLabel}`,
-    'Members of this tenant and their roles.',
+    'Members of this tenant and their roles. To manage this tenant’s OIDC trust relationships, use the "Manage OIDC trust" menu.',
     usersBody
   )}
 
-  {#snippet tenantTrustBody()}
-    {@render trustList(tenantTrusts)}
-    <NewOidcTrustForm allowOwner={false} tenant={selectedTenant} onSuccess={() => trusts.reload?.()}
-    ></NewOidcTrustForm>
-  {/snippet}
-  {@render section(
-    `Tenant OIDC trust — ${tenantLabel}`,
-    'Grant read/write/admin to workloads (CI, services) in this tenant by trusting JWTs from an issuer.',
-    tenantTrustBody
-  )}
-
   {#if isOwner}
     {#snippet ownerTrustBody()}
-      {@render trustList(ownerTrusts)}
-      <NewOidcTrustForm
-        fixedRole="owner"
-        allowOwner={true}
-        tenant={selectedTenant}
-        onSuccess={() => trusts.reload?.()}
+      <div class="scrollbar flex max-h-[40vh] flex-col gap-2 overflow-auto">
+        {#each $ownerTrusts as trust (trust.id)}
+          {#snippet deleteTrustDialog()}
+            <GenericDialog
+              content={{
+                title: `Delete owner trust '${trust.name}'?`,
+                description:
+                  'Tokens matching this trust immediately lose platform-wide owner access. This cannot be undone.',
+                onSuccess: {
+                  name: 'Delete',
+                  callback: async () => {
+                    try {
+                      await deleteOidcTrust(trust.name, undefined, true)
+                      ownerTrusts.reload?.()
+                    } catch (e) {
+                      errorMessage = e instanceof Error ? e.message : String(e)
+                    }
+                    globalDialog.dialog = null
+                  }
+                },
+                onCancel: {
+                  callback: () => {
+                    globalDialog.dialog = null
+                  }
+                }
+              }}
+              noclose
+              danger
+            ></GenericDialog>
+          {/snippet}
+          <div class="flex flex-nowrap items-center gap-2 border-b border-surface-100-900 py-2">
+            <div class="w-full">
+              <div>{trust.name}</div>
+              <div class="text-sm opacity-70">
+                <code>{trust.issuer}</code> · sub=<code>{trust.subject}</code>{#if trust.audience}
+                  · aud=<code>{trust.audience}</code>{/if}
+              </div>
+              {#if trust.description}
+                <div class="text-xs opacity-70">{trust.description}</div>
+              {/if}
+            </div>
+            <button
+              class="fd fd-trash-2 btn-icon text-[20px]"
+              aria-label="Delete {trust.name} owner trust"
+              onclick={() => (globalDialog.dialog = deleteTrustDialog)}
+            ></button>
+          </div>
+        {:else}
+          <div class="opacity-70">No owner trust relationships configured</div>
+        {/each}
+      </div>
+      <NewOidcTrustForm fixedRole="owner" allowOwner={true} onSuccess={() => ownerTrusts.reload?.()}
       ></NewOidcTrustForm>
     {/snippet}
     {@render section(
-      'Owner access (platform-wide)',
-      'Owner trusts grant full platform access across all tenants. Only owners manage these, and only here.',
+      'Owner access (platform-wide OIDC trust)',
+      'Owner trusts grant full platform access across all tenants and belong to no single tenant. This is the only place to manage them; a matching workload selects the tenant it acts in with the Feldera-Tenant header.',
       ownerTrustBody
     )}
 
diff --git a/js-packages/web-console/src/lib/components/admin/TenantList.svelte b/js-packages/web-console/src/lib/components/admin/TenantList.svelte
index 2f441a5b33a..4b65cb6b802 100644
--- a/js-packages/web-console/src/lib/components/admin/TenantList.svelte
+++ b/js-packages/web-console/src/lib/components/admin/TenantList.svelte
@@ -5,18 +5,34 @@
   import { clearConfigCaches } from '$lib/compositions/configCache'
   import { resolve } from '$lib/functions/svelte'
   import { setSelectedTenant } from '$lib/services/auth'
-  import { createTenant, getTenants, type Tenant } from '$lib/services/pipelineManager'
+  import {
+    createTenant,
+    getAuthConfig,
+    getTenants,
+    type Tenant
+  } from '$lib/services/pipelineManager'
 
   const tenants = asyncReadable<Tenant[]>([], getTenants, { reloadable: true })
 
+  // A new tenant is keyed to the platform's configured OIDC issuer (set at
+  // deploy time, e.g. via Helm), so logins from that issuer resolve into it.
+  // The issuer is not settable here; show it read-only.
+  const authConfig = asyncReadable<Record<string, { issuer?: string }> | undefined>(
+    undefined,
+    getAuthConfig
+  )
+  const configuredIssuer = $derived(
+    $authConfig?.GenericOidc?.issuer ??
+      $authConfig?.AwsCognito?.issuer ??
+      '(configured at deploy time)'
+  )
+
   // Compare/select by tenant id (UUID). Names are unique only per provider, so
-  // an owner-created ('manual') tenant and an OIDC-issuer tenant can share a
-  // name; the id is globally unique and the backend's Feldera-Tenant resolver
-  // accepts it unambiguously.
+  // the id is globally unique and the backend's Feldera-Tenant resolver accepts
+  // it unambiguously.
   const currentTenantId = $derived(page.data.feldera?.tenantId)
 
   let newName = $state('')
-  let newProvider = $state('')
   let creating = $state(false)
   let errorMessage = $state('')
 
@@ -28,9 +44,8 @@
     errorMessage = ''
     creating = true
     try {
-      await createTenant(newName.trim(), newProvider.trim() || undefined)
+      await createTenant(newName.trim())
       newName = ''
-      newProvider = ''
       tenants.reload?.()
     } catch (e) {
       errorMessage = e instanceof Error ? e.message : String(e)
@@ -92,9 +107,15 @@
       <span>New tenant name</span>
       <input class="input w-full" placeholder="acme-prod" bind:value={newName} />
     </label>
-    <label class="label w-48">
-      <span>Provider (optional)</span>
-      <input class="input w-full" placeholder="GenericOidc" bind:value={newProvider} />
+    <label class="label w-72">
+      <span>OIDC issuer</span>
+      <input
+        class="input w-full opacity-60"
+        value={configuredIssuer}
+        readonly
+        disabled
+        title="Statically configured at deploy time (Helm: FELDERA_AUTH_ISSUER). Tenants are keyed to this issuer so logins from it resolve into them; it cannot be changed here."
+      />
     </label>
     <button class="btn preset-filled-surface-50-950" disabled={creating}>Create</button>
   </form>
diff --git a/js-packages/web-console/src/lib/components/admin/UserRoleTable.svelte b/js-packages/web-console/src/lib/components/admin/UserRoleTable.svelte
index f4baaef5855..bb9aaa9d10b 100644
--- a/js-packages/web-console/src/lib/components/admin/UserRoleTable.svelte
+++ b/js-packages/web-console/src/lib/components/admin/UserRoleTable.svelte
@@ -5,6 +5,7 @@
   import { useGlobalDialog } from '$lib/compositions/layout/useGlobalDialog.svelte'
   import {
     addTenantUser,
+    getAuthConfig,
     getTenantUsers,
     removeTenantUser,
     setTenantUserRole,
@@ -15,6 +16,18 @@
   // the admin page's per-tenant picker, without changing the global selection.
   const { tenant }: { tenant?: string } = $props()
 
+  // Members authenticate through the platform's single configured OIDC issuer,
+  // so a pre-provisioned grant is always keyed to that issuer (shown read-only).
+  const authConfig = asyncReadable<Record<string, { issuer?: string }> | undefined>(
+    undefined,
+    getAuthConfig
+  )
+  const configuredIssuer = $derived(
+    $authConfig?.GenericOidc?.issuer ??
+      $authConfig?.AwsCognito?.issuer ??
+      '(configured at deploy time)'
+  )
+
   const users = asyncReadable<TenantUser[]>([], () => getTenantUsers(tenant), { reloadable: true })
   // Reload when the selected tenant changes.
   $effect(() => {
@@ -30,7 +43,6 @@
   let errorMessage = $state('')
 
   // Pre-provision (add-member) form state.
-  let newProvider = $state('')
   let newSubject = $state('')
   let newEmail = $state('')
   let newRole = $state<'read' | 'write' | 'admin'>('read')
@@ -50,14 +62,12 @@
     try {
       await addTenantUser(
         {
-          provider: newProvider.trim(),
           subject: newSubject.trim(),
           email: newEmail.trim() || undefined,
           role: newRole
         },
         tenant
       )
-      newProvider = ''
       newSubject = ''
       newEmail = ''
       newRole = 'read'
@@ -90,8 +100,10 @@
 
 <div class="flex flex-col gap-3">
   <p class="text-sm opacity-70">
-    Members appear here after their first login. Assign read, write, or admin; remove a member to
-    revoke access. Pre-provision a member below to grant a role before their first login.
+    Members appear here after their first login. Assign read, write, or admin. Removing a member
+    drops their role now, but if your identity provider still grants them access they are re-added
+    at the default role on their next login — revoke at the provider for a durable block.
+    Pre-provision a member below to grant a role before their first login.
   </p>
   {#if errorMessage}
     <div class="rounded preset-outlined-error-600-400 p-2 text-sm">{errorMessage}</div>
@@ -103,9 +115,9 @@
     <div class="mb-2">
       <div class="font-medium">Pre-provision a member</div>
       <p class="text-sm opacity-70">
-        Grant a role before the user's first login. <b>Provider</b> and <b>Subject</b> must exactly
-        match the <code>iss</code> and <code>sub</code> claims of the JWT the user will present (from
-        your identity provider) — otherwise the grant will not attach at login. Email is for display only.
+        Grant a role before the user's first login. <b>Subject</b> must exactly match the
+        <code>sub</code> claim of the JWT the user will present — otherwise the grant will not attach
+        at login. The issuer is the platform's configured one (shown below). Email is for display only.
       </p>
     </div>
     <form
@@ -118,9 +130,11 @@
       <label class="flex flex-col text-sm">
         <span class="opacity-70">Provider — OIDC issuer (<code>iss</code>)</span>
         <input
-          class="input w-64"
-          bind:value={newProvider}
-          placeholder="https://accounts.google.com"
+          class="input w-64 opacity-60"
+          value={configuredIssuer}
+          readonly
+          disabled
+          title="Statically configured at deploy time (Helm: FELDERA_AUTH_ISSUER). Members authenticate through this issuer; it cannot be changed here."
         />
       </label>
       <label class="flex flex-col text-sm">
@@ -146,7 +160,7 @@
       <button
         type="submit"
         class="btn preset-filled-primary-500"
-        disabled={adding || !newProvider.trim() || !newSubject.trim()}
+        disabled={adding || !newSubject.trim()}
       >
         Add member
       </button>
@@ -159,7 +173,7 @@
           content={{
             title: `Remove ${user.email ?? user.subject}?`,
             description:
-              'They lose their role in this tenant until re-added or they log in again. Continue?',
+              'Drops their role in this tenant now. If your identity provider still grants them access, they are re-added at the default role on their next login; revoke at the provider for a durable block. Continue?',
             onSuccess: {
               name: 'Remove',
               callback: async () => {
diff --git a/js-packages/web-console/src/lib/components/apiKey/NewApiKeyForm.svelte b/js-packages/web-console/src/lib/components/apiKey/NewApiKeyForm.svelte
index 8efe16852f4..55dcee39e7f 100644
--- a/js-packages/web-console/src/lib/components/apiKey/NewApiKeyForm.svelte
+++ b/js-packages/web-console/src/lib/components/apiKey/NewApiKeyForm.svelte
@@ -4,9 +4,9 @@
   import { setError, superForm } from 'sveltekit-superforms'
   import { valibot } from 'sveltekit-superforms/adapters'
   import * as va from 'valibot'
+  import { page } from '$app/state'
   import ClipboardCopyButton from '$lib/components/other/ClipboardCopyButton.svelte'
   import { usePipelineManager } from '$lib/compositions/usePipelineManager.svelte'
-  import { page } from '$app/state'
 
   const { onSubmit, onSuccess }: { onSubmit?: () => void; onSuccess?: () => void } = $props()
 
diff --git a/js-packages/web-console/src/lib/components/auth/ProfileButton.svelte b/js-packages/web-console/src/lib/components/auth/ProfileButton.svelte
index cce84e764d7..c49e4dddfeb 100644
--- a/js-packages/web-console/src/lib/components/auth/ProfileButton.svelte
+++ b/js-packages/web-console/src/lib/components/auth/ProfileButton.svelte
@@ -21,6 +21,9 @@
   const auth = page.data.auth as AuthDetails | undefined
   const role = $derived(page.data.feldera?.role)
   const canAdminister = $derived(role === 'admin' || role === 'owner')
+  // Every /v0/api_keys route requires at least `write`, so a read-only caller
+  // cannot even list keys; hide the menu for them entirely.
+  const canManageApiKeys = $derived(role === 'write' || role === 'admin' || role === 'owner')
 
   const globalDialog = useGlobalDialog()
 
@@ -91,9 +94,11 @@
           {#if canAdminister}
             {@render profileItemButton('Admin', adminIcon, { href: resolve('/admin') })}
           {/if}
-          {@render profileItemButton('Manage API keys', apiKeysIcon, {
-            onclick: () => (globalDialog.dialog = apiKeyDialog)
-          })}
+          {#if canManageApiKeys}
+            {@render profileItemButton('Manage API keys', apiKeysIcon, {
+              onclick: () => (globalDialog.dialog = apiKeyDialog)
+            })}
+          {/if}
           <!-- OIDC trust management is admin-only (the endpoints require admin),
                so only surface it when the caller can actually use it. -->
           {#if canAdminister}
diff --git a/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte b/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte
index 0724d2aaf7d..ab2e12bb6a3 100644
--- a/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte
+++ b/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
   import { asyncReadable } from '@square/svelte-store'
+  import { page } from '$app/state'
   import GenericDialog from '$lib/components/dialogs/GenericDialog.svelte'
   import NewOidcTrustForm from '$lib/components/oidcTrust/NewOidcTrustForm.svelte'
   import { useGlobalDialog } from '$lib/compositions/layout/useGlobalDialog.svelte'
@@ -9,13 +10,18 @@
     type OidcTrustDescr
   } from '$lib/services/pipelineManager'
 
+  const tenantName = $derived(page.data.feldera?.tenantName ?? 'current tenant')
   const trusts = asyncReadable<OidcTrustDescr[]>([], getOidcTrustList, { reloadable: true })
 
   const globalDialog = useGlobalDialog()
   const thisDialog = globalDialog.dialog
 </script>
 
-<GenericDialog content={{ title: 'Manage OIDC trust relationships' }}>
+<GenericDialog content={{ title: `Manage OIDC trust — ${tenantName}` }}>
+  <p class="text-sm opacity-70">
+    Grant read/write/admin to workloads (CI, services) in tenant <b>{tenantName}</b> by trusting JWTs
+    from an issuer. Platform-wide owner trusts are managed on the Admin page.
+  </p>
   <div class="scrollbar flex max-h-[80vh] flex-col gap-2 overflow-auto">
     {#each $trusts as trust}
       {#snippet deleteDialog()}
diff --git a/js-packages/web-console/src/lib/services/manager/sdk.gen.ts b/js-packages/web-console/src/lib/services/manager/sdk.gen.ts
index 69887d111b9..78e9b72f222 100644
--- a/js-packages/web-console/src/lib/services/manager/sdk.gen.ts
+++ b/js-packages/web-console/src/lib/services/manager/sdk.gen.ts
@@ -1847,7 +1847,10 @@ export const listTenants = <ThrowOnError extends boolean = true>(
  * Create a tenant
  *
  * Explicitly create a tenant (owner-only), rather than relying on first login.
- * Fails with a conflict if a tenant with the same name and provider exists.
+ * The tenant is keyed to the platform's configured OIDC issuer (statically set
+ * at deploy time, e.g. via Helm), so that logins from that issuer resolve into
+ * it; the issuer is not caller-settable. Fails with a conflict if a tenant with
+ * the same name already exists for that issuer.
  */
 export const createTenant = <ThrowOnError extends boolean = true>(
   options: Options<CreateTenantData, ThrowOnError>
diff --git a/js-packages/web-console/src/lib/services/manager/types.gen.ts b/js-packages/web-console/src/lib/services/manager/types.gen.ts
index 3c2df7adb79..234da582ae9 100644
--- a/js-packages/web-console/src/lib/services/manager/types.gen.ts
+++ b/js-packages/web-console/src/lib/services/manager/types.gen.ts
@@ -32,13 +32,11 @@ export type AddMemberRequest = {
    * Optional email for display in the member list.
    */
   email?: string | null
-  /**
-   * OIDC issuer the user authenticates through (matches the JWT `iss` claim).
-   */
-  provider: string
   role: Role
   /**
-   * OIDC subject (matches the JWT `sub` claim).
+   * OIDC subject (matches the JWT `sub` claim). The issuer is not settable:
+   * members authenticate through the platform's single configured issuer, so
+   * the grant is keyed to that issuer automatically.
    */
   subject: string
 }
@@ -3237,11 +3235,6 @@ export type NewOidcTrustResponse = {
  */
 export type NewTenantRequest = {
   name: string
-  /**
-   * Identity provider the tenant is keyed under. Defaults to `manual` for
-   * tenants created out of band by an owner.
-   */
-  provider?: string | null
 }
 
 /**
@@ -6345,7 +6338,13 @@ export type GetMetricsResponse = GetMetricsResponses[keyof GetMetricsResponses]
 export type ListOidcTrustData = {
   body?: never
   path?: never
-  query?: never
+  query?: {
+    /**
+     * Operate on platform-wide owner trusts (which belong to no tenant) instead
+     * of the caller's tenant. Owner-only.
+     */
+    platform?: boolean
+  }
   url: '/v0/oidc_trust'
 }
 
@@ -6401,7 +6400,13 @@ export type DeleteOidcTrustData = {
      */
     name: string
   }
-  query?: never
+  query?: {
+    /**
+     * Operate on platform-wide owner trusts (which belong to no tenant) instead
+     * of the caller's tenant. Owner-only.
+     */
+    platform?: boolean
+  }
   url: '/v0/oidc_trust/{name}'
 }
 
@@ -6429,7 +6434,13 @@ export type GetOidcTrustData = {
      */
     name: string
   }
-  query?: never
+  query?: {
+    /**
+     * Operate on platform-wide owner trusts (which belong to no tenant) instead
+     * of the caller's tenant. Owner-only.
+     */
+    platform?: boolean
+  }
   url: '/v0/oidc_trust/{name}'
 }
 
@@ -8479,7 +8490,7 @@ export type CreateTenantData = {
 
 export type CreateTenantErrors = {
   /**
-   * A tenant with that name and provider already exists
+   * A tenant with that name already exists
    */
   409: ErrorResponse
 }
diff --git a/js-packages/web-console/src/lib/services/pipelineManager.ts b/js-packages/web-console/src/lib/services/pipelineManager.ts
index a5adfdf8cf3..ae33fd6f55c 100644
--- a/js-packages/web-console/src/lib/services/pipelineManager.ts
+++ b/js-packages/web-console/src/lib/services/pipelineManager.ts
@@ -639,14 +639,34 @@ export type Tenant = TenantInfo
 // changing the global acting-tenant selection. Omit it to use the current tenant.
 const tenantHdr = (tenant?: string) => (tenant ? { headers: { 'Feldera-Tenant': tenant } } : {})
 
-export const getOidcTrustList = (tenant?: string, options?: FetchOptions) =>
-  mapResponse(_listOidcTrust({ ...tenantHdr(tenant), ...options }), (v) => v ?? [])
+// `platform: true` targets the platform-wide owner trusts (which belong to no
+// tenant, and only an owner may manage) instead of a tenant's trusts.
+const platformQuery = (platform?: boolean) => (platform ? { query: { platform: true } } : {})
+
+export const getOidcTrustList = (tenant?: string, platform?: boolean, options?: FetchOptions) =>
+  mapResponse(
+    _listOidcTrust({ ...tenantHdr(tenant), ...platformQuery(platform), ...options }),
+    (v) => v ?? []
+  )
 
 export const postOidcTrust = (body: NewOidcTrustRequest, tenant?: string, options?: FetchOptions) =>
   mapResponse(_postOidcTrust({ body, ...tenantHdr(tenant), ...options }), (v) => v)
 
-export const deleteOidcTrust = (name: string, tenant?: string, options?: FetchOptions) =>
-  mapResponse(_deleteOidcTrust({ path: { name }, ...tenantHdr(tenant), ...options }), (v) => v)
+export const deleteOidcTrust = (
+  name: string,
+  tenant?: string,
+  platform?: boolean,
+  options?: FetchOptions
+) =>
+  mapResponse(
+    _deleteOidcTrust({
+      path: { name },
+      ...tenantHdr(tenant),
+      ...platformQuery(platform),
+      ...options
+    }),
+    (v) => v
+  )
 
 // Tenant users & roles (min role: admin).
 
@@ -655,8 +675,10 @@ export const getTenantUsers = (tenant?: string, options?: FetchOptions) =>
 
 // Pre-provision a member by identity, before their first login. The grant is
 // dormant until that identity authenticates into the tenant through the IdP.
+// The member's provider (OIDC issuer) is fixed to the platform's configured
+// issuer server-side; only the subject/email/role are caller-supplied.
 export const addTenantUser = (
-  body: { provider: string; subject: string; email?: string; role: 'read' | 'write' | 'admin' },
+  body: { subject: string; email?: string; role: 'read' | 'write' | 'admin' },
   tenant?: string,
   options?: FetchOptions
 ) => mapResponse(_addTenantUser({ body, ...tenantHdr(tenant), ...options }), (v) => v)
@@ -683,11 +705,10 @@ export const removeTenantUser = (userId: string, tenant?: string, options?: Fetc
 export const getTenants = (options?: FetchOptions) =>
   mapResponse(_listTenants({ ...options }), (v) => v ?? [])
 
-export const createTenant = (name: string, provider?: string, options?: FetchOptions) =>
-  mapResponse(
-    _createTenant({ body: { name, ...(provider ? { provider } : {}) }, ...options }),
-    (v) => v
-  )
+// The tenant's provider (OIDC issuer) is fixed to the platform's configured
+// issuer server-side; it is not caller-settable.
+export const createTenant = (name: string, options?: FetchOptions) =>
+  mapResponse(_createTenant({ body: { name }, ...options }), (v) => v)
 
 export const dismissDeploymentError = (pipeline_name: string) =>
   mapResponse(postPipelineDismissError({ path: { pipeline_name } }), (v) => v)

From b6f3ae698516451152b7e69139342b4bc1f6b022 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Fri, 24 Jul 2026 10:02:30 -0700
Subject: [PATCH 08/55] [pipeline-manager] RBAC API reference: per-route min
 role, tighter role schemas

Annotate every /v0 operation with its minimum RBAC role in the generated
OpenAPI, sourced from ROUTE_MIN_ROLE (the same table the middleware enforces)
via a MinRoleAddon modifier, so the reference cannot drift from the policy. A
test asserts every documented /v0 route carries the annotation.

Constrain the documented role enums to the values each endpoint accepts:
API-key roles to read/write (MintableKeyRole), tenant-member roles to
read/write/admin (MemberRole). Type the tenant user_id path parameter as a
UUID. Shorten operation summaries for the API menu and drop redundant
"owner-only" phrasing now carried by the min-role annotation.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 .../src/api/endpoints/api_key.rs              |   1 +
 .../src/api/endpoints/oidc_trust.rs           |  13 +-
 .../src/api/endpoints/tenant.rs               |  26 ++-
 crates/pipeline-manager/src/api/main.rs       |  47 ++++-
 crates/pipeline-manager/src/api/rbac.rs       |  52 +++++
 .../pipeline-manager/src/db/types/api_key.rs  |   4 +-
 crates/pipeline-manager/src/db/types/role.rs  |  22 +-
 openapi.json                                  | 193 ++++++++++--------
 8 files changed, 248 insertions(+), 110 deletions(-)

diff --git a/crates/pipeline-manager/src/api/endpoints/api_key.rs b/crates/pipeline-manager/src/api/endpoints/api_key.rs
index 3e5d278e895..dfb15ce8b2e 100644
--- a/crates/pipeline-manager/src/api/endpoints/api_key.rs
+++ b/crates/pipeline-manager/src/api/endpoints/api_key.rs
@@ -31,6 +31,7 @@ pub(crate) struct NewApiKeyRequest {
     /// caller's own role; `admin` and `owner` are never issuable as API keys.
     /// Defaults to `read`.
     #[serde(default)]
+    #[schema(value_type = Option<MintableKeyRole>)]
     role: Option<Role>,
 }
 
diff --git a/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs b/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
index 3830339fab6..039546484fc 100644
--- a/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
+++ b/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
@@ -29,8 +29,9 @@ use uuid::Uuid;
 /// Selects which trusts an operation targets.
 #[derive(Debug, Default, Deserialize, IntoParams)]
 pub(crate) struct TrustScope {
-    /// Operate on platform-wide owner trusts (which belong to no tenant) instead
-    /// of the caller's tenant. Owner-only.
+    /// Select platform-wide owner trusts (which belong to no tenant) instead of
+    /// the caller's tenant, rather than the trusts scoped to the caller's tenant.
+    /// Owner-only.
     #[serde(default)]
     platform: bool,
 }
@@ -98,7 +99,7 @@ pub(crate) struct NewOidcTrustResponse {
     pub name: String,
 }
 
-/// List OIDC trust relationships
+/// List OIDC Trust
 #[utoipa::path(
     context_path = "/v0",
     security(("JSON web token (JWT) or API key" = [])),
@@ -123,7 +124,7 @@ pub(crate) async fn list_oidc_trust(
         .json(&items))
 }
 
-/// Get OIDC trust relationship
+/// Get OIDC Trust
 #[utoipa::path(
     context_path = "/v0",
     security(("JSON web token (JWT) or API key" = [])),
@@ -150,7 +151,7 @@ pub(crate) async fn get_oidc_trust(
         .json(&item))
 }
 
-/// Create OIDC trust relationship
+/// Create OIDC Trust
 #[utoipa::path(
     context_path = "/v0",
     security(("JSON web token (JWT) or API key" = [])),
@@ -220,7 +221,7 @@ pub(crate) async fn post_oidc_trust(
         }))
 }
 
-/// Delete OIDC trust relationship
+/// Delete OIDC Trust
 #[utoipa::path(
     context_path = "/v0",
     security(("JSON web token (JWT) or API key" = [])),
diff --git a/crates/pipeline-manager/src/api/endpoints/tenant.rs b/crates/pipeline-manager/src/api/endpoints/tenant.rs
index 62cbfd9d9e4..51c46ed259d 100644
--- a/crates/pipeline-manager/src/api/endpoints/tenant.rs
+++ b/crates/pipeline-manager/src/api/endpoints/tenant.rs
@@ -10,7 +10,7 @@ use crate::api::util::parse_url_parameter;
 use crate::auth::AuthenticatedPrincipal;
 use crate::db::error::DBError;
 use crate::db::storage::Storage;
-use crate::db::types::role::Role;
+use crate::db::types::role::{MemberRole, Role};
 use crate::db::types::tenant::TenantId;
 use crate::db::types::user::UserId;
 use crate::error::ManagerError;
@@ -31,6 +31,7 @@ use uuid::Uuid;
 pub(crate) struct SetMemberRoleRequest {
     /// The role to assign. Must be `read`, `write`, or `admin`; capped at the
     /// caller's own role. `owner` is never assignable here.
+    #[schema(value_type = MemberRole)]
     pub role: Role,
 }
 
@@ -48,6 +49,7 @@ pub(crate) struct AddMemberRequest {
     pub email: Option<String>,
     /// Role to grant. Must be `read`, `write`, or `admin`; capped at the
     /// caller's own role. `owner` is never assignable here.
+    #[schema(value_type = MemberRole)]
     pub role: Role,
 }
 
@@ -90,7 +92,7 @@ fn parse_user_id(req: &HttpRequest) -> Result<UserId, ManagerError> {
     Ok(UserId(uuid))
 }
 
-/// List tenant members
+/// List Tenant Members
 ///
 /// List the users that are members of the acting tenant and their roles.
 #[utoipa::path(
@@ -118,14 +120,14 @@ pub(crate) async fn list_tenant_users(
         .json(&members))
 }
 
-/// Assign a member role
+/// Assign Member Role
 ///
 /// Assign or change a user's role in the acting tenant. The role is capped at
 /// the caller's own role and may not be `owner`.
 #[utoipa::path(
     context_path = "/v0",
     security(("JSON web token (JWT) or API key" = [])),
-    params(("user_id" = String, Path, description = "User identifier")),
+    params(("user_id" = Uuid, Path, description = "User identifier")),
     request_body = SetMemberRoleRequest,
     responses(
         (status = OK, description = "Role assigned"),
@@ -158,13 +160,15 @@ pub(crate) async fn put_tenant_user(
     Ok(HttpResponse::Ok().finish())
 }
 
-/// Remove a tenant member
+/// Remove Tenant Member
 ///
-/// Remove a user from the acting tenant.
+/// Remove a user from the acting tenant. This drops their role now, but if the
+/// identity provider still grants them access they are re-added at the default
+/// role on their next login; revoke access at the provider for a durable block.
 #[utoipa::path(
     context_path = "/v0",
     security(("JSON web token (JWT) or API key" = [])),
-    params(("user_id" = String, Path, description = "User identifier")),
+    params(("user_id" = Uuid, Path, description = "User identifier")),
     responses(
         (status = OK, description = "Member removed"),
         (status = NOT_FOUND, description = "User is not a member", body = ErrorResponse),
@@ -188,7 +192,7 @@ pub(crate) async fn delete_tenant_user(
     Ok(HttpResponse::Ok().finish())
 }
 
-/// Pre-provision a tenant member
+/// Provision Tenant Member
 ///
 /// Add a member to the acting tenant by identity, before the user's first
 /// login. The grant is dormant until that identity authenticates into the
@@ -253,7 +257,7 @@ pub(crate) struct NewTenantResponse {
 
 /// List tenants
 ///
-/// List all tenants in the installation. Owner-only platform view.
+/// List all tenants in the installation.
 #[utoipa::path(
     context_path = "/v0",
     security(("JSON web token (JWT) or API key" = [])),
@@ -273,9 +277,9 @@ pub(crate) async fn list_tenants(
         .json(&tenants))
 }
 
-/// Create a tenant
+/// Create Tenant
 ///
-/// Explicitly create a tenant (owner-only), rather than relying on first login.
+/// Explicitly create a tenant, rather than relying on first login.
 /// The tenant is keyed to the platform's configured OIDC issuer (statically set
 /// at deploy time, e.g. via Helm), so that logins from that issuer resolve into
 /// it; the issuer is not caller-settable. Fails with a conflict if a tenant with
diff --git a/crates/pipeline-manager/src/api/main.rs b/crates/pipeline-manager/src/api/main.rs
index f7c71329d35..2a153843ce1 100644
--- a/crates/pipeline-manager/src/api/main.rs
+++ b/crates/pipeline-manager/src/api/main.rs
@@ -52,7 +52,7 @@ macro_rules! log_with_level {
 
 #[derive(OpenApi)]
 #[openapi(
-    modifiers(&SecurityAddon),
+    modifiers(&SecurityAddon, &MinRoleAddon),
     info(
         title = "Feldera API",
         description = r#"
@@ -348,6 +348,8 @@ It contains the following fields:
 
         // RBAC
         crate::db::types::role::Role,
+        crate::db::types::role::MintableKeyRole,
+        crate::db::types::role::MemberRole,
         crate::db::types::user::UserId,
         crate::db::types::user::TenantMember,
         crate::db::types::user::TenantInfo,
@@ -797,6 +799,49 @@ impl Modify for SecurityAddon {
     }
 }
 
+/// Annotates each gated operation with its minimum RBAC role, sourced from
+/// `ROUTE_MIN_ROLE` (rbac.rs) so the API reference cannot drift from the enforced
+/// policy. The note is prepended to the operation description, which the docs
+/// site renders as markdown.
+struct MinRoleAddon;
+
+impl Modify for MinRoleAddon {
+    fn modify(&self, openapi: &mut utoipa::openapi::OpenApi) {
+        use utoipa::openapi::PathItemType;
+        for (path, item) in openapi.paths.paths.iter_mut() {
+            for (method, operation) in item.operations.iter_mut() {
+                let http = match method {
+                    PathItemType::Get => "GET",
+                    PathItemType::Post => "POST",
+                    PathItemType::Put => "PUT",
+                    PathItemType::Delete => "DELETE",
+                    PathItemType::Patch => "PATCH",
+                    _ => continue,
+                };
+                // Only gated routes appear in the table; leave anything else
+                // (public infra endpoints) untouched.
+                let Some(rule) = crate::api::rbac::min_role_for(http, path.as_str()) else {
+                    continue;
+                };
+                let note = match rule {
+                    // `owner` is the highest role, so "or higher" would be misleading.
+                    Some(role) if role == crate::db::types::role::Role::Owner => {
+                        "Required role: `owner`.".to_string()
+                    }
+                    Some(role) => format!("Required role: `{role}` or higher."),
+                    None => "Required role: any authenticated user.".to_string(),
+                };
+                operation.description = Some(match operation.description.take() {
+                    Some(existing) if !existing.trim().is_empty() => {
+                        format!("{note}\n\n{existing}")
+                    }
+                    _ => note,
+                });
+            }
+        }
+    }
+}
+
 // The below types and methods are used for running the api-server
 
 pub(crate) struct ServerState {
diff --git a/crates/pipeline-manager/src/api/rbac.rs b/crates/pipeline-manager/src/api/rbac.rs
index 86eb76fb1e1..750c0955c11 100644
--- a/crates/pipeline-manager/src/api/rbac.rs
+++ b/crates/pipeline-manager/src/api/rbac.rs
@@ -121,6 +121,14 @@ fn lookup(method: &str, pattern: &str) -> Option<Option<Role>> {
     route_table().get(&(method, pattern)).copied()
 }
 
+/// Minimum role required to reach `(method, path)`, for OpenAPI annotation.
+/// `None` => not a gated route; `Some(None)` => any authenticated principal;
+/// `Some(Some(role))` => requires at least `role`. Reads the same table the
+/// middleware enforces, so the API reference cannot drift from the policy.
+pub(crate) fn min_role_for(method: &str, path: &str) -> Option<Option<Role>> {
+    lookup(method, path)
+}
+
 /// Build the 403 body in the same shape as the rest of the API.
 fn forbidden(message: &str) -> HttpResponse<BoxBody> {
     HttpResponse::Forbidden().json(serde_json::json!({
@@ -507,4 +515,48 @@ mod test {
             stale.join("\n  ")
         );
     }
+
+    /// `MinRoleAddon` stamps every documented `/v0` operation with its minimum
+    /// role, so the API reference shows the policy. Removing the modifier from
+    /// `ApiDoc`'s `modifiers(...)` makes this fail.
+    #[test]
+    fn every_v0_operation_documents_its_min_role() {
+        use crate::api::main::ApiDoc;
+        use utoipa::openapi::PathItemType;
+        use utoipa::OpenApi;
+
+        let method = |t: &PathItemType| match t {
+            PathItemType::Get => "GET",
+            PathItemType::Post => "POST",
+            PathItemType::Put => "PUT",
+            PathItemType::Delete => "DELETE",
+            PathItemType::Patch => "PATCH",
+            PathItemType::Head => "HEAD",
+            PathItemType::Options => "OPTIONS",
+            PathItemType::Trace => "TRACE",
+            PathItemType::Connect => "CONNECT",
+        };
+        let doc = ApiDoc::openapi();
+        let mut missing = vec![];
+        for (path, item) in doc.paths.paths.iter() {
+            if !path.starts_with("/v0") {
+                continue;
+            }
+            for (t, operation) in item.operations.iter() {
+                let has_note = operation
+                    .description
+                    .as_deref()
+                    .is_some_and(|d| d.contains("Required role:"));
+                if !has_note {
+                    missing.push(format!("{} {path}", method(t)));
+                }
+            }
+        }
+        missing.sort();
+        assert!(
+            missing.is_empty(),
+            "these /v0 operations are missing the minimum-role annotation:\n  {}",
+            missing.join("\n  ")
+        );
+    }
 }
diff --git a/crates/pipeline-manager/src/db/types/api_key.rs b/crates/pipeline-manager/src/db/types/api_key.rs
index f3374d13a0f..6bdbca3c31f 100644
--- a/crates/pipeline-manager/src/db/types/api_key.rs
+++ b/crates/pipeline-manager/src/db/types/api_key.rs
@@ -1,4 +1,4 @@
-use crate::db::types::role::Role;
+use crate::db::types::role::{MintableKeyRole, Role};
 use serde::{Deserialize, Serialize};
 use std::fmt;
 use std::fmt::Display;
@@ -27,5 +27,7 @@ impl Display for ApiKeyId {
 pub struct ApiKeyDescr {
     pub id: ApiKeyId,
     pub name: String,
+    /// Always `read` or `write` (a key can never carry `admin`/`owner`).
+    #[schema(value_type = MintableKeyRole)]
     pub role: Role,
 }
diff --git a/crates/pipeline-manager/src/db/types/role.rs b/crates/pipeline-manager/src/db/types/role.rs
index 5e305c6a896..13106df5beb 100644
--- a/crates/pipeline-manager/src/db/types/role.rs
+++ b/crates/pipeline-manager/src/db/types/role.rs
@@ -76,18 +76,28 @@ impl fmt::Display for InvalidRole {
     }
 }
 
-/// The subset of roles that may be carried by a static API key. `admin` and
-/// `owner` are deliberately not representable here, so an over-privileged key
-/// cannot be constructed (a leaked static secret carrying admin/owner would be
-/// a standing liability; those roles come only from signature-verified
-/// principals: login JWTs and OIDC trust relationships).
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+/// The role an API key carries: `read` or `write`. API keys cannot be granted
+/// `admin` or `owner`; those roles are held only by interactive logins and OIDC
+/// trust relationships.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, ToSchema)]
 #[cfg_attr(test, derive(proptest_derive::Arbitrary))]
+#[serde(rename_all = "lowercase")]
 pub enum MintableKeyRole {
     Read,
     Write,
 }
 
+/// A role assignable to a tenant member: `read`, `write`, or `admin`. `owner`
+/// is a platform-wide role, not a tenant membership, so it is not a valid value
+/// here.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, ToSchema)]
+#[serde(rename_all = "lowercase")]
+pub enum MemberRole {
+    Read,
+    Write,
+    Admin,
+}
+
 impl MintableKeyRole {
     /// Narrow a `Role` to a key-mintable role, rejecting `admin`/`owner`.
     pub fn from_role(role: Role) -> Option<Self> {
diff --git a/openapi.json b/openapi.json
index 3f2d688be81..04467c2fce1 100644
--- a/openapi.json
+++ b/openapi.json
@@ -51,7 +51,7 @@
           "Platform"
         ],
         "summary": "List API Keys",
-        "description": "Retrieve a list of your API keys.",
+        "description": "Required role: `write` or higher.\n\nRetrieve a list of your API keys.",
         "operationId": "list_api_keys",
         "responses": {
           "200": {
@@ -89,7 +89,7 @@
           "Platform"
         ],
         "summary": "Create API Key",
-        "description": "Create a new API key with the specified name. The generated API key\nwill be returned in the response and cannot be retrieved again later.",
+        "description": "Required role: `write` or higher.\n\nCreate a new API key with the specified name. The generated API key\nwill be returned in the response and cannot be retrieved again later.",
         "operationId": "post_api_key",
         "requestBody": {
           "description": "",
@@ -142,7 +142,7 @@
           "Platform"
         ],
         "summary": "Get API Key",
-        "description": "Retrieve the metadata of a specific API key by its name.",
+        "description": "Required role: `write` or higher.\n\nRetrieve the metadata of a specific API key by its name.",
         "operationId": "get_api_key",
         "parameters": [
           {
@@ -198,7 +198,7 @@
           "Platform"
         ],
         "summary": "Delete API Key",
-        "description": "Remove an API key by its name.",
+        "description": "Required role: `write` or higher.\n\nRemove an API key by its name.",
         "operationId": "delete_api_key",
         "parameters": [
           {
@@ -246,7 +246,7 @@
           "Platform"
         ],
         "summary": "List Cluster Events",
-        "description": "Retrieve a list of retained cluster monitor events ordered from most recent to least recent.\n\nThe returned events only have limited details, the full details can be retrieved using\nthe `GET /v0/cluster/events/<event-id>` endpoint.\n\nCluster monitor events are collected at a periodic interval (every 10s), however only\nevery 10 minutes or if the overall health changes, does it get inserted into the database\n(and thus, served by this endpoint). At most 1000 events are retained (newest first),\nand events older than 72h are deleted. The latest event, if it already exists, is never\ncleaned up.",
+        "description": "Required role: `read` or higher.\n\nRetrieve a list of retained cluster monitor events ordered from most recent to least recent.\n\nThe returned events only have limited details, the full details can be retrieved using\nthe `GET /v0/cluster/events/<event-id>` endpoint.\n\nCluster monitor events are collected at a periodic interval (every 10s), however only\nevery 10 minutes or if the overall health changes, does it get inserted into the database\n(and thus, served by this endpoint). At most 1000 events are retained (newest first),\nand events older than 72h are deleted. The latest event, if it already exists, is never\ncleaned up.",
         "operationId": "list_cluster_events",
         "responses": {
           "200": {
@@ -296,7 +296,7 @@
           "Platform"
         ],
         "summary": "Get Cluster Event",
-        "description": "Get specific cluster monitor event.\n\nThe identifiers of the events can be retrieved via `GET /v0/cluster/events`.\nAt most 1000 events are retained (newest first), and events older than 72h are deleted.\nThe latest event, if it already exists, is never cleaned up.\nThis endpoint can return a 404 for an event that no longer exists due to clean-up.",
+        "description": "Required role: `read` or higher.\n\nGet specific cluster monitor event.\n\nThe identifiers of the events can be retrieved via `GET /v0/cluster/events`.\nAt most 1000 events are retained (newest first), and events older than 72h are deleted.\nThe latest event, if it already exists, is never cleaned up.\nThis endpoint can return a 404 for an event that no longer exists due to clean-up.",
         "operationId": "get_cluster_event",
         "parameters": [
           {
@@ -373,7 +373,7 @@
           "Platform"
         ],
         "summary": "Check Cluster Health",
-        "description": "Determine the latest cluster health via the latest cluster monitor event.",
+        "description": "Required role: `read` or higher.\n\nDetermine the latest cluster health via the latest cluster monitor event.",
         "operationId": "get_cluster_health",
         "responses": {
           "200": {
@@ -410,7 +410,7 @@
           "Platform"
         ],
         "summary": "Get Platform Config",
-        "description": "Retrieve configuration of the Feldera Platform.",
+        "description": "Required role: `read` or higher.\n\nRetrieve configuration of the Feldera Platform.",
         "operationId": "get_config",
         "responses": {
           "200": {
@@ -447,7 +447,7 @@
           "Platform"
         ],
         "summary": "List Demos",
-        "description": "Retrieve the list of demos available in the WebConsole.",
+        "description": "Required role: `read` or higher.\n\nRetrieve the list of demos available in the WebConsole.",
         "operationId": "get_config_demos",
         "responses": {
           "200": {
@@ -487,7 +487,7 @@
           "Platform"
         ],
         "summary": "Get Session",
-        "description": "Retrieve login session information for your current user session.",
+        "description": "Required role: `read` or higher.\n\nRetrieve login session information for your current user session.",
         "operationId": "get_config_session",
         "responses": {
           "200": {
@@ -524,7 +524,7 @@
           "Metrics & Debugging"
         ],
         "summary": "List All Metrics",
-        "description": "Retrieve the metrics of all running pipelines belonging to this tenant.\n\nThe metrics are collected by making individual HTTP requests to `/metrics`\nendpoint of each pipeline, of which only successful responses are included\nin the returned list.",
+        "description": "Required role: `read` or higher.\n\nRetrieve the metrics of all running pipelines belonging to this tenant.\n\nThe metrics are collected by making individual HTTP requests to `/metrics`\nendpoint of each pipeline, of which only successful responses are included\nin the returned list.",
         "operationId": "get_metrics",
         "responses": {
           "200": {
@@ -551,13 +551,14 @@
         "tags": [
           "Platform"
         ],
-        "summary": "List OIDC trust relationships",
+        "summary": "List OIDC Trust",
+        "description": "Required role: `admin` or higher.",
         "operationId": "list_oidc_trust",
         "parameters": [
           {
             "name": "platform",
             "in": "query",
-            "description": "Operate on platform-wide owner trusts (which belong to no tenant) instead\nof the caller's tenant. Owner-only.",
+            "description": "Select platform-wide owner trusts (which belong to no tenant) instead of\nthe caller's tenant, rather than the trusts scoped to the caller's tenant.\nOwner-only.",
             "required": false,
             "schema": {
               "type": "boolean"
@@ -599,7 +600,8 @@
         "tags": [
           "Platform"
         ],
-        "summary": "Create OIDC trust relationship",
+        "summary": "Create OIDC Trust",
+        "description": "Required role: `admin` or higher.",
         "operationId": "post_oidc_trust",
         "requestBody": {
           "content": {
@@ -655,7 +657,8 @@
         "tags": [
           "Platform"
         ],
-        "summary": "Get OIDC trust relationship",
+        "summary": "Get OIDC Trust",
+        "description": "Required role: `admin` or higher.",
         "operationId": "get_oidc_trust",
         "parameters": [
           {
@@ -670,7 +673,7 @@
           {
             "name": "platform",
             "in": "query",
-            "description": "Operate on platform-wide owner trusts (which belong to no tenant) instead\nof the caller's tenant. Owner-only.",
+            "description": "Select platform-wide owner trusts (which belong to no tenant) instead of\nthe caller's tenant, rather than the trusts scoped to the caller's tenant.\nOwner-only.",
             "required": false,
             "schema": {
               "type": "boolean"
@@ -709,7 +712,8 @@
         "tags": [
           "Platform"
         ],
-        "summary": "Delete OIDC trust relationship",
+        "summary": "Delete OIDC Trust",
+        "description": "Required role: `admin` or higher.",
         "operationId": "delete_oidc_trust",
         "parameters": [
           {
@@ -724,7 +728,7 @@
           {
             "name": "platform",
             "in": "query",
-            "description": "Operate on platform-wide owner trusts (which belong to no tenant) instead\nof the caller's tenant. Owner-only.",
+            "description": "Select platform-wide owner trusts (which belong to no tenant) instead of\nthe caller's tenant, rather than the trusts scoped to the caller's tenant.\nOwner-only.",
             "required": false,
             "schema": {
               "type": "boolean"
@@ -759,7 +763,7 @@
           "Pipeline CRUD"
         ],
         "summary": "List Pipelines",
-        "description": "Retrieve the list of pipelines.\nConfigure which fields are included using the `selector` query parameter.",
+        "description": "Required role: `read` or higher.\n\nRetrieve the list of pipelines.\nConfigure which fields are included using the `selector` query parameter.",
         "operationId": "list_pipelines",
         "parameters": [
           {
@@ -998,7 +1002,7 @@
           "Pipeline CRUD"
         ],
         "summary": "Create Pipeline",
-        "description": "Create a new pipeline with the provided configuration.",
+        "description": "Required role: `write` or higher.\n\nCreate a new pipeline with the provided configuration.",
         "operationId": "post_pipeline",
         "requestBody": {
           "content": {
@@ -1238,7 +1242,7 @@
           "Pipeline CRUD"
         ],
         "summary": "Get Pipeline",
-        "description": "Retrieve a pipeline.\nConfigure which fields are included using the `selector` query parameter.",
+        "description": "Required role: `read` or higher.\n\nRetrieve a pipeline.\nConfigure which fields are included using the `selector` query parameter.",
         "operationId": "get_pipeline",
         "parameters": [
           {
@@ -1404,7 +1408,7 @@
           "Pipeline CRUD"
         ],
         "summary": "Upsert Pipeline",
-        "description": "Fully update a pipeline if it already exists, otherwise create a new pipeline.",
+        "description": "Required role: `write` or higher.\n\nFully update a pipeline if it already exists, otherwise create a new pipeline.",
         "operationId": "put_pipeline",
         "parameters": [
           {
@@ -1764,7 +1768,7 @@
           "Pipeline CRUD"
         ],
         "summary": "Delete Pipeline",
-        "description": "Delete an existing pipeline by name.",
+        "description": "Required role: `write` or higher.\n\nDelete an existing pipeline by name.",
         "operationId": "delete_pipeline",
         "parameters": [
           {
@@ -1835,7 +1839,7 @@
           "Pipeline CRUD"
         ],
         "summary": "Patch Pipeline",
-        "description": "Partially update a pipeline.",
+        "description": "Required role: `write` or higher.\n\nPartially update a pipeline.",
         "operationId": "patch_pipeline",
         "parameters": [
           {
@@ -2058,7 +2062,7 @@
           "Pipeline Lifecycle"
         ],
         "summary": "Activate Standby Pipeline",
-        "description": "Requests the pipeline to activate if it is currently in standby mode, which it will do\nasynchronously.\n\nProgress should be monitored by polling the pipeline `GET` endpoints.\n\nThis endpoint is only applicable when the pipeline is configured to start\nfrom object store and started as standby.",
+        "description": "Required role: `write` or higher.\n\nRequests the pipeline to activate if it is currently in standby mode, which it will do\nasynchronously.\n\nProgress should be monitored by polling the pipeline `GET` endpoints.\n\nThis endpoint is only applicable when the pipeline is configured to start\nfrom object store and started as standby.",
         "operationId": "post_pipeline_activate",
         "parameters": [
           {
@@ -2187,7 +2191,7 @@
           "Pipeline Lifecycle"
         ],
         "summary": "Approve Bootstrap",
-        "description": "Approves the pipeline to proceed with bootstrapping.\n\nThis endpoint is used when a pipeline has been started with\n`bootstrap_policy=await_approval`, it is resuming from an existing checkpoint,\nbut the pipeline has been modified since the checkpoint was made and is\ncurrently in the `AwaitingApproval` state awaiting user approval to proceed\nwith bootstrapping.",
+        "description": "Required role: `write` or higher.\n\nApproves the pipeline to proceed with bootstrapping.\n\nThis endpoint is used when a pipeline has been started with\n`bootstrap_policy=await_approval`, it is resuming from an existing checkpoint,\nbut the pipeline has been modified since the checkpoint was made and is\ncurrently in the `AwaitingApproval` state awaiting user approval to proceed\nwith bootstrapping.",
         "operationId": "post_pipeline_approve",
         "parameters": [
           {
@@ -2336,7 +2340,7 @@
           "Pipeline Lifecycle"
         ],
         "summary": "Checkpoint Now",
-        "description": "Initiates checkpoint for a running or paused pipeline.\n\nReturns a checkpoint sequence number that can be used with `/checkpoint_status` to\ndetermine when the checkpoint has completed.",
+        "description": "Required role: `write` or higher.\n\nInitiates checkpoint for a running or paused pipeline.\n\nReturns a checkpoint sequence number that can be used with `/checkpoint_status` to\ndetermine when the checkpoint has completed.",
         "operationId": "checkpoint_pipeline",
         "parameters": [
           {
@@ -2457,7 +2461,7 @@
           "Pipeline Lifecycle"
         ],
         "summary": "Sync Checkpoints To S3",
-        "description": "Syncs latest checkpoints to the object store configured in pipeline config.",
+        "description": "Required role: `write` or higher.\n\nSyncs latest checkpoints to the object store configured in pipeline config.",
         "operationId": "sync_checkpoint",
         "parameters": [
           {
@@ -2578,7 +2582,7 @@
           "Pipeline Lifecycle"
         ],
         "summary": "Get Checkpoint Sync Status",
-        "description": "Retrieve status of checkpoint sync activity in a pipeline.",
+        "description": "Required role: `read` or higher.\n\nRetrieve status of checkpoint sync activity in a pipeline.",
         "operationId": "get_checkpoint_sync_status",
         "parameters": [
           {
@@ -2699,7 +2703,7 @@
           "Pipeline Lifecycle"
         ],
         "summary": "Get Checkpoint Status",
-        "description": "Retrieve status of checkpoint activity in a pipeline.",
+        "description": "Required role: `read` or higher.\n\nRetrieve status of checkpoint activity in a pipeline.",
         "operationId": "get_checkpoint_status",
         "parameters": [
           {
@@ -2820,7 +2824,7 @@
           "Pipeline Lifecycle"
         ],
         "summary": "Get the checkpoints for a pipeline",
-        "description": "Retrieve the current checkpoints made by a pipeline.\n\n**Stability note**: for multihost pipelines, this endpoint returns the\ncombined checkpoint list from all hosts.  The shape of this response may\nchange in a future release.",
+        "description": "Required role: `read` or higher.\n\nRetrieve the current checkpoints made by a pipeline.\n\n**Stability note**: for multihost pipelines, this endpoint returns the\ncombined checkpoint list from all hosts.  The shape of this response may\nchange in a future release.",
         "operationId": "get_checkpoints",
         "parameters": [
           {
@@ -2944,7 +2948,7 @@
           "Pipeline Lifecycle"
         ],
         "summary": "List checkpoints in remote object storage",
-        "description": "Retrieve the list of checkpoints available in the configured remote object\nstorage (e.g., S3).  Requires the pipeline to be running with a sync\nstorage configuration.",
+        "description": "Required role: `read` or higher.\n\nRetrieve the list of checkpoints available in the configured remote object\nstorage (e.g., S3).  Requires the pipeline to be running with a sync\nstorage configuration.",
         "operationId": "get_remote_checkpoints",
         "parameters": [
           {
@@ -3068,7 +3072,7 @@
           "Metrics & Debugging"
         ],
         "summary": "Performance Profile JSON",
-        "description": "Retrieve the circuit performance profile in JSON format of a running or paused pipeline.",
+        "description": "Required role: `read` or higher.\n\nRetrieve the circuit performance profile in JSON format of a running or paused pipeline.",
         "operationId": "get_pipeline_circuit_json_profile",
         "parameters": [
           {
@@ -3189,7 +3193,7 @@
           "Metrics & Debugging"
         ],
         "summary": "Get Performance Profile",
-        "description": "Retrieve the circuit performance profile of a running or paused pipeline.",
+        "description": "Required role: `read` or higher.\n\nRetrieve the circuit performance profile of a running or paused pipeline.",
         "operationId": "get_pipeline_circuit_profile",
         "parameters": [
           {
@@ -3310,7 +3314,7 @@
           "Pipeline Lifecycle"
         ],
         "summary": "Clear Storage",
-        "description": "Clears the pipeline storage asynchronously.\n\nIMPORTANT: Clearing means disassociating the storage from the pipeline.\nDepending on the storage type this can include its deletion.\n\nIt sets the storage state to `Clearing`, after which the clearing process is\nperformed asynchronously. Progress should be monitored by polling the pipeline\nusing the `GET` endpoints. An `/clear` cannot be cancelled.",
+        "description": "Required role: `write` or higher.\n\nClears the pipeline storage asynchronously.\n\nIMPORTANT: Clearing means disassociating the storage from the pipeline.\nDepending on the storage type this can include its deletion.\n\nIt sets the storage state to `Clearing`, after which the clearing process is\nperformed asynchronously. Progress should be monitored by polling the pipeline\nusing the `GET` endpoints. An `/clear` cannot be cancelled.",
         "operationId": "post_pipeline_clear",
         "parameters": [
           {
@@ -3390,7 +3394,7 @@
           "Metrics & Debugging"
         ],
         "summary": "Advance Clock",
-        "description": "Moves `NOW()` forward by a specified amount. Returns the\ncurrent clock time of the circuit.\n\nRequires `dev_tweaks.now_http_driven = true` on the pipeline.\n\nForward-only: `delta_ms` is `u64`, so negative bodies are rejected at\nJSON parse time.  `delta_ms = null` or omitted advances by one\n`clock_resolution`.  Non-zero values round up to the next\n`clock_resolution` boundary, so a sub-resolution delta still moves\nthe clock by one full tick.\n\nThe returned `now_ms` is the value the worker will emit on its next\npipeline step; queries against materialized views may observe the\nprevious `NOW()` until that step completes.  Callers that need\nread-after-write semantics should poll the view.",
+        "description": "Required role: `write` or higher.\n\nMoves `NOW()` forward by a specified amount. Returns the\ncurrent clock time of the circuit.\n\nRequires `dev_tweaks.now_http_driven = true` on the pipeline.\n\nForward-only: `delta_ms` is `u64`, so negative bodies are rejected at\nJSON parse time.  `delta_ms = null` or omitted advances by one\n`clock_resolution`.  Non-zero values round up to the next\n`clock_resolution` boundary, so a sub-resolution delta still moves\nthe clock by one full tick.\n\nThe returned `now_ms` is the value the worker will emit on its next\npipeline step; queries against materialized views may observe the\nprevious `NOW()` until that step completes.  Callers that need\nread-after-write semantics should poll the view.",
         "operationId": "clock_advance",
         "parameters": [
           {
@@ -3459,7 +3463,7 @@
           "Pipeline Lifecycle"
         ],
         "summary": "Commit Transaction",
-        "description": "Commit the current transaction.",
+        "description": "Required role: `write` or higher.\n\nCommit the current transaction.",
         "operationId": "commit_transaction",
         "parameters": [
           {
@@ -3566,7 +3570,7 @@
           "Input Connectors"
         ],
         "summary": "Check Completion Status",
-        "description": "Check the status of a completion token returned by the `/ingress` or `/completion_token`\nendpoint.",
+        "description": "Required role: `read` or higher.\n\nCheck the status of a completion token returned by the `/ingress` or `/completion_token`\nendpoint.",
         "operationId": "completion_status",
         "parameters": [
           {
@@ -3726,7 +3730,7 @@
           "Metrics & Debugging"
         ],
         "summary": "Get Dataflow Graph",
-        "description": "Retrieve the dataflow graph of a pipeline.\nThe dataflow graph is generated during SQL compilation and shows the structure\nof the compiled SQL program including the Calcite plan and MIR nodes.",
+        "description": "Required role: `read` or higher.\n\nRetrieve the dataflow graph of a pipeline.\nThe dataflow graph is generated during SQL compilation and shows the structure\nof the compiled SQL program including the Calcite plan and MIR nodes.",
         "operationId": "get_pipeline_dataflow_graph",
         "parameters": [
           {
@@ -3791,7 +3795,7 @@
           "Pipeline Lifecycle"
         ],
         "summary": "Compute Program Diff",
-        "description": "Compute the diff between the pipeline's current program and a proposed new\nversion, without modifying or restarting the pipeline.\n\nThe diff lists the tables, views, and connectors that would be added,\nremoved, or modified. It is the same diff shown when approving changes during\nbootstrapping, letting you preview the effect of a change before applying it.\n\nThe baseline is the pipeline's currently configured program compiled with its\nruntime, not necessarily the program in the latest checkpoint (which may have\nbeen produced by a different program or runtime version).",
+        "description": "Required role: `read` or higher.\n\nCompute the diff between the pipeline's current program and a proposed new\nversion, without modifying or restarting the pipeline.\n\nThe diff lists the tables, views, and connectors that would be added,\nremoved, or modified. It is the same diff shown when approving changes during\nbootstrapping, letting you preview the effect of a change before applying it.\n\nThe baseline is the pipeline's currently configured program compiled with its\nruntime, not necessarily the program in the latest checkpoint (which may have\nbeen produced by a different program or runtime version).",
         "operationId": "post_pipeline_diff",
         "parameters": [
           {
@@ -3890,7 +3894,7 @@
           "Pipeline Lifecycle"
         ],
         "summary": "Dismiss Pipeline Deployment Error",
-        "description": "Clears the `deployment_error` field of the pipeline, such that a subsequent call to\n`/start?dismiss_error=false` succeeds. It will return an error if the pipeline is not fully\nstopped (i.e., both current and desired status must be `Stopped`) AND a deployment error\nis present.",
+        "description": "Required role: `write` or higher.\n\nClears the `deployment_error` field of the pipeline, such that a subsequent call to\n`/start?dismiss_error=false` succeeds. It will return an error if the pipeline is not fully\nstopped (i.e., both current and desired status must be `Stopped`) AND a deployment error\nis present.",
         "operationId": "post_pipeline_dismiss_error",
         "parameters": [
           {
@@ -3958,7 +3962,7 @@
           "Output Connectors"
         ],
         "summary": "Subscribe to View",
-        "description": "Subscribe to a stream of updates from a SQL view or table.\n\nThe pipeline responds with a continuous stream of changes to the specified\ntable or view.  The stream is configurable two ways:\n\n- Simple configuration of the format may be provided using query parameters.\nSpecify `backpressure` to specify behavior when the HTTP client cannot\nkeep up.  Use `format` to specify `csv` or `json` output.  For `json`\noutput format, `update_format` and `json_flavor` may be provided (with the\nsame possible values as in JSON format configuration for connectors).\n\n- Comprehensive configuration may be provided by providing a connector\nconfiguration as a JSON body.  In this case, no query parameters are\nallowed.\n\nUpdates are split into `Chunk`s.\n\nThe pipeline continues sending updates until the client closes the\nconnection or the pipeline is stopped.",
+        "description": "Required role: `write` or higher.\n\nSubscribe to a stream of updates from a SQL view or table.\n\nThe pipeline responds with a continuous stream of changes to the specified\ntable or view.  The stream is configurable two ways:\n\n- Simple configuration of the format may be provided using query parameters.\nSpecify `backpressure` to specify behavior when the HTTP client cannot\nkeep up.  Use `format` to specify `csv` or `json` output.  For `json`\noutput format, `update_format` and `json_flavor` may be provided (with the\nsame possible values as in JSON format configuration for connectors).\n\n- Comprehensive configuration may be provided by providing a connector\nconfiguration as a JSON body.  In this case, no query parameters are\nallowed.\n\nUpdates are split into `Chunk`s.\n\nThe pipeline continues sending updates until the client closes the\nconnection or the pipeline is stopped.",
         "operationId": "http_output",
         "parameters": [
           {
@@ -4141,7 +4145,7 @@
           "Metrics & Debugging"
         ],
         "summary": "List Pipeline Events",
-        "description": "Retrieve monitoring events in reverse chronological order.\n\nPipeline health is monitored regularly every several seconds.\nNot every monitoring action results in a pipeline monitor event being\nconstructed and inserted into the database. This happens if:\n- Any status changed\n- Only the status details changed, and it has been 10s since the last event\n- Nothing has changed for more than 10 minutes\n\nThis endpoint returns the most recent persisted events, up to by default approximately 720.",
+        "description": "Required role: `read` or higher.\n\nRetrieve monitoring events in reverse chronological order.\n\nPipeline health is monitored regularly every several seconds.\nNot every monitoring action results in a pipeline monitor event being\nconstructed and inserted into the database. This happens if:\n- Any status changed\n- Only the status details changed, and it has been 10s since the last event\n- Nothing has changed for more than 10 minutes\n\nThis endpoint returns the most recent persisted events, up to by default approximately 720.",
         "operationId": "list_pipeline_events",
         "parameters": [
           {
@@ -4211,7 +4215,7 @@
           "Metrics & Debugging"
         ],
         "summary": "Get Pipeline Event",
-        "description": "Get a specific pipeline monitor event.\n\nThe identifiers of the events can be retrieved via `GET /v0/pipelines/<pipeline>/events`.\nThe most recent approximately 720 (default) events are retained.\nThis endpoint can return a 404 for an event that no longer exists due to a cleanup.",
+        "description": "Required role: `read` or higher.\n\nGet a specific pipeline monitor event.\n\nThe identifiers of the events can be retrieved via `GET /v0/pipelines/<pipeline>/events`.\nThe most recent approximately 720 (default) events are retained.\nThis endpoint can return a 404 for an event that no longer exists due to a cleanup.",
         "operationId": "get_pipeline_event",
         "parameters": [
           {
@@ -4297,7 +4301,7 @@
           "Metrics & Debugging"
         ],
         "summary": "Get Heap Profile",
-        "description": "Retrieve the heap profile of a running or paused pipeline.",
+        "description": "Required role: `read` or higher.\n\nRetrieve the heap profile of a running or paused pipeline.",
         "operationId": "get_pipeline_heap_profile",
         "parameters": [
           {
@@ -4429,7 +4433,7 @@
           "Input Connectors"
         ],
         "summary": "Insert Data",
-        "description": "Push data to a SQL table.\n\nThe client sends data encoded using the format specified in the `?format=`\nparameter as a body of the request.  The contents of the data must match\nthe SQL table schema specified in `table_name`\n\nThe pipeline ingests data as it arrives without waiting for the end of\nthe request.  Successful HTTP response indicates that all data has been\ningested successfully.\n\nOn success, returns a completion token that can be passed to the\n'/completion_status' endpoint to check whether the pipeline has fully\nprocessed the data.",
+        "description": "Required role: `write` or higher.\n\nPush data to a SQL table.\n\nThe client sends data encoded using the format specified in the `?format=`\nparameter as a body of the request.  The contents of the data must match\nthe SQL table schema specified in `table_name`\n\nThe pipeline ingests data as it arrives without waiting for the end of\nthe request.  Successful HTTP response indicates that all data has been\ningested successfully.\n\nOn success, returns a completion token that can be passed to the\n'/completion_status' endpoint to check whether the pipeline has fully\nprocessed the data.",
         "operationId": "http_input",
         "parameters": [
           {
@@ -4626,7 +4630,7 @@
           "Metrics & Debugging"
         ],
         "summary": "Stream Pipeline Logs",
-        "description": "Retrieve logs of a pipeline as a stream.\n\nThe logs stream catches up to the extent of the internally configured per-pipeline\ncircular logs buffer (limited to a certain byte size and number of lines, whichever\nis reached first). After the catch-up, new lines are pushed whenever they become\navailable.\n\nIt is possible for the logs stream to end prematurely due to the API server temporarily losing\nconnection to the runner. In this case, it is needed to issue again a new request to this\nendpoint.\n\nThe logs stream will end when the pipeline is deleted, or if the runner restarts. Note that in\nboth cases the logs will be cleared.",
+        "description": "Required role: `read` or higher.\n\nRetrieve logs of a pipeline as a stream.\n\nThe logs stream catches up to the extent of the internally configured per-pipeline\ncircular logs buffer (limited to a certain byte size and number of lines, whichever\nis reached first). After the catch-up, new lines are pushed whenever they become\navailable.\n\nIt is possible for the logs stream to end prematurely due to the API server temporarily losing\nconnection to the runner. In this case, it is needed to issue again a new request to this\nendpoint.\n\nThe logs stream will end when the pipeline is deleted, or if the runner restarts. Note that in\nboth cases the logs will be cleared.",
         "operationId": "get_pipeline_logs",
         "parameters": [
           {
@@ -4713,7 +4717,7 @@
           "Metrics & Debugging"
         ],
         "summary": "Get Pipeline Metrics",
-        "description": "Retrieve the metrics of a running or paused pipeline.",
+        "description": "Required role: `read` or higher.\n\nRetrieve the metrics of a running or paused pipeline.",
         "operationId": "get_pipeline_metrics",
         "parameters": [
           {
@@ -4843,7 +4847,7 @@
           "Pipeline Lifecycle"
         ],
         "summary": "Pause Pipeline",
-        "description": "Requests the pipeline to pause, which it will do asynchronously.\n\nProgress should be monitored by polling the pipeline `GET` endpoints.",
+        "description": "Required role: `write` or higher.\n\nRequests the pipeline to pause, which it will do asynchronously.\n\nProgress should be monitored by polling the pipeline `GET` endpoints.",
         "operationId": "post_pipeline_pause",
         "parameters": [
           {
@@ -4921,7 +4925,7 @@
           "Pipeline Lifecycle"
         ],
         "summary": "Execute Ad-hoc SQL",
-        "description": "Execute ad-hoc SQL in a running or paused pipeline.\n\nThe evaluation is not incremental.",
+        "description": "Required role: `write` or higher.\n\nExecute ad-hoc SQL in a running or paused pipeline.\n\nThe evaluation is not incremental.",
         "operationId": "pipeline_adhoc_sql",
         "parameters": [
           {
@@ -5071,7 +5075,7 @@
           "Pipeline Lifecycle"
         ],
         "summary": "Initiate rebalancing.",
-        "description": "Initiate immediate rebalancing of the pipeline. Normally rebalancing is initiated automatically\nwhen the drift in the size of joined relations exceeds a threshold. This endpoint forces the balancer\nto reevaluate and apply an optimal partitioning policy regardless of the threshold.\n\nThis operation is a no-op unless the `adaptive_joins` feature is enabled in `dev_tweaks`.",
+        "description": "Required role: `write` or higher.\n\nInitiate immediate rebalancing of the pipeline. Normally rebalancing is initiated automatically\nwhen the drift in the size of joined relations exceeds a threshold. This endpoint forces the balancer\nto reevaluate and apply an optimal partitioning policy regardless of the threshold.\n\nThis operation is a no-op unless the `adaptive_joins` feature is enabled in `dev_tweaks`.",
         "operationId": "post_pipeline_rebalance",
         "parameters": [
           {
@@ -5129,7 +5133,7 @@
           "Pipeline Lifecycle"
         ],
         "summary": "Resume Pipeline",
-        "description": "Requests the pipeline to resume, which it will do asynchronously.\n\nProgress should be monitored by polling the pipeline `GET` endpoints.",
+        "description": "Required role: `write` or higher.\n\nRequests the pipeline to resume, which it will do asynchronously.\n\nProgress should be monitored by polling the pipeline `GET` endpoints.",
         "operationId": "post_pipeline_resume",
         "parameters": [
           {
@@ -5207,7 +5211,7 @@
           "Metrics & Debugging"
         ],
         "summary": "Get Samply Profile",
-        "description": "Retrieve the last samply profile of a pipeline, regardless of whether profiling is currently in progress.\nIf ?latest parameter is specified and Samply profile collection is in progress, returns HTTP 307 with Retry-After header.",
+        "description": "Required role: `read` or higher.\n\nRetrieve the last samply profile of a pipeline, regardless of whether profiling is currently in progress.\nIf ?latest parameter is specified and Samply profile collection is in progress, returns HTTP 307 with Retry-After header.",
         "operationId": "get_pipeline_samply_profile",
         "parameters": [
           {
@@ -5356,7 +5360,7 @@
           "Metrics & Debugging"
         ],
         "summary": "Start a Samply profile",
-        "description": "Profile the pipeline using the Samply profiler for the next `duration_secs` seconds.",
+        "description": "Required role: `read` or higher.\n\nProfile the pipeline using the Samply profiler for the next `duration_secs` seconds.",
         "operationId": "start_samply_profile",
         "parameters": [
           {
@@ -5501,7 +5505,7 @@
           "Pipeline Lifecycle"
         ],
         "summary": "Start Pipeline",
-        "description": "Start the pipeline asynchronously by updating the desired status.\n\nThe endpoint returns immediately after setting the desired status.\nThe procedure to get to the desired status is performed asynchronously.\nProgress should be monitored by polling the pipeline `GET` endpoints.\n\nNote the following:\n- A stopped pipeline can be started through calling `/start?initial=running`,\n`/start?initial=paused`, or `/start?initial=standby`.\n- If the pipeline is already (being) started (provisioned), it will still return success\n- It is not possible to call `/start` when the pipeline has already had `/stop` called and is\nin the process of suspending or stopping.",
+        "description": "Required role: `write` or higher.\n\nStart the pipeline asynchronously by updating the desired status.\n\nThe endpoint returns immediately after setting the desired status.\nThe procedure to get to the desired status is performed asynchronously.\nProgress should be monitored by polling the pipeline `GET` endpoints.\n\nNote the following:\n- A stopped pipeline can be started through calling `/start?initial=running`,\n`/start?initial=paused`, or `/start?initial=standby`.\n- If the pipeline is already (being) started (provisioned), it will still return success\n- It is not possible to call `/start` when the pipeline has already had `/stop` called and is\nin the process of suspending or stopping.",
         "operationId": "post_pipeline_start",
         "parameters": [
           {
@@ -5623,7 +5627,7 @@
           "Pipeline Lifecycle"
         ],
         "summary": "Initiate compaction.",
-        "description": "Initiate immediate compaction of the pipeline's state.",
+        "description": "Required role: `write` or higher.\n\nInitiate immediate compaction of the pipeline's state.",
         "operationId": "post_pipeline_start_compaction",
         "parameters": [
           {
@@ -5737,7 +5741,7 @@
           "Pipeline Lifecycle"
         ],
         "summary": "Begin Transaction",
-        "description": "Start a new transaction.",
+        "description": "Required role: `write` or higher.\n\nStart a new transaction.",
         "operationId": "start_transaction",
         "parameters": [
           {
@@ -5851,7 +5855,7 @@
           "Metrics & Debugging"
         ],
         "summary": "Get Pipeline Stats",
-        "description": "Retrieve statistics (e.g., performance counters) of a running or paused pipeline.",
+        "description": "Required role: `read` or higher.\n\nRetrieve statistics (e.g., performance counters) of a running or paused pipeline.",
         "operationId": "get_pipeline_stats",
         "parameters": [
           {
@@ -5972,7 +5976,7 @@
           "Pipeline Lifecycle"
         ],
         "summary": "Stop Pipeline",
-        "description": "Stop the pipeline asynchronously by updating the desired state.\n\nThere are two variants:\n- `/stop?force=false` (default): the pipeline will first atomically checkpoint before\ndeprovisioning the compute resources. When resuming, the pipeline will start from this\n- `/stop?force=true`: the compute resources will be immediately deprovisioned. When resuming,\nit will pick up the latest checkpoint made by the periodic checkpointer or by a prior\n`/checkpoint` call.\n\nThe endpoint returns immediately after setting the desired state to `Suspended` for\n`?force=false` or `Stopped` for `?force=true`. In the former case, once the pipeline has\nsuccessfully passes the `Suspending` state, the desired state will become `Stopped` as well.\nThe procedure to get to the desired state is performed asynchronously. Progress should be\nmonitored by polling the pipeline `GET` endpoints.\n\nNote the following:\n- The suspending that is done with `/stop?force=false` is not guaranteed to succeed:\n- If an error is returned during the suspension, the pipeline will be forcefully stopped with\nthat error set\n- Otherwise, it will keep trying to suspend, in which case it is possible to cancel suspending\nby calling `/stop?force=true`\n- `/stop?force=true` cannot be cancelled: the pipeline must first reach `Stopped` before another\naction can be done\n- A pipeline which is in the process of suspending or stopping can only be forcefully stopped",
+        "description": "Required role: `write` or higher.\n\nStop the pipeline asynchronously by updating the desired state.\n\nThere are two variants:\n- `/stop?force=false` (default): the pipeline will first atomically checkpoint before\ndeprovisioning the compute resources. When resuming, the pipeline will start from this\n- `/stop?force=true`: the compute resources will be immediately deprovisioned. When resuming,\nit will pick up the latest checkpoint made by the periodic checkpointer or by a prior\n`/checkpoint` call.\n\nThe endpoint returns immediately after setting the desired state to `Suspended` for\n`?force=false` or `Stopped` for `?force=true`. In the former case, once the pipeline has\nsuccessfully passes the `Suspending` state, the desired state will become `Stopped` as well.\nThe procedure to get to the desired state is performed asynchronously. Progress should be\nmonitored by polling the pipeline `GET` endpoints.\n\nNote the following:\n- The suspending that is done with `/stop?force=false` is not guaranteed to succeed:\n- If an error is returned during the suspension, the pipeline will be forcefully stopped with\nthat error set\n- Otherwise, it will keep trying to suspend, in which case it is possible to cancel suspending\nby calling `/stop?force=true`\n- `/stop?force=true` cannot be cancelled: the pipeline must first reach `Stopped` before another\naction can be done\n- A pipeline which is in the process of suspending or stopping can only be forcefully stopped",
         "operationId": "post_pipeline_stop",
         "parameters": [
           {
@@ -6101,7 +6105,7 @@
           "Metrics & Debugging"
         ],
         "summary": "Download Support Bundle",
-        "description": "Generate a support bundle for a pipeline.\n\nThis endpoint collects various diagnostic data from the pipeline including\ncircuit profile, heap profile, metrics, logs, stats, and connector statistics,\nand packages them into a single ZIP file for support purposes.",
+        "description": "Required role: `read` or higher.\n\nGenerate a support bundle for a pipeline.\n\nThis endpoint collects various diagnostic data from the pipeline including\ncircuit profile, heap profile, metrics, logs, stats, and connector statistics,\nand packages them into a single ZIP file for support purposes.",
         "operationId": "get_pipeline_support_bundle",
         "parameters": [
           {
@@ -6313,7 +6317,7 @@
           "Input Connectors"
         ],
         "summary": "Get Completion Token",
-        "description": "Generate a completion token for an input connector.\n\nReturns a token that can be passed to the `/completion_status` endpoint\nto check whether the pipeline has finished processing all inputs received from the\nconnector before the token was generated.",
+        "description": "Required role: `write` or higher.\n\nGenerate a completion token for an input connector.\n\nReturns a token that can be passed to the `/completion_status` endpoint\nto check whether the pipeline has finished processing all inputs received from the\nconnector before the token was generated.",
         "operationId": "completion_token",
         "parameters": [
           {
@@ -6452,7 +6456,7 @@
           "Input Connectors"
         ],
         "summary": "Get Input Status",
-        "description": "Retrieve the status of an input connector.",
+        "description": "Required role: `read` or higher.\n\nRetrieve the status of an input connector.",
         "operationId": "get_pipeline_input_connector_status",
         "parameters": [
           {
@@ -6595,7 +6599,7 @@
           "Input Connectors"
         ],
         "summary": "Control Input Connector",
-        "description": "Start (resume) or pause the input connector.\n\nThe following values of the `action` argument are accepted: `start` and `pause`.\n\nInput connectors can be in either the `Running` or `Paused` state. By default,\nconnectors are initialized in the `Running` state when a pipeline is deployed.\nIn this state, the connector actively fetches data from its configured data\nsource and forwards it to the pipeline. If needed, a connector can be created\nin the `Paused` state by setting its\n[`paused`](https://docs.feldera.com/connectors/#generic-attributes) property\nto `true`. When paused, the connector remains idle until reactivated using the\n`start` command. Conversely, a connector in the `Running` state can be paused\nat any time by issuing the `pause` command.\n\nThe current connector state can be retrieved via the\n`GET /v0/pipelines/{pipeline_name}/stats` endpoint.\n\nNote that only if both the pipeline *and* the connector state is `Running`,\nis the input connector active.\n```text\nPipeline state    Connector state    Connector is active?\n--------------    ---------------    --------------------\nPaused            Paused             No\nPaused            Running            No\nRunning           Paused             No\nRunning           Running            Yes\n```",
+        "description": "Required role: `write` or higher.\n\nStart (resume) or pause the input connector.\n\nThe following values of the `action` argument are accepted: `start` and `pause`.\n\nInput connectors can be in either the `Running` or `Paused` state. By default,\nconnectors are initialized in the `Running` state when a pipeline is deployed.\nIn this state, the connector actively fetches data from its configured data\nsource and forwards it to the pipeline. If needed, a connector can be created\nin the `Paused` state by setting its\n[`paused`](https://docs.feldera.com/connectors/#generic-attributes) property\nto `true`. When paused, the connector remains idle until reactivated using the\n`start` command. Conversely, a connector in the `Running` state can be paused\nat any time by issuing the `pause` command.\n\nThe current connector state can be retrieved via the\n`GET /v0/pipelines/{pipeline_name}/stats` endpoint.\n\nNote that only if both the pipeline *and* the connector state is `Running`,\nis the input connector active.\n```text\nPipeline state    Connector state    Connector is active?\n--------------    ---------------    --------------------\nPaused            Paused             No\nPaused            Running            No\nRunning           Paused             No\nRunning           Running            Yes\n```",
         "operationId": "post_pipeline_input_connector_action",
         "parameters": [
           {
@@ -6739,7 +6743,7 @@
           "Metrics & Debugging"
         ],
         "summary": "Get Time Series Stats",
-        "description": "Retrieve time series for statistics of a running or paused pipeline.",
+        "description": "Required role: `read` or higher.\n\nRetrieve time series for statistics of a running or paused pipeline.",
         "operationId": "get_pipeline_time_series",
         "parameters": [
           {
@@ -6860,7 +6864,7 @@
           "Metrics & Debugging"
         ],
         "summary": "Stream Time Series",
-        "description": "Stream time series for statistics of a running or paused pipeline.\n\nReturns a snapshot of all existing time series data followed by a continuous stream of\nnew time series data points as they become available. The response is in newline-delimited\nJSON format (NDJSON) where each line is a JSON object representing a single time series\ndata point.",
+        "description": "Required role: `read` or higher.\n\nStream time series for statistics of a running or paused pipeline.\n\nReturns a snapshot of all existing time series data followed by a continuous stream of\nnew time series data points as they become available. The response is in newline-delimited\nJSON format (NDJSON) where each line is a JSON object representing a single time series\ndata point.",
         "operationId": "get_pipeline_time_series_stream",
         "parameters": [
           {
@@ -6981,7 +6985,7 @@
           "Pipeline Lifecycle"
         ],
         "summary": "Recompile Pipeline",
-        "description": "Recompile a pipeline with the Feldera runtime version included in the\ncurrently installed Feldera platform.\n\nUse this endpoint after upgrading Feldera to rebuild pipelines that were\ncompiled with older platform versions. In most cases, recompilation is not\nrequired; pipelines compiled with older versions will continue to run on the\nupgraded platform.\n\nSituations where recompilation may be necessary:\n- To benefit from the latest bug fixes and performance optimizations.\n- When backward-incompatible changes are introduced in Feldera. In this case,\nattempting to start a pipeline compiled with an unsupported version will\nresult in an error.\n\nIf the pipeline is already compiled with the current platform version,\nthis operation is a no-op.\n\nNote that recompiling the pipeline with a new platform version may change its\nquery plan. If the modified pipeline is started from an existing checkpoint,\nit may require bootstrapping parts of its state from scratch.  See Feldera\ndocumentation for details on the bootstrapping process.",
+        "description": "Required role: `write` or higher.\n\nRecompile a pipeline with the Feldera runtime version included in the\ncurrently installed Feldera platform.\n\nUse this endpoint after upgrading Feldera to rebuild pipelines that were\ncompiled with older platform versions. In most cases, recompilation is not\nrequired; pipelines compiled with older versions will continue to run on the\nupgraded platform.\n\nSituations where recompilation may be necessary:\n- To benefit from the latest bug fixes and performance optimizations.\n- When backward-incompatible changes are introduced in Feldera. In this case,\nattempting to start a pipeline compiled with an unsupported version will\nresult in an error.\n\nIf the pipeline is already compiled with the current platform version,\nthis operation is a no-op.\n\nNote that recompiling the pipeline with a new platform version may change its\nquery plan. If the modified pipeline is started from an existing checkpoint,\nit may require bootstrapping parts of its state from scratch.  See Feldera\ndocumentation for details on the bootstrapping process.",
         "operationId": "post_update_runtime",
         "parameters": [
           {
@@ -7170,7 +7174,7 @@
           "Output Connectors"
         ],
         "summary": "Get Output Status",
-        "description": "Retrieve the status of an output connector.",
+        "description": "Required role: `read` or higher.\n\nRetrieve the status of an output connector.",
         "operationId": "get_pipeline_output_connector_status",
         "parameters": [
           {
@@ -7312,8 +7316,8 @@
         "tags": [
           "Platform"
         ],
-        "summary": "List tenant members",
-        "description": "List the users that are members of the acting tenant and their roles.",
+        "summary": "List Tenant Members",
+        "description": "Required role: `admin` or higher.\n\nList the users that are members of the acting tenant and their roles.",
         "operationId": "list_tenant_users",
         "responses": {
           "200": {
@@ -7350,8 +7354,8 @@
         "tags": [
           "Platform"
         ],
-        "summary": "Pre-provision a tenant member",
-        "description": "Add a member to the acting tenant by identity, before the user's first\nlogin. The grant is dormant until that identity authenticates into the\ntenant through the IdP. The role is capped at the caller's own role and may\nnot be `owner`.",
+        "summary": "Provision Tenant Member",
+        "description": "Required role: `admin` or higher.\n\nAdd a member to the acting tenant by identity, before the user's first\nlogin. The grant is dormant until that identity authenticates into the\ntenant through the IdP. The role is capped at the caller's own role and may\nnot be `owner`.",
         "operationId": "add_tenant_user",
         "requestBody": {
           "content": {
@@ -7397,8 +7401,8 @@
         "tags": [
           "Platform"
         ],
-        "summary": "Assign a member role",
-        "description": "Assign or change a user's role in the acting tenant. The role is capped at\nthe caller's own role and may not be `owner`.",
+        "summary": "Assign Member Role",
+        "description": "Required role: `admin` or higher.\n\nAssign or change a user's role in the acting tenant. The role is capped at\nthe caller's own role and may not be `owner`.",
         "operationId": "put_tenant_user",
         "parameters": [
           {
@@ -7407,7 +7411,8 @@
             "description": "User identifier",
             "required": true,
             "schema": {
-              "type": "string"
+              "type": "string",
+              "format": "uuid"
             }
           }
         ],
@@ -7446,8 +7451,8 @@
         "tags": [
           "Platform"
         ],
-        "summary": "Remove a tenant member",
-        "description": "Remove a user from the acting tenant.",
+        "summary": "Remove Tenant Member",
+        "description": "Required role: `admin` or higher.\n\nRemove a user from the acting tenant. This drops their role now, but if the\nidentity provider still grants them access they are re-added at the default\nrole on their next login; revoke access at the provider for a durable block.",
         "operationId": "delete_tenant_user",
         "parameters": [
           {
@@ -7456,7 +7461,8 @@
             "description": "User identifier",
             "required": true,
             "schema": {
-              "type": "string"
+              "type": "string",
+              "format": "uuid"
             }
           }
         ],
@@ -7488,7 +7494,7 @@
           "Platform"
         ],
         "summary": "List tenants",
-        "description": "List all tenants in the installation. Owner-only platform view.",
+        "description": "Required role: `owner`.\n\nList all tenants in the installation.",
         "operationId": "list_tenants",
         "responses": {
           "200": {
@@ -7525,8 +7531,8 @@
         "tags": [
           "Platform"
         ],
-        "summary": "Create a tenant",
-        "description": "Explicitly create a tenant (owner-only), rather than relying on first login.\nThe tenant is keyed to the platform's configured OIDC issuer (statically set\nat deploy time, e.g. via Helm), so that logins from that issuer resolve into\nit; the issuer is not caller-settable. Fails with a conflict if a tenant with\nthe same name already exists for that issuer.",
+        "summary": "Create Tenant",
+        "description": "Required role: `owner`.\n\nExplicitly create a tenant, rather than relying on first login.\nThe tenant is keyed to the platform's configured OIDC issuer (statically set\nat deploy time, e.g. via Helm), so that logins from that issuer resolve into\nit; the issuer is not caller-settable. Fails with a conflict if a tenant with\nthe same name already exists for that issuer.",
         "operationId": "create_tenant",
         "requestBody": {
           "content": {
@@ -7573,7 +7579,7 @@
           "Pipeline Lifecycle"
         ],
         "summary": "Validate Program",
-        "description": "Validate a SQL program by compiling it, without creating a pipeline or\nbuilding the pipeline binary. Reports SQL errors and warnings and the derived\nschema and connectors. Set `ir` to also return the program IR (dataflow).\n\nNote that this endpoint returns HTTP 200, regardless of whether validation\nsucceeds or fails. The validation result, including any compiler warnings and errors,\nis encoded in the `ValidateProgramResponse` response body.",
+        "description": "Required role: `read` or higher.\n\nValidate a SQL program by compiling it, without creating a pipeline or\nbuilding the pipeline binary. Reports SQL errors and warnings and the derived\nschema and connectors. Set `ir` to also return the program IR (dataflow).\n\nNote that this endpoint returns HTTP 200, regardless of whether validation\nsucceeds or fails. The validation result, including any compiler warnings and errors,\nis encoded in the `ValidateProgramResponse` response body.",
         "operationId": "post_validate_program",
         "requestBody": {
           "description": "The SQL program to validate, an optional runtime version, and whether to return the IR",
@@ -7686,7 +7692,7 @@
             "nullable": true
           },
           "role": {
-            "$ref": "#/components/schemas/Role"
+            "$ref": "#/components/schemas/MemberRole"
           },
           "subject": {
             "type": "string",
@@ -7736,7 +7742,7 @@
             "type": "string"
           },
           "role": {
-            "$ref": "#/components/schemas/Role"
+            "$ref": "#/components/schemas/MintableKeyRole"
           }
         }
       },
@@ -11147,6 +11153,15 @@
           }
         ]
       },
+      "MemberRole": {
+        "type": "string",
+        "description": "A role assignable to a tenant member: `read`, `write`, or `admin`. `owner`\nis a platform-wide role, not a tenant membership, so it is not a valid value\nhere.",
+        "enum": [
+          "read",
+          "write",
+          "admin"
+        ]
+      },
       "MemoryPressure": {
         "type": "string",
         "description": "Memory pressure level.\n\nThe current memory pressure level is computed as a function of the current process\nresident set size (RSS) and the user-configured memory limit (`max_rss`).\n\nAs the memory pressure level increases, the system will apply increasing backpressure to\npush state cached in memory to storage.\n\n- `Low`: less than 85% of the user-configured memory limit has been allocated.\n- `Moderate`: between 85% and 90% of the user-configured memory limit has been allocated.\n- `High`: between 90% and 95% of the user-configured memory limit has been allocated.\n- `Critical`: more than 95% of the user-configured memory limit has been allocated.",
@@ -11182,6 +11197,14 @@
           }
         }
       },
+      "MintableKeyRole": {
+        "type": "string",
+        "description": "The role an API key carries: `read` or `write`. API keys cannot be granted\n`admin` or `owner`; those roles are held only by interactive logins and OIDC\ntrust relationships.",
+        "enum": [
+          "read",
+          "write"
+        ]
+      },
       "MirInput": {
         "type": "object",
         "required": [
@@ -11323,7 +11346,7 @@
           "role": {
             "allOf": [
               {
-                "$ref": "#/components/schemas/Role"
+                "$ref": "#/components/schemas/MintableKeyRole"
               }
             ],
             "nullable": true
@@ -14371,7 +14394,7 @@
         ],
         "properties": {
           "role": {
-            "$ref": "#/components/schemas/Role"
+            "$ref": "#/components/schemas/MemberRole"
           }
         }
       },

From 4971592557dacdb25acd55f14fe240fc5ab207a6 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Fri, 24 Jul 2026 10:02:37 -0700
Subject: [PATCH 09/55] [docs] Authentication: RBAC roles page and upgrade
 guidance

Add a Roles page (role model, platform-owner bootstrap, default-role and owners
settings) and link it in the Authentication sidebar. Clarify that the
authorized-groups check applies to owners too, and document the no-auth to auth
tenant-orphaning and its owner-mediated recovery.

Changelog: describe the RBAC change and how to upgrade an existing installation,
note the two API-key breaking changes, and move already-released items under
their version headings (v0.322.0, v0.319.0, v0.316.0) so only RBAC remains under
Unreleased.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 docs.feldera.com/docs/changelog.md            | 36 ++++++-
 .../enterprise/authentication/index.mdx       | 34 +++++++
 .../enterprise/authentication/roles.md        | 94 +++++++++++++++++++
 docs.feldera.com/docs/sidebars.js             |  1 +
 4 files changed, 162 insertions(+), 3 deletions(-)
 create mode 100644 docs.feldera.com/docs/get-started/enterprise/authentication/roles.md

diff --git a/docs.feldera.com/docs/changelog.md b/docs.feldera.com/docs/changelog.md
index 3eae354c8dd..ee87d3ab591 100644
--- a/docs.feldera.com/docs/changelog.md
+++ b/docs.feldera.com/docs/changelog.md
@@ -20,18 +20,46 @@ import TabItem from '@theme/TabItem';
           the primary key.  As a result some programs that used to run
           with finite state will now have unbounded state.
 
-       ## v0.322.0
+        - Role-based access control (RBAC). Access is now governed by per-user,
+          per-tenant roles (`read` < `write` < `admin` < `owner`) rather than every
+          authenticated user having full access to their tenant. See
+          [Roles](/get-started/enterprise/authentication/roles) for the model.
+
+          Upgrading an existing authenticated installation: before RBAC every
+          authenticated user had read and write access; after the upgrade a returning
+          user starts with no membership and is admitted at the configured default role.
+          Set `authorization.defaultRole: write` (the binary default is `read`; the Helm
+          chart sets it to `write` in `values.yaml`) so returning users keep their read
+          and write access, and set
+          `authorization.owners` to bootstrap a platform owner, who can then grant
+          `admin` to whoever manages users and OIDC trust. The default role is applied
+          and recorded on a user's first login after the upgrade, so set it before the
+          first post-upgrade logins; changing it later does not re-grade users who have
+          already logged in (an owner or admin adjusts those individually). Tighten
+          `defaultRole` back to `read` once explicit roles are provisioned.
+
+        - Breaking change (API keys): the `scopes` array on API-key responses
+          (`GET /v0/api_keys`, `GET /v0/api_keys/{api_key_name}`) is replaced by a single
+          `role` string, one of `read` or `write` (lower-case). Clients that read the
+          `scopes` field must read `role` instead. Existing keys are migrated to `write`,
+          so their access is unchanged.
+
+        - Breaking change (API keys): `POST /v0/api_keys` without a `role` field now
+          creates a `read`-only key. Previously a new key carried read and write access.
+          Pass `{"role": "write"}` in the request body to keep the previous behavior.
+
+        ## v0.322.0
 
         - Pipeline API field `deployment_runtime_status_details` is now strongly typed,
           whereas before it was just a generic JSON value type. While `AwaitingApproval`,
           the diff is now located at `deployment_runtime_status_details.approval_diff`
           instead of being the whole details itself.
 
-        - Pipelines from this latest version onward will have their GET selector
+        - Pipelines from v0.322.0 onward will have their GET selector
           `status_with_connectors` connector stats cached, which are now updated along
           with the runtime status details within roughly 1-15s.
 
-       ## v0.319.0
+        ## v0.319.0
 
         - Cluster monitor events with information on the backing (Kubernetes) resources is
           no longer gated behind unstable feature `cluster_monitor_resources` (deprecated).
@@ -41,6 +69,8 @@ import TabItem from '@theme/TabItem';
           The cluster monitoring of resources can still be disabled by setting in the Helm
           chart `disableClusterMonitorResources` to `true`.
 
+        ## v0.316.0
+
         - A bug fix introduced a backward incompatible change to the replay journal format.
           This only affects pipelines configured with exactly-once fault tolerance. Such
           pipelines should not be upgraded to the new Feldera runtime if they are in a failed
diff --git a/docs.feldera.com/docs/get-started/enterprise/authentication/index.mdx b/docs.feldera.com/docs/get-started/enterprise/authentication/index.mdx
index 67e3589e453..daa02feb41d 100644
--- a/docs.feldera.com/docs/get-started/enterprise/authentication/index.mdx
+++ b/docs.feldera.com/docs/get-started/enterprise/authentication/index.mdx
@@ -24,6 +24,8 @@ We support multiple authorization use-cases through strategies to assign tenant
 As an orthogonal feature, the authorized-groups startup parameter can be used to limit access to the users who are a member of at least one of the groups in this list. The membership is determined based on the `groups` claim of an OIDC Access token.
 Users must belong to at least one of the specified groups to access Feldera. If `authorizedGroups` is not specified or empty, no group restrictions apply.
 
+This group check applies to every principal, including platform owners: the membership check runs before owner resolution, so an identity listed in `owners` that is not in any authorized group is still denied access. Being an owner does not exempt a user from the group requirement.
+
 ## Tenant Assignment Strategies
 
 Feldera provides three different tenant assignment strategies to support different deployment patterns:
@@ -57,6 +59,28 @@ auth:
   enabled: false
 ```
 
+### Transitioning from no authentication to authentication
+
+A deployment that runs without authentication keeps all of its data under a
+single built-in tenant named `default`, whose id is the all-zero UUID
+`00000000-0000-0000-0000-000000000000`. When you enable authentication, each
+login resolves to its own tenant per the strategies above, not to the `default`
+tenant, so pipelines and API keys created while authentication was disabled are
+not visible to ordinary logins.
+
+To reach that data after enabling authentication, a platform
+[owner](/get-started/enterprise/authentication/roles) selects the default tenant
+explicitly with the `Feldera-Tenant` header:
+
+```bash
+curl -H "Authorization: Bearer $OWNER_TOKEN" \
+     -H "Feldera-Tenant: 00000000-0000-0000-0000-000000000000" \
+     https://<your-host>/v0/pipelines
+```
+
+Recreate the resources in a regular tenant as needed. Plan this migration before
+enabling authentication on a deployment that already holds data.
+
 ### Individual access
 
 Every user gets their individual tenant based on their `sub` claim.
@@ -194,6 +218,14 @@ authorization:
 
   # OIDC audience claim validation (default: "feldera-api")
   authAudience: "feldera-api"           # Maps to: FELDERA_AUTH_AUDIENCE
+
+  # Platform owners: identities granted the platform-wide `owner` role (default: [])
+  owners:                               # Maps to: FELDERA_OWNERS
+    - "ops@example.com"
+
+  # Role for an authenticated user with no explicit membership yet (default: "read")
+  # Ship "write" when upgrading a pre-RBAC deployment; see the Roles page.
+  defaultRole: "write"                  # Maps to: FELDERA_AUTH_DEFAULT_ROLE
 ```
 
 ### Environment Variables Reference
@@ -216,6 +248,8 @@ FELDERA_AUTH_INDIVIDUAL_TENANT=true          # default: true
 FELDERA_AUTH_ISSUER_TENANT=false             # default: false
 FELDERA_AUTH_AUTHORIZED_GROUPS=group1,group2 # comma-separated list
 FELDERA_AUTH_AUDIENCE=feldera-api            # default: feldera-api
+FELDERA_OWNERS=ops@example.com               # comma-separated; default: (none)
+FELDERA_AUTH_DEFAULT_ROLE=read               # read or write; default: read
 
 # AWS Cognito specific
 AWS_COGNITO_LOGIN_URL=https://...
diff --git a/docs.feldera.com/docs/get-started/enterprise/authentication/roles.md b/docs.feldera.com/docs/get-started/enterprise/authentication/roles.md
new file mode 100644
index 00000000000..baec33d098f
--- /dev/null
+++ b/docs.feldera.com/docs/get-started/enterprise/authentication/roles.md
@@ -0,0 +1,94 @@
+---
+title: Roles
+sidebar_position: 2
+---
+
+# Roles
+
+Feldera Enterprise governs access with role-based access control (RBAC). Every
+authenticated principal (a human via OIDC, or an API key) holds a role in the
+tenant it acts in, and each API route requires a minimum role. The minimum role
+for a route is shown on its endpoint in the [API reference](/api).
+
+## Roles
+
+Roles are totally ordered: a higher role includes every capability of the ones
+below it.
+
+| Role | Scope | Can do |
+|---|---|---|
+| `read` | tenant | View pipelines, logs, metrics, stats, and configuration |
+| `write` | tenant | Everything `read` can, plus create, edit, run, and delete pipelines; push and query data; and manage the tenant's API keys |
+| `admin` | tenant | Everything `write` can, plus manage the tenant's members and their roles, and manage the tenant's OIDC trust relationships |
+| `owner` | platform | Everything `admin` can, in any tenant; create tenants; manage the installation |
+
+`read`, `write`, and `admin` are per-tenant memberships. `owner` is
+platform-wide: it is not stored as a tenant membership and is granted only
+through configuration (`owners`) or an owner OIDC trust relationship. An owner
+can select the tenant it acts in with the `Feldera-Tenant` request header.
+
+## How a role is assigned
+
+- On a user's first login to a tenant, if the user has no membership yet, they
+  are admitted at the configured default role (see [below](#default-role-and-owners))
+  and a membership record is created.
+- When that first login also creates the tenant (auto-provisioning, because the
+  resolved tenant did not exist yet), the user becomes the tenant's `admin`
+  instead. A tenant an owner creates explicitly starts with no members, and the
+  first user to log into it is admitted at the default role.
+- An `admin` or `owner` can pre-provision members and change member roles from the
+  Admin page in the web console, or through the
+  [set-member-role API](/api/assign-member-role).
+- `owner` comes from the `owners` setting or an owner OIDC trust; it is never
+  assigned as a tenant membership.
+- An API key carries a role capped at its creator's role, limited to `read` or
+  `write`.
+
+## Platform owners
+
+A new installation has no owners until you configure them. Set
+`authorization.owners` (Helm), which sets the `FELDERA_OWNERS` environment
+variable on the pipeline-manager pod, to a list of identities. Each entry matches
+an access token in one of three forms:
+
+| Form | Matches | Example |
+|---|---|---|
+| Verified email | the token's `email`, only when `email_verified` is true | `ops@example.com` |
+| OIDC subject | the token's `sub` | `a1b2c3d4-...` |
+| Provider-qualified subject | `"<issuer> <subject>"` | `https://accounts.google.com 1234567890` |
+
+```yaml
+authorization:
+  owners:
+    - "ops@example.com"
+    - "https://accounts.google.com 1234567890"
+```
+
+:::note
+Prefer the subject or provider-qualified form over email. An email entry matches
+only when the identity provider marks the email verified, and an email address is
+user-facing and can change, whereas the subject is stable.
+:::
+
+An owner can pre-provision members and grant `admin` to the people who will
+manage each tenant, from the Admin page or through the
+[set-member-role API](/api/assign-member-role).
+
+## Default role and owners
+
+Two settings govern how much access an authenticated user has before an admin or
+owner assigns them a role.
+
+`authorization.defaultRole` (environment: `FELDERA_AUTH_DEFAULT_ROLE`) is the role
+given to an authenticated user who has no explicit membership in the tenant they
+resolve to. It must be `read` or `write`; it can never grant `admin` or `owner`,
+because those are control-plane roles (managing members, trust, and tenants) that
+are granted only explicitly, never handed to an unprovisioned user by default.
+The value is applied on the user's first login and recorded as their membership,
+so a later change to `defaultRole` does not re-grade a user who has already logged
+in. The Helm chart sets this to `write`.
+
+`authorization.owners` (environment: `FELDERA_OWNERS`) lists the identities
+granted the platform-wide `owner` role, in the forms shown above. It is empty by
+default. At least one owner is needed to manage tenants across the installation
+and to grant `admin` in a tenant that a user did not create.
diff --git a/docs.feldera.com/docs/sidebars.js b/docs.feldera.com/docs/sidebars.js
index fbbbe29773e..1612dfcc6a0 100644
--- a/docs.feldera.com/docs/sidebars.js
+++ b/docs.feldera.com/docs/sidebars.js
@@ -66,6 +66,7 @@ const installation = {
                         id: 'get-started/enterprise/authentication/index',
                     },
                     items: [
+                        'get-started/enterprise/authentication/roles',
                         'get-started/enterprise/authentication/aws-cognito',
                         'get-started/enterprise/authentication/okta-sso',
                     ]

From 3142b69e60b7b622438924e2196b69bb4126f526 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Fri, 24 Jul 2026 15:44:44 -0700
Subject: [PATCH 10/55] [pipeline-manager] Make the tenant-creator's role
 configurable

The login that first creates a tenant (auto-provisioning) was hardcoded to
admin. Add first_user_role (--first-user-role / FELDERA_AUTH_FIRST_USER_ROLE),
capped at read/write/admin and defaulting to admin, so a deployment can grant
the creator a lower role. This lets a shared sandbox drop the creator to write
or read while default_role continues to govern later joiners of an existing
tenant.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 crates/pipeline-manager/src/auth.rs           |  2 +
 crates/pipeline-manager/src/config.rs         | 27 +++++++++++++
 .../src/db/operations/user.rs                 | 18 ++++++---
 crates/pipeline-manager/src/db/storage.rs     |  1 +
 .../src/db/storage_postgres.rs                |  2 +
 crates/pipeline-manager/src/db/test.rs        | 38 +++++++++++++++++++
 6 files changed, 82 insertions(+), 6 deletions(-)

diff --git a/crates/pipeline-manager/src/auth.rs b/crates/pipeline-manager/src/auth.rs
index 638519c750b..e213487b3b4 100644
--- a/crates/pipeline-manager/src/auth.rs
+++ b/crates/pipeline-manager/src/auth.rs
@@ -590,6 +590,7 @@ async fn bearer_auth(
                     subject,
                     email,
                     state.config.default_role,
+                    state.config.first_user_role,
                 )
                 .await
             };
@@ -1551,6 +1552,7 @@ mod test {
             auth_audience: "feldera-api".to_string(),
             owners: vec![],
             default_role: Role::Read,
+            first_user_role: Role::Admin,
         };
 
         let (conn, _temp) = crate::db::test::setup_pg().await;
diff --git a/crates/pipeline-manager/src/config.rs b/crates/pipeline-manager/src/config.rs
index 2149d83a5e9..850627a5407 100644
--- a/crates/pipeline-manager/src/config.rs
+++ b/crates/pipeline-manager/src/config.rs
@@ -130,6 +130,23 @@ fn parse_default_role(s: &str) -> Result<Role, String> {
     }
 }
 
+/// Default role granted to the login that first creates a tenant.
+fn default_first_user_role() -> Role {
+    Role::Admin
+}
+
+/// Parse the configured first-user role, restricting it to `read`, `write`, or
+/// `admin` (`owner` is platform-wide, never a tenant membership).
+fn parse_first_user_role(s: &str) -> Result<Role, String> {
+    match Role::from_str(s) {
+        Ok(role @ (Role::Read | Role::Write | Role::Admin)) => Ok(role),
+        Ok(other) => Err(format!(
+            "first user role must be 'read', 'write', or 'admin', not '{other}'"
+        )),
+        Err(e) => Err(e.to_string()),
+    }
+}
+
 /// Default number of monitor events that are retained for each pipeline.
 fn default_pipeline_monitor_events_retention() -> u32 {
     720
@@ -974,6 +991,15 @@ pub struct ApiServerConfig {
     #[serde(default = "default_default_role")]
     #[arg(long, default_value = "read", value_parser = parse_default_role, env = "FELDERA_AUTH_DEFAULT_ROLE")]
     pub default_role: Role,
+
+    /// Role granted to the user whose login first creates a tenant
+    /// (auto-provisioning). Must be `read`, `write`, or `admin`. Default:
+    /// `admin`, so the tenant's creator can manage it. Set it lower (e.g.
+    /// `write`) for a shared sandbox where users should not administer the
+    /// tenant they land in.
+    #[serde(default = "default_first_user_role")]
+    #[arg(long, default_value = "admin", value_parser = parse_first_user_role, env = "FELDERA_AUTH_FIRST_USER_ROLE")]
+    pub first_user_role: Role,
 }
 
 impl ApiServerConfig {
@@ -1022,6 +1048,7 @@ impl ApiServerConfig {
             auth_audience: "feldera-api".to_string(),
             owners: vec![],
             default_role: Role::Read,
+            first_user_role: Role::Admin,
         }
     }
 }
diff --git a/crates/pipeline-manager/src/db/operations/user.rs b/crates/pipeline-manager/src/db/operations/user.rs
index 6cd7a6398a3..f46e2fa631b 100644
--- a/crates/pipeline-manager/src/db/operations/user.rs
+++ b/crates/pipeline-manager/src/db/operations/user.rs
@@ -145,11 +145,12 @@ pub async fn list_tenant_members(
 }
 
 /// Atomic login resolution for a non-owner principal: resolve (or create) the
-/// acting tenant, ensure the user record, and determine the role. The first
-/// principal of a freshly created tenant becomes its `admin`; an existing
-/// member keeps its stored role; any other principal is admitted at
-/// `default_role` and a membership row is recorded so admins can see and adjust
-/// it. Returns the acting tenant, the user, and the effective role.
+/// acting tenant, ensure the user record, and determine the role. The login
+/// that first creates a tenant is granted `first_user_role` (`admin` by
+/// default); an existing member keeps its stored role; any other principal is
+/// admitted at `default_role` and a membership row is recorded so admins can
+/// see and adjust it. Returns the acting tenant, the user, and the effective
+/// role.
 #[allow(clippy::too_many_arguments)]
 pub async fn resolve_login(
     txn: &Transaction<'_>,
@@ -160,6 +161,7 @@ pub async fn resolve_login(
     subject: String,
     email: Option<String>,
     default_role: Role,
+    first_user_role: Role,
 ) -> Result<(TenantId, UserId, Role), DBError> {
     let (tenant_id, created) =
         get_or_create_tenant_id_created(txn, new_tenant_id, tenant_name, provider.clone()).await?;
@@ -169,7 +171,11 @@ pub async fn resolve_login(
     let role = match get_member_role(txn, tenant_id, user_id).await? {
         Some(role) => role,
         None => {
-            let role = if created { Role::Admin } else { default_role };
+            let role = if created {
+                first_user_role
+            } else {
+                default_role
+            };
             upsert_member_role(txn, tenant_id, user_id, role).await?;
             role
         }
diff --git a/crates/pipeline-manager/src/db/storage.rs b/crates/pipeline-manager/src/db/storage.rs
index c0590029431..173993afb9a 100644
--- a/crates/pipeline-manager/src/db/storage.rs
+++ b/crates/pipeline-manager/src/db/storage.rs
@@ -125,6 +125,7 @@ pub(crate) trait Storage {
         subject: String,
         email: Option<String>,
         default_role: Role,
+        first_user_role: Role,
     ) -> Result<(TenantId, UserId, Role), DBError>;
 
     /// Ensures a user record exists for an OIDC `(provider, subject)`.
diff --git a/crates/pipeline-manager/src/db/storage_postgres.rs b/crates/pipeline-manager/src/db/storage_postgres.rs
index c73176d97cd..39c39e5e6a1 100644
--- a/crates/pipeline-manager/src/db/storage_postgres.rs
+++ b/crates/pipeline-manager/src/db/storage_postgres.rs
@@ -156,6 +156,7 @@ impl Storage for StoragePostgres {
         subject: String,
         email: Option<String>,
         default_role: Role,
+        first_user_role: Role,
     ) -> Result<(TenantId, UserId, Role), DBError> {
         let mut client = self.pool.get().await?;
         let txn = client.transaction().await?;
@@ -168,6 +169,7 @@ impl Storage for StoragePostgres {
             subject,
             email,
             default_role,
+            first_user_role,
         )
         .await?;
         txn.commit().await?;
diff --git a/crates/pipeline-manager/src/db/test.rs b/crates/pipeline-manager/src/db/test.rs
index 0c6f76cba1b..8d4f5acbaaa 100644
--- a/crates/pipeline-manager/src/db/test.rs
+++ b/crates/pipeline-manager/src/db/test.rs
@@ -778,6 +778,37 @@ async fn api_key_store_and_validation() {
     }
 }
 
+/// `first_user_role` sets the role of the login that creates a tenant: with
+/// `write`, the creator is not made admin (e.g. a shared sandbox).
+#[tokio::test]
+async fn rbac_first_user_role_configurable() {
+    let handle = test_setup().await;
+    let provider = "https://idp.example".to_string();
+
+    // Creator of a fresh tenant, with first_user_role = write, is admitted at
+    // write rather than admin.
+    let (tenant, _founder, role) = handle
+        .db
+        .resolve_login(
+            Uuid::now_v7(),
+            Uuid::now_v7(),
+            "sandbox".to_string(),
+            provider.clone(),
+            "founder".to_string(),
+            Some("founder@sandbox.test".to_string()),
+            Role::Read,
+            Role::Write,
+        )
+        .await
+        .unwrap();
+    assert_eq!(role, Role::Write);
+
+    // The freshly created tenant therefore has no admin member; only a platform
+    // owner could administer it.
+    let members = handle.db.list_tenant_members(tenant).await.unwrap();
+    assert!(members.iter().all(|m| m.role != Role::Admin));
+}
+
 /// RBAC login resolution and membership: the first principal of a fresh tenant
 /// becomes its admin, later principals default to read, roles are editable and
 /// removable, and strict tenant lookup works.
@@ -797,6 +828,7 @@ async fn rbac_login_resolution_and_membership() {
             "alice".to_string(),
             Some("alice@acme.test".to_string()),
             Role::Read,
+            Role::Admin,
         )
         .await
         .unwrap();
@@ -813,6 +845,7 @@ async fn rbac_login_resolution_and_membership() {
             "bob".to_string(),
             Some("bob@acme.test".to_string()),
             Role::Read,
+            Role::Admin,
         )
         .await
         .unwrap();
@@ -830,6 +863,7 @@ async fn rbac_login_resolution_and_membership() {
             "alice".to_string(),
             None,
             Role::Read,
+            Role::Admin,
         )
         .await
         .unwrap();
@@ -900,6 +934,7 @@ async fn oidc_trust_matching_and_issuer_gate() {
                 format!("admin-{name}"),
                 None,
                 Role::Read,
+                Role::Admin,
             )
             .await
             .unwrap()
@@ -1076,6 +1111,7 @@ async fn preprovision_member_survives_first_login() {
             "admin".to_string(),
             None,
             Role::Read,
+            Role::Admin,
         )
         .await
         .unwrap();
@@ -1110,6 +1146,7 @@ async fn preprovision_member_survives_first_login() {
             "carol".to_string(),
             Some("carol@acme.test".to_string()),
             Role::Read,
+            Role::Admin,
         )
         .await
         .unwrap();
@@ -5204,6 +5241,7 @@ impl Storage for Mutex<DbModel> {
         _subject: String,
         _email: Option<String>,
         default_role: Role,
+        _first_user_role: Role,
     ) -> DBResult<(TenantId, UserId, Role)> {
         Ok((TenantId(Uuid::nil()), UserId(Uuid::nil()), default_role))
     }

From 536c24b777943984a3ac090fb7e7c287b2bcba96 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Fri, 24 Jul 2026 15:44:53 -0700
Subject: [PATCH 11/55] [docs] Document the configurable first-user role

Note on the Roles page that the tenant creator is granted first_user_role
(admin by default) and add it to the settings section; add firstUserRole /
FELDERA_AUTH_FIRST_USER_ROLE to the authentication configuration reference.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 .../enterprise/authentication/index.mdx          |  5 +++++
 .../enterprise/authentication/roles.md           | 16 +++++++++++-----
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/docs.feldera.com/docs/get-started/enterprise/authentication/index.mdx b/docs.feldera.com/docs/get-started/enterprise/authentication/index.mdx
index daa02feb41d..4353be7af59 100644
--- a/docs.feldera.com/docs/get-started/enterprise/authentication/index.mdx
+++ b/docs.feldera.com/docs/get-started/enterprise/authentication/index.mdx
@@ -226,6 +226,10 @@ authorization:
   # Role for an authenticated user with no explicit membership yet (default: "read")
   # Ship "write" when upgrading a pre-RBAC deployment; see the Roles page.
   defaultRole: "write"                  # Maps to: FELDERA_AUTH_DEFAULT_ROLE
+
+  # Role for the user whose login first creates a tenant (default: "admin")
+  # Set to "write"/"read" for a shared sandbox; see the Roles page.
+  firstUserRole: "admin"                # Maps to: FELDERA_AUTH_FIRST_USER_ROLE
 ```
 
 ### Environment Variables Reference
@@ -250,6 +254,7 @@ FELDERA_AUTH_AUTHORIZED_GROUPS=group1,group2 # comma-separated list
 FELDERA_AUTH_AUDIENCE=feldera-api            # default: feldera-api
 FELDERA_OWNERS=ops@example.com               # comma-separated; default: (none)
 FELDERA_AUTH_DEFAULT_ROLE=read               # read or write; default: read
+FELDERA_AUTH_FIRST_USER_ROLE=admin           # read, write, or admin; default: admin
 
 # AWS Cognito specific
 AWS_COGNITO_LOGIN_URL=https://...
diff --git a/docs.feldera.com/docs/get-started/enterprise/authentication/roles.md b/docs.feldera.com/docs/get-started/enterprise/authentication/roles.md
index baec33d098f..21a38fd42c8 100644
--- a/docs.feldera.com/docs/get-started/enterprise/authentication/roles.md
+++ b/docs.feldera.com/docs/get-started/enterprise/authentication/roles.md
@@ -33,9 +33,10 @@ can select the tenant it acts in with the `Feldera-Tenant` request header.
   are admitted at the configured default role (see [below](#default-role-and-owners))
   and a membership record is created.
 - When that first login also creates the tenant (auto-provisioning, because the
-  resolved tenant did not exist yet), the user becomes the tenant's `admin`
-  instead. A tenant an owner creates explicitly starts with no members, and the
-  first user to log into it is admitted at the default role.
+  resolved tenant did not exist yet), the user is granted the configured
+  first-user role, `admin` by default (see [below](#default-role-and-owners)). A
+  tenant an owner creates explicitly starts with no members, and the first user
+  to log into it is admitted at the default role.
 - An `admin` or `owner` can pre-provision members and change member roles from the
   Admin page in the web console, or through the
   [set-member-role API](/api/assign-member-role).
@@ -76,8 +77,8 @@ manage each tenant, from the Admin page or through the
 
 ## Default role and owners
 
-Two settings govern how much access an authenticated user has before an admin or
-owner assigns them a role.
+These settings govern how much access an authenticated user has before an admin
+or owner assigns them a role.
 
 `authorization.defaultRole` (environment: `FELDERA_AUTH_DEFAULT_ROLE`) is the role
 given to an authenticated user who has no explicit membership in the tenant they
@@ -88,6 +89,11 @@ The value is applied on the user's first login and recorded as their membership,
 so a later change to `defaultRole` does not re-grade a user who has already logged
 in. The Helm chart sets this to `write`.
 
+`authorization.firstUserRole` (environment: `FELDERA_AUTH_FIRST_USER_ROLE`) is the
+role granted to the user whose login first creates a tenant (auto-provisioning).
+It must be `read`, `write`, or `admin`, and defaults to `admin` so the creator can
+administer the tenant.
+
 `authorization.owners` (environment: `FELDERA_OWNERS`) lists the identities
 granted the platform-wide `owner` role, in the forms shown above. It is empty by
 default. At least one owner is needed to manage tenants across the installation

From dcd313c76acf2616e94c60b1a6fd3eb1ce0ad4fe Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Fri, 24 Jul 2026 16:29:51 -0700
Subject: [PATCH 12/55] [pipeline-manager] Drop unused role imports

The `#[schema(value_type = ...)]` overrides resolve MemberRole/MintableKeyRole by
their registered schema name, so the imports were never referenced and tripped
`-D warnings`. Removing them leaves openapi.json unchanged.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 crates/pipeline-manager/src/api/endpoints/tenant.rs | 2 +-
 crates/pipeline-manager/src/db/types/api_key.rs     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/crates/pipeline-manager/src/api/endpoints/tenant.rs b/crates/pipeline-manager/src/api/endpoints/tenant.rs
index 51c46ed259d..55802539b70 100644
--- a/crates/pipeline-manager/src/api/endpoints/tenant.rs
+++ b/crates/pipeline-manager/src/api/endpoints/tenant.rs
@@ -10,7 +10,7 @@ use crate::api::util::parse_url_parameter;
 use crate::auth::AuthenticatedPrincipal;
 use crate::db::error::DBError;
 use crate::db::storage::Storage;
-use crate::db::types::role::{MemberRole, Role};
+use crate::db::types::role::Role;
 use crate::db::types::tenant::TenantId;
 use crate::db::types::user::UserId;
 use crate::error::ManagerError;
diff --git a/crates/pipeline-manager/src/db/types/api_key.rs b/crates/pipeline-manager/src/db/types/api_key.rs
index 6bdbca3c31f..720d0a54b48 100644
--- a/crates/pipeline-manager/src/db/types/api_key.rs
+++ b/crates/pipeline-manager/src/db/types/api_key.rs
@@ -1,4 +1,4 @@
-use crate::db::types::role::{MintableKeyRole, Role};
+use crate::db::types::role::Role;
 use serde::{Deserialize, Serialize};
 use std::fmt;
 use std::fmt::Display;

From 4403e497535854ae721b577b741ad7cde7578b71 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Fri, 24 Jul 2026 16:29:51 -0700
Subject: [PATCH 13/55] [scripts] dummy_oidc: add --demo-tenants for
 multi-tenant demo users

Give the built-in tenanted demo users (reader/writer/admin) a configurable
tenants claim, defaulting to a single "acme". Pass e.g. --demo-tenants acme,beta
to place them in two tenants and exercise Feldera-Tenant header selection in the
web console. The owner demo user stays untenanted.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 scripts/dummy_oidc.py | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/scripts/dummy_oidc.py b/scripts/dummy_oidc.py
index 03ea262f667..34b4b062fb6 100755
--- a/scripts/dummy_oidc.py
+++ b/scripts/dummy_oidc.py
@@ -111,8 +111,12 @@ def __init__(self) -> None:
         }
 
 
-def make_handler(keys: KeyMaterial, issuer: str, default_audience: str):
-    """Build a request handler bound to one keypair and issuer."""
+def make_handler(keys: KeyMaterial, issuer: str, default_audience: str, demo_tenants: list[str]):
+    """Build a request handler bound to one keypair and issuer.
+
+    `demo_tenants` is the tenants claim given to the built-in tenanted demo users
+    (reader/writer/admin) on the login page; the owner demo user stays untenanted.
+    """
 
     # In-memory, single-process stores. Codes are single-use; refresh tokens map
     # to the claims needed to re-mint a token pair.
@@ -400,7 +404,9 @@ def one(name: str) -> str | None:
             auth_codes[code] = {
                 "sub": profile["sub"],
                 "email": profile["email"],
-                "tenants": profile.get("tenants"),
+                # Tenanted demo users get the configured demo tenants; the owner
+                # demo user (no tenants in ROLES) stays untenanted.
+                "tenants": demo_tenants if profile.get("tenants") else None,
                 "code_challenge": one("code_challenge"),
                 "code_challenge_method": one("code_challenge_method"),
                 "redirect_uri": redirect_uri,
@@ -598,11 +604,19 @@ def main() -> None:
         default="feldera-api",
         help="Audience put in the aud claim; must match FELDERA_AUTH_AUDIENCE",
     )
+    parser.add_argument(
+        "--demo-tenants",
+        default="acme",
+        help="Comma-separated tenants claim for the built-in tenanted demo users "
+        "(reader/writer/admin); default 'acme'. Use e.g. 'acme,beta' to place them "
+        "in two tenants and exercise multi-tenant selection.",
+    )
     args = parser.parse_args()
 
     issuer = args.issuer or f"http://localhost:{args.port}"
+    demo_tenants = [t.strip() for t in args.demo_tenants.split(",") if t.strip()]
     keys = KeyMaterial()
-    handler = make_handler(keys, issuer, args.audience)
+    handler = make_handler(keys, issuer, args.audience, demo_tenants)
     server = ThreadingHTTPServer(("0.0.0.0", args.port), handler)
 
     print_startup(issuer, args.audience, args.port)

From b50cfba954ac922f0d19e1e5908fded113eb928e Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Sat, 25 Jul 2026 23:00:04 -0700
Subject: [PATCH 14/55] [pipeline-manager] Merge the RBAC and OIDC trust
 migrations

The two migrations landed together and reference each other's columns, so keep
them as one unit. Also make the role columns varchar to match the surrounding
schema; in PostgreSQL a varchar without a length is the same type as text, and
the CHECK constraint already bounds the values.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 .../migrations/V35__oidc_trust.sql            | 34 ---------
 .../pipeline-manager/migrations/V35__rbac.sql | 69 +++++++++++++++++++
 .../pipeline-manager/migrations/V36__rbac.sql | 34 ---------
 3 files changed, 69 insertions(+), 68 deletions(-)
 delete mode 100644 crates/pipeline-manager/migrations/V35__oidc_trust.sql
 create mode 100644 crates/pipeline-manager/migrations/V35__rbac.sql
 delete mode 100644 crates/pipeline-manager/migrations/V36__rbac.sql

diff --git a/crates/pipeline-manager/migrations/V35__oidc_trust.sql b/crates/pipeline-manager/migrations/V35__oidc_trust.sql
deleted file mode 100644
index 297e5542c89..00000000000
--- a/crates/pipeline-manager/migrations/V35__oidc_trust.sql
+++ /dev/null
@@ -1,34 +0,0 @@
--- Trust relationships for OIDC workload identity federation.
---
--- A trust registers an issuer plus subject/audience match patterns; an incoming
--- JWT from that issuer whose claims satisfy the patterns is authorized with the
--- recorded role, like a signature-verified API key. `role` is the RBAC role
--- granted (see V36), capped at the creator's role at write time.
---
--- Scope follows the role. read/write/admin trusts are tenant-scoped: `tenant_id`
--- names the tenant they authorize into. An `owner` trust is platform-wide and
--- belongs to no tenant, so `tenant_id` is NULL; the acting tenant then comes
--- from the Feldera-Tenant header at request time. The CHECK makes the two
--- inseparable: tenant_id is NULL if and only if the role is owner.
-CREATE TABLE IF NOT EXISTS oidc_trust_relationship (
-    id uuid PRIMARY KEY,
-    tenant_id uuid,
-    name varchar NOT NULL,
-    description varchar,
-    issuer varchar NOT NULL,
-    subject varchar NOT NULL,
-    audience varchar,
-    role text NOT NULL DEFAULT 'read' CHECK (role IN ('read', 'write', 'admin', 'owner')),
-    CONSTRAINT oidc_trust_owner_is_platform CHECK ((tenant_id IS NULL) = (role = 'owner')),
-    CONSTRAINT unique_oidc_trust_name UNIQUE (tenant_id, name),
-    FOREIGN KEY (tenant_id) REFERENCES tenant(id) ON DELETE CASCADE
-);
-
--- unique_oidc_trust_name bounds tenant-scoped names per tenant, but a UNIQUE
--- constraint treats NULL tenant_ids as distinct and so does not bound owner
--- trusts. Name owner trusts uniquely across the platform with a partial index.
-CREATE UNIQUE INDEX IF NOT EXISTS idx_oidc_owner_trust_name
-    ON oidc_trust_relationship (name) WHERE tenant_id IS NULL;
-
--- The auth hot path resolves a federated token by its issuer, so index it.
-CREATE INDEX IF NOT EXISTS idx_oidc_trust_issuer ON oidc_trust_relationship (issuer);
diff --git a/crates/pipeline-manager/migrations/V35__rbac.sql b/crates/pipeline-manager/migrations/V35__rbac.sql
new file mode 100644
index 00000000000..47bf8c80a1a
--- /dev/null
+++ b/crates/pipeline-manager/migrations/V35__rbac.sql
@@ -0,0 +1,69 @@
+-- Role-based access control and OIDC workload-identity trust.
+--
+-- Adds the user concept and the per-(user, tenant) role link that the platform
+-- previously lacked (the only principal was the tenant). The released `api_key`
+-- table carried a `scopes text[]`; it is replaced with a single `role`.
+-- Roles: 'read' < 'write' < 'admin' (and 'owner', which is platform-wide and
+-- never stored in a membership; it is sourced from configuration or an owner
+-- OIDC trust relationship).
+
+CREATE TABLE IF NOT EXISTS app_user (
+    id       uuid PRIMARY KEY,
+    provider varchar NOT NULL,   -- OIDC issuer the subject was seen under
+    subject  varchar NOT NULL,   -- OIDC `sub`
+    email    varchar,            -- display only, may be null
+    CONSTRAINT unique_user_identity UNIQUE (provider, subject)
+);
+
+CREATE TABLE IF NOT EXISTS tenant_membership (
+    tenant_id uuid NOT NULL,
+    user_id   uuid NOT NULL,
+    role      varchar NOT NULL CHECK (role IN ('read', 'write', 'admin')),
+    PRIMARY KEY (tenant_id, user_id),
+    FOREIGN KEY (tenant_id) REFERENCES tenant(id)   ON DELETE CASCADE,
+    FOREIGN KEY (user_id)   REFERENCES app_user(id) ON DELETE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS idx_tenant_membership_user ON tenant_membership (user_id);
+
+-- Replace the released per-key `scopes text[]` with a single `role`.
+-- Existing keys were uniformly {read, write}; the backfill preserves their access.
+ALTER TABLE api_key ADD COLUMN role varchar NOT NULL DEFAULT 'read'
+    CHECK (role IN ('read', 'write'));
+UPDATE api_key SET role = CASE WHEN 'write' = ANY (scopes) THEN 'write' ELSE 'read' END;
+ALTER TABLE api_key DROP COLUMN scopes;
+
+-- Trust relationships for OIDC workload identity federation.
+--
+-- A trust registers an issuer plus subject/audience match patterns; an incoming
+-- JWT from that issuer whose claims satisfy the patterns is authorized with the
+-- recorded role, like a signature-verified API key. `role` is capped at the
+-- creator's role at write time.
+--
+-- Scope follows the role. read/write/admin trusts are tenant-scoped: `tenant_id`
+-- names the tenant they authorize into. An `owner` trust is platform-wide and
+-- belongs to no tenant, so `tenant_id` is NULL; the acting tenant then comes
+-- from the Feldera-Tenant header at request time. The CHECK makes the two
+-- inseparable: tenant_id is NULL if and only if the role is owner.
+CREATE TABLE IF NOT EXISTS oidc_trust_relationship (
+    id uuid PRIMARY KEY,
+    tenant_id uuid,
+    name varchar NOT NULL,
+    description varchar,
+    issuer varchar NOT NULL,
+    subject varchar NOT NULL,
+    audience varchar,
+    role varchar NOT NULL DEFAULT 'read' CHECK (role IN ('read', 'write', 'admin', 'owner')),
+    CONSTRAINT oidc_trust_owner_is_platform CHECK ((tenant_id IS NULL) = (role = 'owner')),
+    CONSTRAINT unique_oidc_trust_name UNIQUE (tenant_id, name),
+    FOREIGN KEY (tenant_id) REFERENCES tenant(id) ON DELETE CASCADE
+);
+
+-- unique_oidc_trust_name bounds tenant-scoped names per tenant, but a UNIQUE
+-- constraint treats NULL tenant_ids as distinct and so does not bound owner
+-- trusts. Name owner trusts uniquely across the platform with a partial index.
+CREATE UNIQUE INDEX IF NOT EXISTS idx_oidc_owner_trust_name
+    ON oidc_trust_relationship (name) WHERE tenant_id IS NULL;
+
+-- The auth hot path resolves a federated token by its issuer, so index it.
+CREATE INDEX IF NOT EXISTS idx_oidc_trust_issuer ON oidc_trust_relationship (issuer);
diff --git a/crates/pipeline-manager/migrations/V36__rbac.sql b/crates/pipeline-manager/migrations/V36__rbac.sql
deleted file mode 100644
index e2c79964676..00000000000
--- a/crates/pipeline-manager/migrations/V36__rbac.sql
+++ /dev/null
@@ -1,34 +0,0 @@
--- Role-based access control.
---
--- Adds the user concept and the per-(user, tenant) role link that the platform
--- previously lacked (the only principal was the tenant). The released `api_key`
--- table carried a `scopes text[]`; it is replaced with a single `role`.
--- Roles: 'read' < 'write' < 'admin' (and 'owner', which is platform-wide and
--- never stored in a membership; it is sourced from configuration or an owner
--- OIDC trust). The `oidc_trust_relationship` table (V35) already defines `role`.
-
-CREATE TABLE IF NOT EXISTS app_user (
-    id       uuid PRIMARY KEY,
-    provider varchar NOT NULL,   -- OIDC issuer the subject was seen under
-    subject  varchar NOT NULL,   -- OIDC `sub`
-    email    varchar,            -- display only, may be null
-    CONSTRAINT unique_user_identity UNIQUE (provider, subject)
-);
-
-CREATE TABLE IF NOT EXISTS tenant_membership (
-    tenant_id uuid NOT NULL,
-    user_id   uuid NOT NULL,
-    role      text NOT NULL CHECK (role IN ('read', 'write', 'admin')),
-    PRIMARY KEY (tenant_id, user_id),
-    FOREIGN KEY (tenant_id) REFERENCES tenant(id)   ON DELETE CASCADE,
-    FOREIGN KEY (user_id)   REFERENCES app_user(id) ON DELETE CASCADE
-);
-
-CREATE INDEX IF NOT EXISTS idx_tenant_membership_user ON tenant_membership (user_id);
-
--- Replace the released per-key `scopes text[]` with a single `role`.
--- Existing keys were uniformly {read, write}; the backfill preserves their access.
-ALTER TABLE api_key ADD COLUMN role text NOT NULL DEFAULT 'read'
-    CHECK (role IN ('read', 'write'));
-UPDATE api_key SET role = CASE WHEN 'write' = ANY (scopes) THEN 'write' ELSE 'read' END;
-ALTER TABLE api_key DROP COLUMN scopes;

From dc43e53e89a44ad97f0c71a86fb1fa82d1b58cf3 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Sat, 25 Jul 2026 23:00:16 -0700
Subject: [PATCH 15/55] [pipeline-manager] Address review feedback on the RBAC
 surface

Drop `SessionInfo.is_owner`: it was `role == owner`, so the console derives it.
Drop `AuthenticatedPrincipal.home_tenant`: it fed one audit line, and "home" is
ill-defined once a token carries several tenants. Rename the API-key mint error
to OwnerAdminNotMintableAsApiKey, matching the message it already printed.

Give every new endpoint an exhaustive `responses(...)` so generated clients see
the full error set. Constrain member roles to read/write/admin in the schema.
Say where `owner` is configured instead of only where it is not.

Replace three copies of a role-parsing helper with `From<InvalidRole> for
DBError`, so read paths use `Role::from_str(..)?`. Add `Role::is_owner`. Rewrite
`claim_matches` as an ordered scan over the `*`-separated literals, with a test
that literals cannot consume the same characters twice, and delete
`pattern_is_concrete`, dead since the breadth policy was dropped. Log an error
if a tenant name ever resolves to more than one tenant. Collapse the route
lookup into one function and document it, `authorize` and `match_oidc_trust`
with worked examples. Audit lines move to debug.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 .../src/api/endpoints/api_key.rs              |   6 +-
 .../src/api/endpoints/config.rs               |   6 +-
 .../src/api/endpoints/oidc_trust.rs           |  25 ++-
 .../src/api/endpoints/tenant.rs               |  31 ++-
 crates/pipeline-manager/src/api/main.rs       |   2 +-
 crates/pipeline-manager/src/api/rbac.rs       | 101 +++++-----
 crates/pipeline-manager/src/auth.rs           |  42 ++--
 crates/pipeline-manager/src/config.rs         |  13 +-
 crates/pipeline-manager/src/db/error.rs       |  18 +-
 .../src/db/operations/api_key.rs              |  14 +-
 .../src/db/operations/oidc_trust.rs           |  28 ++-
 .../src/db/operations/tenant.rs               |  36 ++--
 .../src/db/operations/user.rs                 |  15 +-
 crates/pipeline-manager/src/db/storage.rs     |  12 +-
 .../src/db/types/oidc_trust.rs                |  86 ++++-----
 crates/pipeline-manager/src/db/types/role.rs  |   6 +
 openapi.json                                  | 181 ++++++++++++++++--
 17 files changed, 416 insertions(+), 206 deletions(-)

diff --git a/crates/pipeline-manager/src/api/endpoints/api_key.rs b/crates/pipeline-manager/src/api/endpoints/api_key.rs
index dfb15ce8b2e..3f09a02766e 100644
--- a/crates/pipeline-manager/src/api/endpoints/api_key.rs
+++ b/crates/pipeline-manager/src/api/endpoints/api_key.rs
@@ -137,8 +137,7 @@ pub(crate) async fn post_api_key(
     principal: ReqData<AuthenticatedPrincipal>,
     req: web::Json<NewApiKeyRequest>,
 ) -> Result<HttpResponse, ManagerError> {
-    // Mint cap: the key's role may not exceed the caller's role, and `admin`/
-    // `owner` are never issuable as a static key.
+    // Mint cap: the key's role may not exceed the caller's role.
     let requested = req.role.unwrap_or(Role::Read);
     if requested > principal.role {
         return Err(DBError::RoleExceedsCreator {
@@ -147,7 +146,8 @@ pub(crate) async fn post_api_key(
         }
         .into());
     }
-    let role = MintableKeyRole::from_role(requested).ok_or(DBError::OwnerNotMintableAsApiKey)?;
+    let role =
+        MintableKeyRole::from_role(requested).ok_or(DBError::OwnerAdminNotMintableAsApiKey)?;
 
     let new_id = Uuid::now_v7();
     let generated_api_key = crate::auth::generate_api_key();
diff --git a/crates/pipeline-manager/src/api/endpoints/config.rs b/crates/pipeline-manager/src/api/endpoints/config.rs
index 693961bd48e..b1876571a4d 100644
--- a/crates/pipeline-manager/src/api/endpoints/config.rs
+++ b/crates/pipeline-manager/src/api/endpoints/config.rs
@@ -227,10 +227,9 @@ pub(crate) struct SessionInfo {
     /// Current user's tenant name
     pub tenant_name: String,
     /// The caller's effective role in the acting tenant. The web console uses
-    /// this to gate the admin UI (no role claim lives in the JWT).
+    /// this to gate the admin UI (no role claim lives in the JWT). A platform
+    /// owner reports `owner` here.
     pub role: Role,
-    /// Whether the caller is a platform owner.
-    pub is_owner: bool,
 }
 
 impl SessionInfo {
@@ -244,7 +243,6 @@ impl SessionInfo {
             tenant_id,
             tenant_name,
             role,
-            is_owner: role == Role::Owner,
         })
     }
 }
diff --git a/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs b/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
index 039546484fc..a87a84223da 100644
--- a/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
+++ b/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
@@ -29,9 +29,8 @@ use uuid::Uuid;
 /// Selects which trusts an operation targets.
 #[derive(Debug, Default, Deserialize, IntoParams)]
 pub(crate) struct TrustScope {
-    /// Select platform-wide owner trusts (which belong to no tenant) instead of
-    /// the caller's tenant, rather than the trusts scoped to the caller's tenant.
-    /// Owner-only.
+    /// Select the platform-wide owner trusts, which belong to no tenant,
+    /// instead of the trusts scoped to the caller's tenant. Owner-only.
     #[serde(default)]
     platform: bool,
 }
@@ -80,7 +79,7 @@ pub(crate) struct NewOidcTrustRequest {
 
     /// Optional audience claim pattern. `*` matches any sequence of characters.
     /// If omitted, the audience claim is not checked.
-    #[schema(example = "feldera")]
+    #[schema(example = "https://github.com/my-org")]
     #[serde(default)]
     pub audience: Option<String>,
 
@@ -106,6 +105,7 @@ pub(crate) struct NewOidcTrustResponse {
     params(TrustScope),
     responses(
         (status = OK, description = "Trust relationships retrieved", body = [OidcTrustDescr]),
+        (status = FORBIDDEN, description = "Caller's role is below the required role, or `platform` was set by a non-owner", body = ErrorResponse),
         (status = INTERNAL_SERVER_ERROR, body = ErrorResponse)
     ),
     tag = "Platform"
@@ -131,7 +131,9 @@ pub(crate) async fn list_oidc_trust(
     params(("name" = String, Path, description = "Trust relationship name"), TrustScope),
     responses(
         (status = OK, description = "Trust relationship retrieved", body = OidcTrustDescr),
-        (status = NOT_FOUND, description = "No relationship with that name", body = ErrorResponse)
+        (status = FORBIDDEN, description = "Caller's role is below the required role, or `platform` was set by a non-owner", body = ErrorResponse),
+        (status = NOT_FOUND, description = "No relationship with that name", body = ErrorResponse),
+        (status = INTERNAL_SERVER_ERROR, body = ErrorResponse)
     ),
     tag = "Platform"
 )]
@@ -158,8 +160,10 @@ pub(crate) async fn get_oidc_trust(
     request_body = NewOidcTrustRequest,
     responses(
         (status = CREATED, description = "Trust relationship created", body = NewOidcTrustResponse),
+        (status = BAD_REQUEST, description = "A required field is empty", body = ErrorResponse),
+        (status = FORBIDDEN, description = "Caller's role is below the required role, or the requested role exceeds the caller's own", body = ErrorResponse),
         (status = CONFLICT, description = "Name already in use", body = ErrorResponse),
-        (status = BAD_REQUEST, description = "Invalid request", body = ErrorResponse),
+        (status = INTERNAL_SERVER_ERROR, body = ErrorResponse)
     ),
     tag = "Platform"
 )]
@@ -185,9 +189,8 @@ pub(crate) async fn post_oidc_trust(
     }
 
     // Scope follows the role: an owner trust is platform-wide (no tenant), any
-    // other role is scoped to the acting tenant. `subject`/`audience` carry no
-    // breadth restriction; `audience`, if set, is only an extra match filter and
-    // tenant selection at auth time comes from the Feldera-Tenant header.
+    // other role is scoped to the acting tenant. Tenant selection at auth time
+    // comes from the Feldera-Tenant header.
     let scope = if requested == Role::Owner {
         None
     } else {
@@ -228,7 +231,9 @@ pub(crate) async fn post_oidc_trust(
     params(("name" = String, Path, description = "Trust relationship name"), TrustScope),
     responses(
         (status = OK, description = "Trust relationship deleted"),
-        (status = NOT_FOUND, description = "No relationship with that name", body = ErrorResponse)
+        (status = FORBIDDEN, description = "Caller's role is below the required role, or `platform` was set by a non-owner", body = ErrorResponse),
+        (status = NOT_FOUND, description = "No relationship with that name", body = ErrorResponse),
+        (status = INTERNAL_SERVER_ERROR, body = ErrorResponse)
     ),
     tag = "Platform"
 )]
diff --git a/crates/pipeline-manager/src/api/endpoints/tenant.rs b/crates/pipeline-manager/src/api/endpoints/tenant.rs
index 55802539b70..e1550d1f20d 100644
--- a/crates/pipeline-manager/src/api/endpoints/tenant.rs
+++ b/crates/pipeline-manager/src/api/endpoints/tenant.rs
@@ -29,8 +29,10 @@ use uuid::Uuid;
 /// Request to assign a role to a user within a tenant.
 #[derive(Debug, Deserialize, ToSchema)]
 pub(crate) struct SetMemberRoleRequest {
-    /// The role to assign. Must be `read`, `write`, or `admin`; capped at the
-    /// caller's own role. `owner` is never assignable here.
+    /// The role to assign: `read`, `write`, or `admin`. `owner` is platform-wide
+    /// rather than a tenant membership, so it is configured at deploy time
+    /// (Helm `authorization.owners` / `FELDERA_OWNERS`) or granted by an owner
+    /// OIDC trust relationship, never assigned through this endpoint.
     #[schema(value_type = MemberRole)]
     pub role: Role,
 }
@@ -47,8 +49,10 @@ pub(crate) struct AddMemberRequest {
     /// Optional email for display in the member list.
     #[serde(default)]
     pub email: Option<String>,
-    /// Role to grant. Must be `read`, `write`, or `admin`; capped at the
-    /// caller's own role. `owner` is never assignable here.
+    /// Role to grant: `read`, `write`, or `admin`. `owner` is platform-wide
+    /// rather than a tenant membership, so it is configured at deploy time
+    /// (Helm `authorization.owners` / `FELDERA_OWNERS`) or granted by an owner
+    /// OIDC trust relationship, never assigned through this endpoint.
     #[schema(value_type = MemberRole)]
     pub role: Role,
 }
@@ -59,8 +63,10 @@ pub(crate) struct AddMemberResponse {
     pub user_id: UserId,
 }
 
-/// Reject a requested role an admin may not grant: `owner` is platform-wide and
-/// never a tenant membership, and no one may grant above their own role.
+/// Reject a requested role the caller may not grant: `owner` is platform-wide
+/// and never a tenant membership. The second check, that no one grants above
+/// their own role, cannot fire while these routes require `admin` (the highest
+/// grantable role); it is kept so lowering the route's minimum role stays safe.
 fn check_grantable_role(requested: Role, caller: Role) -> Result<(), ManagerError> {
     if requested == Role::Owner {
         return Err(DBError::OwnerRoleNotAssignable.into());
@@ -100,6 +106,7 @@ fn parse_user_id(req: &HttpRequest) -> Result<UserId, ManagerError> {
     security(("JSON web token (JWT) or API key" = [])),
     responses(
         (status = OK, description = "Members retrieved", body = [TenantMember]),
+        (status = FORBIDDEN, description = "Caller's role is below the required role", body = ErrorResponse),
         (status = INTERNAL_SERVER_ERROR, body = ErrorResponse)
     ),
     tag = "Platform"
@@ -131,7 +138,9 @@ pub(crate) async fn list_tenant_users(
     request_body = SetMemberRoleRequest,
     responses(
         (status = OK, description = "Role assigned"),
-        (status = FORBIDDEN, description = "Requested role exceeds caller's role or is owner", body = ErrorResponse),
+        (status = FORBIDDEN, description = "Caller's role is below the required role, or the requested role is `owner`", body = ErrorResponse),
+        (status = NOT_FOUND, description = "No user with that identifier", body = ErrorResponse),
+        (status = INTERNAL_SERVER_ERROR, body = ErrorResponse)
     ),
     tag = "Platform"
 )]
@@ -171,7 +180,9 @@ pub(crate) async fn put_tenant_user(
     params(("user_id" = Uuid, Path, description = "User identifier")),
     responses(
         (status = OK, description = "Member removed"),
+        (status = FORBIDDEN, description = "Caller's role is below the required role", body = ErrorResponse),
         (status = NOT_FOUND, description = "User is not a member", body = ErrorResponse),
+        (status = INTERNAL_SERVER_ERROR, body = ErrorResponse)
     ),
     tag = "Platform"
 )]
@@ -204,7 +215,8 @@ pub(crate) async fn delete_tenant_user(
     request_body = AddMemberRequest,
     responses(
         (status = OK, description = "Member added", body = AddMemberResponse),
-        (status = FORBIDDEN, description = "Requested role exceeds caller's role or is owner", body = ErrorResponse),
+        (status = FORBIDDEN, description = "Caller's role is below the required role, or the requested role is `owner`", body = ErrorResponse),
+        (status = INTERNAL_SERVER_ERROR, body = ErrorResponse)
     ),
     tag = "Platform"
 )]
@@ -263,6 +275,7 @@ pub(crate) struct NewTenantResponse {
     security(("JSON web token (JWT) or API key" = [])),
     responses(
         (status = OK, description = "Tenants retrieved", body = [TenantInfo]),
+        (status = FORBIDDEN, description = "Caller is not a platform owner", body = ErrorResponse),
         (status = INTERNAL_SERVER_ERROR, body = ErrorResponse)
     ),
     tag = "Platform"
@@ -290,7 +303,9 @@ pub(crate) async fn list_tenants(
     request_body = NewTenantRequest,
     responses(
         (status = CREATED, description = "Tenant created", body = NewTenantResponse),
+        (status = FORBIDDEN, description = "Caller is not a platform owner", body = ErrorResponse),
         (status = CONFLICT, description = "A tenant with that name already exists", body = ErrorResponse),
+        (status = INTERNAL_SERVER_ERROR, body = ErrorResponse)
     ),
     tag = "Platform"
 )]
diff --git a/crates/pipeline-manager/src/api/main.rs b/crates/pipeline-manager/src/api/main.rs
index 2a153843ce1..65e18945a7c 100644
--- a/crates/pipeline-manager/src/api/main.rs
+++ b/crates/pipeline-manager/src/api/main.rs
@@ -825,7 +825,7 @@ impl Modify for MinRoleAddon {
                 };
                 let note = match rule {
                     // `owner` is the highest role, so "or higher" would be misleading.
-                    Some(role) if role == crate::db::types::role::Role::Owner => {
+                    Some(crate::db::types::role::Role::Owner) => {
                         "Required role: `owner`.".to_string()
                     }
                     Some(role) => format!("Required role: `{role}` or higher."),
diff --git a/crates/pipeline-manager/src/api/rbac.rs b/crates/pipeline-manager/src/api/rbac.rs
index 750c0955c11..f0614ab8271 100644
--- a/crates/pipeline-manager/src/api/rbac.rs
+++ b/crates/pipeline-manager/src/api/rbac.rs
@@ -4,8 +4,8 @@
 //! [`AuthenticatedPrincipal`] that `auth_validator` installed and compares its
 //! role against the minimum role declared for the matched route. The
 //! [`ROUTE_MIN_ROLE`] table below is the single source of truth for the
-//! access-control model of RFC #6422. Enforcement is deny-by-default: a route
-//! that is reached but absent from the table is refused (fail closed), so a
+//! access-control model. Enforcement is deny-by-default: a route that is
+//! reached but absent from the table is refused, so a
 //! newly added endpoint cannot ship silently world-accessible. The
 //! `every_registered_v0_route_is_classified` test enforces that every route
 //! actually registered gets an entry.
@@ -20,7 +20,7 @@ use actix_web::middleware::Next;
 use actix_web::{HttpMessage, HttpResponse, ResponseError};
 use std::collections::HashMap;
 use std::sync::OnceLock;
-use tracing::{debug, error, info};
+use tracing::{debug, error};
 
 /// Minimum role required to reach each `/v0` route. `None` means the route is
 /// reachable by any authenticated principal (no role floor). A `(method, path)`
@@ -94,7 +94,7 @@ static ROUTE_MIN_ROLE: &[(&str, &str, Option<Role>)] = &[
     ("POST", "/v0/validate_program", Some(Role::Read)), // post_validate_program (compile-only, no data/state change)
     ("POST", "/v0/pipelines/{pipeline_name}/views/{view_name}/connectors/{connector_name}/command", Some(Role::Write)), // post_pipeline_output_connector_command
     ("GET", "/v0/pipelines/{pipeline_name}/views/{view_name}/connectors/{connector_name}/stats", Some(Role::Read)), // get_pipeline_output_connector_status
-    // --- RBAC tenant/user management (new) ---
+    // RBAC tenant/user management
     ("GET", "/v0/tenant/users", Some(Role::Admin)), // list_tenant_users
     ("POST", "/v0/tenant/users", Some(Role::Admin)), // add_tenant_user (pre-provision)
     ("PUT", "/v0/tenant/users/{user_id}", Some(Role::Admin)), // put_tenant_user
@@ -103,7 +103,9 @@ static ROUTE_MIN_ROLE: &[(&str, &str, Option<Role>)] = &[
     ("POST", "/v0/tenants", Some(Role::Owner)), // create_tenant
 ];
 
-/// Build the lookup map once (the table is static and small).
+/// [`ROUTE_MIN_ROLE`] indexed by `(method, path)`, built once on first use. The
+/// table is the authoring format; this map is the form the auth hot path needs,
+/// turning a per-request scan into a hash lookup.
 fn route_table() -> &'static HashMap<(&'static str, &'static str), Option<Role>> {
     static TABLE: OnceLock<HashMap<(&'static str, &'static str), Option<Role>>> = OnceLock::new();
     TABLE.get_or_init(|| {
@@ -114,22 +116,26 @@ fn route_table() -> &'static HashMap<(&'static str, &'static str), Option<Role>>
     })
 }
 
-/// Look up the access rule for a matched route.
-/// `None` => route unknown (deny). `Some(None)` => any authenticated principal.
-/// `Some(Some(role))` => requires at least `role`.
-fn lookup(method: &str, pattern: &str) -> Option<Option<Role>> {
+/// The access rule for a route, used both by the middleware below and by the
+/// OpenAPI annotation that documents each endpoint's minimum role, so the API
+/// reference cannot drift from the enforced policy.
+///
+/// ```text
+/// min_role_for("POST", "/v0/pipelines")            => Some(Some(Role::Write))
+/// min_role_for("GET",  "/v0/pipelines")            => Some(Some(Role::Read))
+/// min_role_for("POST", "/v0/tenants")              => Some(Some(Role::Owner))
+/// min_role_for("GET",  "/v0/not-a-route")          => None   // unknown: denied
+/// ```
+///
+/// `None` means the route is not in the table and is denied; `Some(None)` means
+/// any authenticated principal may proceed; `Some(Some(role))` requires at least
+/// `role`.
+pub(crate) fn min_role_for(method: &str, pattern: &str) -> Option<Option<Role>> {
     route_table().get(&(method, pattern)).copied()
 }
 
-/// Minimum role required to reach `(method, path)`, for OpenAPI annotation.
-/// `None` => not a gated route; `Some(None)` => any authenticated principal;
-/// `Some(Some(role))` => requires at least `role`. Reads the same table the
-/// middleware enforces, so the API reference cannot drift from the policy.
-pub(crate) fn min_role_for(method: &str, path: &str) -> Option<Option<Role>> {
-    lookup(method, path)
-}
-
-/// Build the 403 body in the same shape as the rest of the API.
+/// A 403 in the same JSON shape the rest of the API returns, so clients can
+/// parse a permission denial the same way whether it came from here or a handler.
 fn forbidden(message: &str) -> HttpResponse<BoxBody> {
     HttpResponse::Forbidden().json(serde_json::json!({
         "message": message,
@@ -138,20 +144,33 @@ fn forbidden(message: &str) -> HttpResponse<BoxBody> {
 }
 
 /// Decide whether the principal may proceed. `Ok(())` allows; `Err(resp)` is the
-/// 403 to return.
+/// 403 to return. `pattern` is the matched route template, not the request path.
+///
+/// ```text
+/// // a writer posting a pipeline
+/// authorize("POST", Some("/v0/pipelines"), Some(&writer))  => Ok(())
+/// // a reader posting a pipeline
+/// authorize("POST", Some("/v0/pipelines"), Some(&reader))  => Err(403)
+/// // an admin listing tenants, which is owner-only
+/// authorize("GET",  Some("/v0/tenants"),   Some(&admin))   => Err(403)
+/// // no route matched, so this is a 404 for actix to answer, not a denial
+/// authorize("GET",  None,                  Some(&reader))  => Ok(())
+/// ```
 fn authorize(
     method: &str,
     pattern: Option<&str>,
     principal: Option<&AuthenticatedPrincipal>,
 ) -> Result<(), HttpResponse<BoxBody>> {
-    // No matched route: let actix produce its normal 404. RBAC only guards
-    // routes that exist.
+    // No route matched, so there is nothing to guard. Passing it through lets
+    // actix answer 404; denying here would report a missing route as a
+    // permission error.
     let Some(pattern) = pattern else {
         return Ok(());
     };
-    match lookup(method, pattern) {
+    match min_role_for(method, pattern) {
         None => {
-            // Registered route with no classification: fail closed.
+            // A registered route with no table entry is a bug: deny it rather
+            // than serve it unguarded.
             error!("RBAC: route {method} {pattern} has no access-control entry; denying");
             Err(forbidden(
                 "This endpoint has no access-control classification and is denied",
@@ -173,28 +192,14 @@ fn authorize(
     }
 }
 
-/// Emit an audit line for an authorized request. Mutations and any owner action
-/// are logged at info; reads at debug, to keep the happy path quiet.
+/// Record who reached which route, in which tenant, at what role. `role=owner`
+/// identifies a platform owner acting in a tenant it may not belong to.
 fn audit(method: &Method, pattern: &str, principal: Option<&AuthenticatedPrincipal>) {
     let Some(p) = principal else { return };
-    // Make an owner acting outside its home tenant explicit in the log.
-    let tenant = if p.home_tenant != p.acting_tenant {
-        format!("{} (home={})", p.acting_tenant, p.home_tenant)
-    } else {
-        p.acting_tenant.to_string()
-    };
-    let is_owner = p.role == Role::Owner;
-    if method != Method::GET || is_owner {
-        info!(
-            "audit: user='{}' tenant={} role={} {} {}",
-            p.label, tenant, p.role, method, pattern
-        );
-    } else {
-        debug!(
-            "audit: user='{}' tenant={} role={} {} {}",
-            p.label, tenant, p.role, method, pattern
-        );
-    }
+    debug!(
+        "audit: user='{}' tenant={} role={} {} {}",
+        p.label, p.acting_tenant, p.role, method, pattern
+    );
 }
 
 /// RBAC enforcement middleware for the authenticated `/v0` scope. Runs after
@@ -287,7 +292,11 @@ mod test {
     #[test]
     fn security_critical_routes_have_expected_minimums() {
         let expect = |method, pattern, role| {
-            assert_eq!(lookup(method, pattern), Some(role), "{method} {pattern}");
+            assert_eq!(
+                min_role_for(method, pattern),
+                Some(role),
+                "{method} {pattern}"
+            );
         };
         // Data plane and mutations require write; read must never reach them.
         expect("POST", "/v0/pipelines", Some(Role::Write));
@@ -470,9 +479,7 @@ mod test {
     /// `api_scope()`, save the explicit `REGISTERED_BUT_UNDOCUMENTED` set) and
     /// fail the build if any route lacks a `ROUTE_MIN_ROLE` entry. A new endpoint
     /// added without a classification breaks this test rather than silently
-    /// shipping 403 (which is how the `diff`/`validate_program`/
-    /// `checkpoints/remote` routes slipped through a hand-maintained count).
-    /// Enforces RFC I6.
+    /// shipping 403.
     #[test]
     fn every_registered_v0_route_is_classified() {
         let table: std::collections::HashSet<(&str, &str)> =
diff --git a/crates/pipeline-manager/src/auth.rs b/crates/pipeline-manager/src/auth.rs
index e213487b3b4..0aacb8af77a 100644
--- a/crates/pipeline-manager/src/auth.rs
+++ b/crates/pipeline-manager/src/auth.rs
@@ -90,12 +90,10 @@ use crate::db::types::tenant::TenantId;
 /// with existing `ReqData<TenantId>` extractors).
 #[derive(Clone, Debug)]
 pub(crate) struct AuthenticatedPrincipal {
-    /// The tenant the request operates in. Equals `home_tenant` for everyone
-    /// but an `owner` selecting another tenant via `Feldera-Tenant`.
+    /// The tenant the request operates in: the one the principal's claims
+    /// resolve to, or the one a `Feldera-Tenant` header selected among those it
+    /// is authorized for.
     pub acting_tenant: TenantId,
-    /// The tenant the principal belongs to. Differs from `acting_tenant` only
-    /// for an `owner` selecting another tenant; the audit log flags that case.
-    pub home_tenant: TenantId,
     /// The principal's effective role in the acting tenant.
     pub role: Role,
     /// Human-readable identity for audit logging (email, sub, or "apikey:<name>").
@@ -113,7 +111,6 @@ impl AuthenticatedPrincipal {
     pub(crate) fn for_test(role: Role) -> Self {
         Self {
             acting_tenant: DEFAULT_TENANT_ID,
-            home_tenant: DEFAULT_TENANT_ID,
             role,
             label: "test".to_string(),
         }
@@ -150,7 +147,6 @@ fn is_configured_owner(
 pub(crate) fn tag_with_default_tenant_id(req: ServiceRequest) -> ServiceRequest {
     AuthenticatedPrincipal {
         acting_tenant: DEFAULT_TENANT_ID,
-        home_tenant: DEFAULT_TENANT_ID,
         role: Role::Admin,
         label: "default".to_string(),
     }
@@ -319,13 +315,11 @@ async fn oidc_trust_auth(
     let state = req.app_data::<Data<ServerState>>().unwrap().clone();
 
     // SSRF/DoS gate: only fetch discovery/JWKS for an issuer that at least one
-    // trust relationship names. An unregistered issuer is rejected here, before
-    // any outbound request, so an unauthenticated caller cannot make the manager
-    // fetch an arbitrary URL or amplify one request into repeated fetches.
+    // trust relationship names.
     match state.db.lock().await.is_trusted_issuer(&iss).await {
         Ok(true) => {}
         Ok(false) => {
-            debug!("Federated token from unregistered issuer '{iss}' rejected before any fetch");
+            debug!("Federated token from unregistered issuer '{iss}' rejected");
             return unauthorized(
                 "No OIDC trust relationship matches this token".to_string(),
                 req,
@@ -421,7 +415,6 @@ async fn oidc_trust_auth(
         };
         AuthenticatedPrincipal {
             acting_tenant: acting,
-            home_tenant: acting,
             role: Role::Owner,
             label,
         }
@@ -430,12 +423,12 @@ async fn oidc_trust_auth(
     }
 
     // Tenant-scoped matches (each carries a tenant). One is unambiguous; several
-    // require the Feldera-Tenant header to name one of them (fail closed).
+    // require the Feldera-Tenant header to name one of them.
     let tenant_matches: Vec<(TenantId, Role)> = matches
         .into_iter()
         .filter_map(|(t, r)| t.map(|t| (t, r)))
         .collect();
-    let (home_tenant, role) = if tenant_matches.len() == 1 {
+    let (acting_tenant, role) = if tenant_matches.len() == 1 {
         tenant_matches[0]
     } else {
         let Some(selector) = header_tenant(&req) else {
@@ -457,8 +450,7 @@ async fn oidc_trust_auth(
         }
     };
     AuthenticatedPrincipal {
-        acting_tenant: home_tenant,
-        home_tenant,
+        acting_tenant,
         role,
         label,
     }
@@ -466,11 +458,16 @@ async fn oidc_trust_auth(
     Ok(req)
 }
 
-/// Resolve the tenant an `owner` acts in. The `Feldera-Tenant` header selects
-/// any existing tenant by UUID or name (strict lookup, never created); a miss is
-/// a 404, so a typo cannot silently create or cross into the wrong tenant.
-/// Without the header the owner acts in its home tenant. This widening is gated
-/// on `role == Owner` by the callers; lower roles never reach here.
+/// Resolve the tenant an `owner` acts in. Every principal type selects its
+/// acting tenant with the `Feldera-Tenant` header, but each validates the
+/// selection against its own authorization set: a human login against the
+/// `tenants` claim, a federated token against the trusts that matched it. An
+/// owner's set is every tenant, so this path resolves the selector without such
+/// a filter, which is why it is gated on `role == Owner` by the callers.
+///
+/// The selector is looked up strictly by UUID or name and never creates a
+/// tenant; a miss is a 404, so a typo cannot cross into the wrong tenant.
+/// Without the header the owner acts in the tenant its own claims resolved to.
 async fn resolve_owner_acting_tenant(
     db: &StoragePostgres,
     headers: &actix_web::http::header::HeaderMap,
@@ -560,7 +557,6 @@ async fn bearer_auth(
                 };
                 AuthenticatedPrincipal {
                     acting_tenant,
-                    home_tenant: home,
                     role: Role::Owner,
                     label,
                 }
@@ -598,7 +594,6 @@ async fn bearer_auth(
                 Ok((tenant_id, _user_id, role)) => {
                     AuthenticatedPrincipal {
                         acting_tenant: tenant_id,
-                        home_tenant: tenant_id,
                         role,
                         label,
                     }
@@ -653,7 +648,6 @@ async fn api_key_auth(
         Ok((tenant_id, role)) => {
             AuthenticatedPrincipal {
                 acting_tenant: tenant_id,
-                home_tenant: tenant_id,
                 role,
                 label: "apikey".to_string(),
             }
diff --git a/crates/pipeline-manager/src/config.rs b/crates/pipeline-manager/src/config.rs
index 850627a5407..611bac242af 100644
--- a/crates/pipeline-manager/src/config.rs
+++ b/crates/pipeline-manager/src/config.rs
@@ -978,10 +978,15 @@ pub struct ApiServerConfig {
     #[arg(long, default_value = "feldera-api", env = "FELDERA_AUTH_AUDIENCE")]
     pub auth_audience: String,
 
-    /// Identities granted the platform-wide `owner` role. Each entry matches an
-    /// access token's email, its OIDC subject, or the provider-qualified
-    /// `"<issuer> <subject>"` form. Comma-separated.
-    /// Example: "ops@acme.com,platform-admins"
+    /// Identities granted the platform-wide `owner` role, comma-separated. Each
+    /// entry matches an access token in one of three forms:
+    ///
+    ///   - a provider-verified email:      "ops@acme.com"
+    ///   - a bare OIDC subject (`sub`):    "a1b2c3d4-5e6f-7890-abcd-ef1234567890"
+    ///   - a provider-qualified subject:   "https://accounts.google.com 1234567890"
+    ///
+    /// An email matches only when the provider marks it verified, so prefer the
+    /// subject forms, which are stable and not user-settable.
     #[serde(default)]
     #[arg(long, value_delimiter = ',', env = "FELDERA_OWNERS")]
     pub owners: Vec<String>,
diff --git a/crates/pipeline-manager/src/db/error.rs b/crates/pipeline-manager/src/db/error.rs
index 12578303d31..2c68028f938 100644
--- a/crates/pipeline-manager/src/db/error.rs
+++ b/crates/pipeline-manager/src/db/error.rs
@@ -3,7 +3,7 @@ use crate::db::types::monitor::{ClusterMonitorEventId, PipelineMonitorEventId};
 use crate::db::types::pipeline::PipelineId;
 use crate::db::types::program::ProgramStatus;
 use crate::db::types::resources_status::{ResourcesDesiredStatus, ResourcesStatus};
-use crate::db::types::role::Role;
+use crate::db::types::role::{InvalidRole, Role};
 use crate::db::types::storage::StorageStatus;
 use crate::db::types::tenant::TenantId;
 use crate::db::types::utils::ValidationError;
@@ -176,7 +176,7 @@ pub enum DBError {
         requested: Role,
         creator: Role,
     },
-    OwnerNotMintableAsApiKey,
+    OwnerAdminNotMintableAsApiKey,
     OwnerRoleNotAssignable,
     InvalidRoleString {
         value: String,
@@ -456,6 +456,14 @@ impl From<PoolError> for DBError {
     }
 }
 
+/// Lets a read path parse a stored role with `Role::from_str(..)?` instead of
+/// hand-mapping the error at every call site.
+impl From<InvalidRole> for DBError {
+    fn from(error: InvalidRole) -> Self {
+        Self::InvalidRoleString { value: error.0 }
+    }
+}
+
 impl From<RefineryError> for DBError {
     fn from(error: RefineryError) -> Self {
         Self::PostgresMigrationError {
@@ -635,7 +643,7 @@ impl Display for DBError {
                     "Cannot grant the '{requested}' role: it exceeds the creator's own '{creator}' role"
                 )
             }
-            DBError::OwnerNotMintableAsApiKey => {
+            DBError::OwnerAdminNotMintableAsApiKey => {
                 write!(
                     f,
                     "The 'owner' and 'admin' roles cannot be issued as an API key; use an OIDC trust relationship or interactive login"
@@ -982,7 +990,7 @@ impl DetailedError for DBError {
             Self::InvalidApiKey => Cow::from("InvalidApiKey"),
             Self::InsufficientPermissions { .. } => Cow::from("InsufficientPermissions"),
             Self::RoleExceedsCreator { .. } => Cow::from("RoleExceedsCreator"),
-            Self::OwnerNotMintableAsApiKey => Cow::from("OwnerNotMintableAsApiKey"),
+            Self::OwnerAdminNotMintableAsApiKey => Cow::from("OwnerAdminNotMintableAsApiKey"),
             Self::OwnerRoleNotAssignable => Cow::from("OwnerRoleNotAssignable"),
             Self::InvalidRoleString { .. } => Cow::from("InvalidRoleString"),
             Self::UnknownUser { .. } => Cow::from("UnknownUser"),
@@ -1109,7 +1117,7 @@ impl ResponseError for DBError {
             Self::InvalidApiKey => StatusCode::UNAUTHORIZED,
             Self::InsufficientPermissions { .. } => StatusCode::FORBIDDEN,
             Self::RoleExceedsCreator { .. } => StatusCode::FORBIDDEN,
-            Self::OwnerNotMintableAsApiKey => StatusCode::FORBIDDEN,
+            Self::OwnerAdminNotMintableAsApiKey => StatusCode::FORBIDDEN,
             Self::OwnerRoleNotAssignable => StatusCode::FORBIDDEN,
             Self::InvalidRoleString { .. } => StatusCode::INTERNAL_SERVER_ERROR,
             Self::UnknownUser { .. } => StatusCode::NOT_FOUND,
diff --git a/crates/pipeline-manager/src/db/operations/api_key.rs b/crates/pipeline-manager/src/db/operations/api_key.rs
index 2409b40b412..b82a846eea8 100644
--- a/crates/pipeline-manager/src/db/operations/api_key.rs
+++ b/crates/pipeline-manager/src/db/operations/api_key.rs
@@ -11,14 +11,6 @@ use openssl::sha;
 use std::str::FromStr;
 use uuid::Uuid;
 
-/// Parse a role string read from the DB, turning an unexpected value into a
-/// request error rather than a panic (this runs on the auth path).
-fn parse_role(s: &str) -> Result<Role, DBError> {
-    Role::from_str(s).map_err(|_| DBError::InvalidRoleString {
-        value: s.to_string(),
-    })
-}
-
 pub async fn list_api_keys(
     txn: &Transaction<'_>,
     tenant_id: TenantId,
@@ -31,7 +23,7 @@ pub async fn list_api_keys(
     for row in rows {
         let id: ApiKeyId = ApiKeyId(row.get(0));
         let name: String = row.get(1);
-        let role = parse_role(&row.get::<_, String>(2))?;
+        let role = Role::from_str(&row.get::<_, String>(2))?;
         result.push(ApiKeyDescr { id, name, role });
     }
     Ok(result)
@@ -49,7 +41,7 @@ pub async fn get_api_key(
     if let Some(row) = maybe_row {
         let id: ApiKeyId = ApiKeyId(row.get(0));
         let name: String = row.get(1);
-        let role = parse_role(&row.get::<_, String>(2))?;
+        let role = Role::from_str(&row.get::<_, String>(2))?;
         Ok(ApiKeyDescr { id, name, role })
     } else {
         Err(DBError::UnknownApiKey {
@@ -123,6 +115,6 @@ pub async fn validate_api_key(
     let res = txn.query(&stmt, &[&hash]).await?;
     let res = res.first().ok_or(DBError::InvalidApiKey)?;
     let tenant_id = TenantId(res.get(0));
-    let role = parse_role(&res.get::<_, String>(1))?;
+    let role = Role::from_str(&res.get::<_, String>(1))?;
     Ok((tenant_id, role))
 }
diff --git a/crates/pipeline-manager/src/db/operations/oidc_trust.rs b/crates/pipeline-manager/src/db/operations/oidc_trust.rs
index 54ca199bde7..b85ae3f1862 100644
--- a/crates/pipeline-manager/src/db/operations/oidc_trust.rs
+++ b/crates/pipeline-manager/src/db/operations/oidc_trust.rs
@@ -10,12 +10,6 @@ use deadpool_postgres::Transaction;
 use std::str::FromStr;
 use uuid::Uuid;
 
-fn parse_role(s: &str) -> Result<Role, DBError> {
-    Role::from_str(s).map_err(|_| DBError::InvalidRoleString {
-        value: s.to_string(),
-    })
-}
-
 fn row_to_descr(row: &tokio_postgres::Row) -> Result<OidcTrustDescr, DBError> {
     let id: Uuid = row.get(0);
     let name: String = row.get(1);
@@ -23,7 +17,7 @@ fn row_to_descr(row: &tokio_postgres::Row) -> Result<OidcTrustDescr, DBError> {
     let issuer: String = row.get(3);
     let subject: String = row.get(4);
     let audience: Option<String> = row.get(5);
-    let role = parse_role(&row.get::<_, String>(6))?;
+    let role = Role::from_str(&row.get::<_, String>(6))?;
     Ok(OidcTrustDescr {
         id: OidcTrustId(id),
         name,
@@ -207,6 +201,24 @@ pub async fn is_trusted_issuer(txn: &Transaction<'_>, issuer: &str) -> Result<bo
 /// for a tenant-scoped trust, `None` for a platform-wide owner trust. When the
 /// result spans several scopes the caller disambiguates with the
 /// `Feldera-Tenant` header. Sorted (owner scope first) for a deterministic order.
+///
+/// For a GitHub Actions token with
+/// `iss = https://token.actions.githubusercontent.com`,
+/// `sub = repo:acme/api:ref:refs/heads/main`, `aud = https://github.com/acme`:
+///
+/// ```text
+/// registered trusts
+///   ("acme-ci",   tenant=acme, subject="repo:acme/*",     audience=None,    role=write)
+///   ("acme-main", tenant=acme, subject="repo:acme/api:*", audience="https://github.com/acme", role=admin)
+///   ("bootstrap", tenant=None, subject="repo:acme/*",     audience=None,    role=owner)
+///   ("other",     tenant=beta, subject="repo:beta/*",     audience=None,    role=write)
+///
+/// match_oidc_trust(..) => [(None, Owner), (Some(acme), Admin)]
+/// ```
+///
+/// `beta` does not appear because its subject pattern does not match. `acme`
+/// appears once, at `admin`, the most permissive of its two matching trusts. The
+/// result spans two scopes, so the caller needs the `Feldera-Tenant` header.
 pub async fn match_oidc_trust(
     txn: &Transaction<'_>,
     issuer: &str,
@@ -225,7 +237,7 @@ pub async fn match_oidc_trust(
         let tenant_id = row.get::<_, Option<Uuid>>(0).map(TenantId);
         let pattern_subject: String = row.get(1);
         let pattern_audience: Option<String> = row.get(2);
-        let role = parse_role(&row.get::<_, String>(3))?;
+        let role = Role::from_str(&row.get::<_, String>(3))?;
 
         if !claim_matches(&pattern_subject, subject) {
             continue;
diff --git a/crates/pipeline-manager/src/db/operations/tenant.rs b/crates/pipeline-manager/src/db/operations/tenant.rs
index ac797fced7c..f0727c9cbc4 100644
--- a/crates/pipeline-manager/src/db/operations/tenant.rs
+++ b/crates/pipeline-manager/src/db/operations/tenant.rs
@@ -3,6 +3,7 @@ use crate::db::operations::utils::maybe_unique_violation;
 use crate::db::types::tenant::TenantId;
 use crate::db::types::user::TenantInfo;
 use deadpool_postgres::Transaction;
+use tracing::error;
 use uuid::Uuid;
 
 /// Retrieves tenant, which is uniquely identified by the tuple (name, provider).
@@ -20,7 +21,8 @@ pub async fn get_or_create_tenant_id(
 
 /// As [`get_or_create_tenant_id`], but also reports whether the tenant was
 /// newly created by this call. The boolean lets the login path grant the very
-/// first principal of a fresh tenant the `admin` role.
+/// first principal of a fresh tenant the role configured by
+/// `--first-user-role` / `FELDERA_AUTH_FIRST_USER_ROLE` (`admin` by default).
 pub async fn get_or_create_tenant_id_created(
     txn: &Transaction<'_>,
     new_id: Uuid,
@@ -49,9 +51,9 @@ pub async fn get_or_create_tenant_id_created(
     Ok((TenantId(row.get(0)), inserted == 1))
 }
 
-/// Strict lookup of a tenant by name only, used for owner cross-tenant
-/// resolution from the `Feldera-Tenant` header. Never creates a tenant; errors
-/// on miss or ambiguity (a name shared across providers cannot be resolved).
+/// Strict lookup of a tenant by name only, used to resolve a `Feldera-Tenant`
+/// header. Never creates a tenant; errors on miss, and on the ambiguity that a
+/// name shared across providers would create.
 pub async fn get_tenant_id_by_name(txn: &Transaction<'_>, name: &str) -> Result<TenantId, DBError> {
     let stmt = txn
         .prepare_cached("SELECT id FROM tenant WHERE tenant = $1")
@@ -59,18 +61,30 @@ pub async fn get_tenant_id_by_name(txn: &Transaction<'_>, name: &str) -> Result<
     let rows = txn.query(&stmt, &[&name]).await?;
     match rows.len() {
         1 => Ok(TenantId(rows[0].get(0))),
-        _ => Err(DBError::UnknownTenantName {
+        0 => Err(DBError::UnknownTenantName {
             name: name.to_string(),
         }),
+        n => {
+            // Tenants are unique per (name, provider), so this needs a second
+            // configured provider to happen at all. Refuse to guess which one.
+            error!(
+                "Tenant name '{name}' resolves to {n} tenants across providers; \
+                 select the tenant by its UUID instead"
+            );
+            Err(DBError::UnknownTenantName {
+                name: name.to_string(),
+            })
+        }
     }
 }
 
-/// Strict resolution of a `Feldera-Tenant` selector for an owner acting
-/// cross-tenant. A selector that parses as a UUID is resolved by tenant id
-/// (unambiguous); otherwise it is resolved by name. Never creates a tenant;
-/// errors with `UnknownTenantName` (HTTP 404) on miss, so a typo cannot silently
-/// create or cross into the wrong tenant. Tenant names are unique only per
-/// provider, so the UUID form is the robust selector.
+/// Strict resolution of a `Feldera-Tenant` selector, used wherever a principal
+/// picks one of the tenants it is authorized for. A selector that parses as a
+/// UUID is resolved by tenant id; otherwise it is resolved by name. Never
+/// creates a tenant; errors with `UnknownTenantName` (HTTP 404) on miss, so a
+/// typo cannot silently create or cross into the wrong tenant. The caller is
+/// responsible for checking that the resolved tenant is one the principal may
+/// act in.
 pub async fn resolve_tenant_selector(
     txn: &Transaction<'_>,
     selector: &str,
diff --git a/crates/pipeline-manager/src/db/operations/user.rs b/crates/pipeline-manager/src/db/operations/user.rs
index f46e2fa631b..a659b64f627 100644
--- a/crates/pipeline-manager/src/db/operations/user.rs
+++ b/crates/pipeline-manager/src/db/operations/user.rs
@@ -12,12 +12,6 @@ use deadpool_postgres::Transaction;
 use std::str::FromStr;
 use uuid::Uuid;
 
-fn parse_role(s: &str) -> Result<Role, DBError> {
-    Role::from_str(s).map_err(|_| DBError::InvalidRoleString {
-        value: s.to_string(),
-    })
-}
-
 /// Get the persisted user for an OIDC `(provider, subject)`, creating it if
 /// absent and refreshing the stored email. Returns its identifier.
 pub async fn get_or_create_user(
@@ -29,6 +23,8 @@ pub async fn get_or_create_user(
 ) -> Result<UserId, DBError> {
     let stmt = txn
         .prepare_cached(
+            // `EXCLUDED` is PostgreSQL's name for the row this statement tried
+            // to insert, so `EXCLUDED.email` is the email from this login.
             // COALESCE keeps a previously stored email when a later token omits
             // the claim (some IdPs drop email on refresh-derived access tokens),
             // rather than overwriting it with NULL.
@@ -72,7 +68,7 @@ pub async fn get_member_role(
         .await?;
     let row = txn.query_opt(&stmt, &[&tenant_id.0, &user_id.0]).await?;
     match row {
-        Some(row) => Ok(Some(parse_role(&row.get::<_, String>(0))?)),
+        Some(row) => Ok(Some(Role::from_str(&row.get::<_, String>(0))?)),
         None => Ok(None),
     }
 }
@@ -87,6 +83,9 @@ pub async fn upsert_member_role(
 ) -> Result<(), DBError> {
     let stmt = txn
         .prepare_cached(
+            // On conflict the membership already exists, so overwrite its role
+            // with `EXCLUDED.role`, PostgreSQL's name for the value this
+            // statement tried to insert. Insert and update in one statement.
             "INSERT INTO tenant_membership (tenant_id, user_id, role) VALUES ($1, $2, $3) \
              ON CONFLICT (tenant_id, user_id) DO UPDATE SET role = EXCLUDED.role",
         )
@@ -138,7 +137,7 @@ pub async fn list_tenant_members(
             provider: row.get(1),
             subject: row.get(2),
             email: row.get(3),
-            role: parse_role(&row.get::<_, String>(4))?,
+            role: Role::from_str(&row.get::<_, String>(4))?,
         });
     }
     Ok(result)
diff --git a/crates/pipeline-manager/src/db/storage.rs b/crates/pipeline-manager/src/db/storage.rs
index 173993afb9a..704abb44aee 100644
--- a/crates/pipeline-manager/src/db/storage.rs
+++ b/crates/pipeline-manager/src/db/storage.rs
@@ -101,7 +101,7 @@ pub(crate) trait Storage {
     async fn resolve_tenant_selector(&self, selector: &str) -> Result<TenantId, DBError>;
 
     /// Creates a tenant, failing with a conflict (HTTP 409) if `(name, provider)`
-    /// already exists. Used by the owner-only explicit-create endpoint.
+    /// already exists.
     async fn create_tenant(
         &self,
         id: Uuid,
@@ -109,11 +109,13 @@ pub(crate) trait Storage {
         provider: &str,
     ) -> Result<TenantId, DBError>;
 
-    /// Lists all tenants in the installation (owner-only platform view).
+    /// Lists all tenants in the installation.
     async fn list_tenants(&self) -> Result<Vec<TenantInfo>, DBError>;
 
-    /// Resolves a non-owner login to its acting tenant and effective role,
-    /// ensuring the user and membership records exist. See
+    /// Resolves a login to its acting tenant and effective role, ensuring the
+    /// user and membership records exist. Owners skip this: their role comes
+    /// from configuration rather than a membership, so `auth` resolves them
+    /// before reaching here. See
     /// [`crate::db::operations::user::resolve_login`].
     #[allow(clippy::too_many_arguments)]
     async fn resolve_login(
@@ -175,7 +177,7 @@ pub(crate) trait Storage {
     /// Deletes an API key by name.
     async fn delete_api_key(&self, tenant_id: TenantId, name: &str) -> Result<(), DBError>;
 
-    /// Persists an SHA-256 hash of an API key in the database. The role is a
+    /// Persists a SHA-256 hash of an API key in the database. The role is a
     /// [`MintableKeyRole`] (read/write only), so `admin`/`owner` cannot be
     /// persisted as a static key by construction.
     async fn store_api_key_hash(
diff --git a/crates/pipeline-manager/src/db/types/oidc_trust.rs b/crates/pipeline-manager/src/db/types/oidc_trust.rs
index 849c22f9a73..33e8d7b5d6b 100644
--- a/crates/pipeline-manager/src/db/types/oidc_trust.rs
+++ b/crates/pipeline-manager/src/db/types/oidc_trust.rs
@@ -40,59 +40,40 @@ pub struct OidcTrustDescr {
     pub role: Role,
 }
 
-/// Returns true if `pattern` is a concrete claim value: non-empty and free of
-/// the `*` wildcard. Used by the create path to bound how broadly a trust may
-/// match (a wildcard pattern authorizes a whole set of tokens). Lives next to
-/// [`claim_matches`] so the matcher and the breadth policy change together.
-pub fn pattern_is_concrete(pattern: &str) -> bool {
-    !pattern.is_empty() && !pattern.contains('*')
-}
-
 /// Returns true if `pattern` matches `value`, where `*` in `pattern` matches
 /// any sequence of characters and all other characters must match exactly.
+///
+/// The `*`-separated literals must occur in order, with the first anchored at
+/// the start of `value` and the last at its end. Matching each middle literal at
+/// its earliest position is optimal here because the trailing literal is
+/// anchored separately, so no backtracking is needed. A plain matcher rather
+/// than a regex: patterns come from user-registered trust relationships, and
+/// this way there is nothing to escape and no pathological input to guard.
 pub fn claim_matches(pattern: &str, value: &str) -> bool {
-    let p = pattern.as_bytes();
-    let v = value.as_bytes();
-    let mut pi = 0usize;
-    let mut vi = 0usize;
-    let mut star_pi: Option<usize> = None;
-    let mut star_vi = 0usize;
-    while vi < v.len() {
-        if pi < p.len() && p[pi] == b'*' {
-            star_pi = Some(pi);
-            star_vi = vi;
-            pi += 1;
-        } else if pi < p.len() && p[pi] == v[vi] {
-            pi += 1;
-            vi += 1;
-        } else if let Some(sp) = star_pi {
-            pi = sp + 1;
-            star_vi += 1;
-            vi = star_vi;
-        } else {
-            return false;
+    let mut literals = pattern.split('*');
+    // `split` always yields at least one item.
+    let first = literals.next().unwrap_or_default();
+    let Some(mut rest) = value.strip_prefix(first) else {
+        return false;
+    };
+    let Some(last) = literals.next_back() else {
+        // No `*` in the pattern, so the single literal must be the whole value.
+        return rest.is_empty();
+    };
+    for literal in literals {
+        match rest.find(literal) {
+            Some(at) => rest = &rest[at + literal.len()..],
+            None => return false,
         }
     }
-    while pi < p.len() && p[pi] == b'*' {
-        pi += 1;
-    }
-    pi == p.len()
+    // The tail must fit in what is left, so a trailing literal cannot reuse
+    // characters an earlier one already consumed.
+    rest.len() >= last.len() && rest.ends_with(last)
 }
 
 #[cfg(test)]
 mod test {
-    use super::{claim_matches, pattern_is_concrete};
-
-    #[test]
-    fn concrete_patterns_have_no_wildcard() {
-        assert!(pattern_is_concrete("system:sa:app"));
-        assert!(pattern_is_concrete("feldera-tenant"));
-        assert!(!pattern_is_concrete("system:sa:*"));
-        assert!(!pattern_is_concrete("*"));
-        assert!(!pattern_is_concrete("*prod"));
-        // Empty is not a usable concrete value.
-        assert!(!pattern_is_concrete(""));
-    }
+    use super::claim_matches;
 
     #[test]
     fn exact_match() {
@@ -121,4 +102,21 @@ mod test {
         assert!(claim_matches("*", ""));
         assert!(claim_matches("*", "anything-goes"));
     }
+
+    /// Literals around a `*` may not consume the same characters twice.
+    #[test]
+    fn literals_do_not_overlap() {
+        assert!(claim_matches("a*a", "aa"));
+        assert!(!claim_matches("a*a", "a"));
+        assert!(claim_matches("*b*bb", "abbb"));
+        assert!(!claim_matches("*b*bb", "abb"));
+        assert!(claim_matches(
+            "repo:org/*:ref:*",
+            "repo:org/app:ref:refs/heads/main"
+        ));
+        assert!(!claim_matches(
+            "repo:org/*:ref:*",
+            "repo:other/app:ref:refs/heads/main"
+        ));
+    }
 }
diff --git a/crates/pipeline-manager/src/db/types/role.rs b/crates/pipeline-manager/src/db/types/role.rs
index 13106df5beb..29da359d3ec 100644
--- a/crates/pipeline-manager/src/db/types/role.rs
+++ b/crates/pipeline-manager/src/db/types/role.rs
@@ -42,6 +42,12 @@ impl Role {
     pub fn satisfies(&self, required: Role) -> bool {
         *self >= required
     }
+
+    /// True for the platform-wide `owner` role, which acts across tenants and is
+    /// never stored as a tenant membership.
+    pub fn is_owner(&self) -> bool {
+        *self == Role::Owner
+    }
 }
 
 impl fmt::Display for Role {
diff --git a/openapi.json b/openapi.json
index 04467c2fce1..22b5b7b0130 100644
--- a/openapi.json
+++ b/openapi.json
@@ -558,7 +558,7 @@
           {
             "name": "platform",
             "in": "query",
-            "description": "Select platform-wide owner trusts (which belong to no tenant) instead of\nthe caller's tenant, rather than the trusts scoped to the caller's tenant.\nOwner-only.",
+            "description": "Select the platform-wide owner trusts, which belong to no tenant,\ninstead of the trusts scoped to the caller's tenant. Owner-only.",
             "required": false,
             "schema": {
               "type": "boolean"
@@ -579,6 +579,16 @@
               }
             }
           },
+          "403": {
+            "description": "Caller's role is below the required role, or `platform` was set by a non-owner",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
           "500": {
             "description": "",
             "content": {
@@ -625,7 +635,17 @@
             }
           },
           "400": {
-            "description": "Invalid request",
+            "description": "A required field is empty",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Caller's role is below the required role, or the requested role exceeds the caller's own",
             "content": {
               "application/json": {
                 "schema": {
@@ -643,6 +663,16 @@
                 }
               }
             }
+          },
+          "500": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
           }
         },
         "security": [
@@ -673,7 +703,7 @@
           {
             "name": "platform",
             "in": "query",
-            "description": "Select platform-wide owner trusts (which belong to no tenant) instead of\nthe caller's tenant, rather than the trusts scoped to the caller's tenant.\nOwner-only.",
+            "description": "Select the platform-wide owner trusts, which belong to no tenant,\ninstead of the trusts scoped to the caller's tenant. Owner-only.",
             "required": false,
             "schema": {
               "type": "boolean"
@@ -691,6 +721,16 @@
               }
             }
           },
+          "403": {
+            "description": "Caller's role is below the required role, or `platform` was set by a non-owner",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
           "404": {
             "description": "No relationship with that name",
             "content": {
@@ -700,6 +740,16 @@
                 }
               }
             }
+          },
+          "500": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
           }
         },
         "security": [
@@ -728,7 +778,7 @@
           {
             "name": "platform",
             "in": "query",
-            "description": "Select platform-wide owner trusts (which belong to no tenant) instead of\nthe caller's tenant, rather than the trusts scoped to the caller's tenant.\nOwner-only.",
+            "description": "Select the platform-wide owner trusts, which belong to no tenant,\ninstead of the trusts scoped to the caller's tenant. Owner-only.",
             "required": false,
             "schema": {
               "type": "boolean"
@@ -739,6 +789,16 @@
           "200": {
             "description": "Trust relationship deleted"
           },
+          "403": {
+            "description": "Caller's role is below the required role, or `platform` was set by a non-owner",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
           "404": {
             "description": "No relationship with that name",
             "content": {
@@ -748,6 +808,16 @@
                 }
               }
             }
+          },
+          "500": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
           }
         },
         "security": [
@@ -7333,6 +7403,16 @@
               }
             }
           },
+          "403": {
+            "description": "Caller's role is below the required role",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
           "500": {
             "description": "",
             "content": {
@@ -7379,7 +7459,17 @@
             }
           },
           "403": {
-            "description": "Requested role exceeds caller's role or is owner",
+            "description": "Caller's role is below the required role, or the requested role is `owner`",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "",
             "content": {
               "application/json": {
                 "schema": {
@@ -7431,7 +7521,27 @@
             "description": "Role assigned"
           },
           "403": {
-            "description": "Requested role exceeds caller's role or is owner",
+            "description": "Caller's role is below the required role, or the requested role is `owner`",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "No user with that identifier",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "",
             "content": {
               "application/json": {
                 "schema": {
@@ -7470,6 +7580,16 @@
           "200": {
             "description": "Member removed"
           },
+          "403": {
+            "description": "Caller's role is below the required role",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
           "404": {
             "description": "User is not a member",
             "content": {
@@ -7479,6 +7599,16 @@
                 }
               }
             }
+          },
+          "500": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
           }
         },
         "security": [
@@ -7510,6 +7640,16 @@
               }
             }
           },
+          "403": {
+            "description": "Caller is not a platform owner",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
           "500": {
             "description": "",
             "content": {
@@ -7555,6 +7695,16 @@
               }
             }
           },
+          "403": {
+            "description": "Caller is not a platform owner",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
           "409": {
             "description": "A tenant with that name already exists",
             "content": {
@@ -7564,6 +7714,16 @@
                 }
               }
             }
+          },
+          "500": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
           }
         },
         "security": [
@@ -11389,7 +11549,7 @@
           "audience": {
             "type": "string",
             "description": "Optional audience claim pattern. `*` matches any sequence of characters.\nIf omitted, the audience claim is not checked.",
-            "example": "feldera",
+            "example": "https://github.com/my-org",
             "nullable": true
           },
           "description": {
@@ -14366,14 +14526,9 @@
         "required": [
           "tenant_id",
           "tenant_name",
-          "role",
-          "is_owner"
+          "role"
         ],
         "properties": {
-          "is_owner": {
-            "type": "boolean",
-            "description": "Whether the caller is a platform owner."
-          },
           "role": {
             "$ref": "#/components/schemas/Role"
           },

From 900a618f547893c83348b5860053624c884611b3 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Sat, 25 Jul 2026 23:00:25 -0700
Subject: [PATCH 16/55] [fda] Default a new API key to read, and show real
 token commands

`apikey create` minted a write key by default; least privilege says read, and it
now matches the server's own default. Pass --role write where a key needs to
make changes.

Replace the `--auth-token-command` prose with commands that work: the Kubernetes
projected service-account token, the EKS web identity token, and `gcloud auth
print-identity-token` (an ID token is a JWT; an access token is not). Drop the
description of a trust-breadth policy the server no longer enforces.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 crates/fda/src/cli.rs  | 35 ++++++++++++++++++++++-------------
 crates/fda/src/main.rs | 10 +++++++---
 2 files changed, 29 insertions(+), 16 deletions(-)

diff --git a/crates/fda/src/cli.rs b/crates/fda/src/cli.rs
index b590590d767..26937159410 100644
--- a/crates/fda/src/cli.rs
+++ b/crates/fda/src/cli.rs
@@ -126,9 +126,19 @@ pub struct Cli {
     /// Run once per `fda` invocation; the trimmed stdout becomes the
     /// `Authorization: Bearer <token>` header for every request that
     /// invocation makes. Use for OIDC workload-identity flows with short-lived
-    /// tokens — pair with `tsidp-token`, `gcloud auth print-access-token`, etc.
-    /// The kubelet-rotated token file works because each `fda` run re-reads it.
-    /// Conflicts with `--auth`.
+    /// tokens: because the command runs on every invocation, a rotated token is
+    /// picked up automatically. Conflicts with `--auth`.
+    ///
+    /// Examples:
+    ///
+    ///   # Kubernetes projected service-account token
+    ///   --auth-token-command 'cat /var/run/secrets/kubernetes.io/serviceaccount/token'
+    ///
+    ///   # AWS EKS, IAM roles for service accounts
+    ///   --auth-token-command 'cat $AWS_WEB_IDENTITY_TOKEN_FILE'
+    ///
+    ///   # Google Cloud (an ID token is a JWT; an access token is not)
+    ///   --auth-token-command 'gcloud auth print-identity-token'
     #[arg(
         long,
         env = "FELDERA_AUTH_TOKEN_COMMAND",
@@ -258,10 +268,9 @@ pub enum ApiKeyActions {
     Create {
         /// The name of the API key to create
         name: String,
-        /// Role the key carries: `read` or `write` (default). `admin` and
-        /// `owner` are never issuable as API keys. The role may not exceed the
-        /// caller's own role.
-        #[arg(long, default_value = "write")]
+        /// Role the key carries: `read` (default) or `write`. The role may not
+        /// exceed the caller's own role.
+        #[arg(long, default_value = "read")]
         role: ApiKeyRole,
     },
     /// Delete an existing API key
@@ -272,7 +281,7 @@ pub enum ApiKeyActions {
     },
 }
 
-/// The roles an API key may carry (`admin`/`owner` are never key-mintable).
+/// The roles an API key may carry.
 #[derive(Clone, Copy, Debug, ValueEnum)]
 pub enum ApiKeyRole {
     Read,
@@ -300,14 +309,14 @@ pub enum OidcTrustActions {
         /// Pattern for the `aud` claim. `*` matches any sequence. Optional.
         #[arg(long)]
         audience: Option<String>,
-        /// Free-text description.
+        /// What this trust is for, e.g. the workload or CI job it authorizes.
+        /// Shown when listing trust relationships.
         #[arg(long)]
         description: Option<String>,
         /// Role granted to a matching token: `read` (default), `write`,
-        /// `admin`, or `owner`. Capped at the caller's role; `owner` requires a
-        /// platform owner. Breadth rules the server enforces: a wildcard
-        /// `subject` always requires a concrete (non-wildcard) `audience`; and
-        /// above `read`, neither subject nor audience may contain a wildcard.
+        /// `admin`, or `owner`. Capped at the caller's role. `owner` requires a
+        /// platform owner and registers a platform-wide trust that belongs to no
+        /// tenant; the acting tenant then comes from the `Feldera-Tenant` header.
         #[arg(long)]
         role: Option<TrustRole>,
     },
diff --git a/crates/fda/src/main.rs b/crates/fda/src/main.rs
index 90427e163a1..6ef11efba7c 100644
--- a/crates/fda/src/main.rs
+++ b/crates/fda/src/main.rs
@@ -292,7 +292,11 @@ fn handle_errors_fatal(
                 let server_msg = body.as_deref().and_then(|b| {
                     serde_json::from_str::<serde_json::Value>(b)
                         .ok()
-                        .and_then(|v| v.get("message").and_then(|m| m.as_str()).map(str::to_string))
+                        .and_then(|v| {
+                            v.get("message")
+                                .and_then(|m| m.as_str())
+                                .map(str::to_string)
+                        })
                 });
                 match server_msg {
                     Some(m) => {
@@ -336,8 +340,8 @@ async fn api_key_commands(format: OutputFormat, action: ApiKeyActions, client: C
         ApiKeyActions::Create { name, role } => {
             debug!("Creating API key: {}", name);
             let role = match role {
-                ApiKeyRole::Read => feldera_rest_api::types::Role::Read,
-                ApiKeyRole::Write => feldera_rest_api::types::Role::Write,
+                ApiKeyRole::Read => feldera_rest_api::types::MintableKeyRole::Read,
+                ApiKeyRole::Write => feldera_rest_api::types::MintableKeyRole::Write,
             };
             let response = client
                 .post_api_key()

From 2cbcc5f60109b1b62e9c9bc2aa99e378e5c524b2 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Sat, 25 Jul 2026 23:00:25 -0700
Subject: [PATCH 17/55] [web-console] Derive owner status from the session role

The session payload no longer carries `is_owner`; `role === 'owner'` says the
same thing. Regenerate the API client for the narrowed role schemas.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 .../src/lib/services/manager/index.ts         |   2 +
 .../src/lib/services/manager/sdk.gen.ts       | 168 ++++++++++++++++--
 .../src/lib/services/manager/types.gen.ts     |  87 +++++++--
 js-packages/web-console/src/routes/+layout.ts |   7 +-
 4 files changed, 232 insertions(+), 32 deletions(-)

diff --git a/js-packages/web-console/src/lib/services/manager/index.ts b/js-packages/web-console/src/lib/services/manager/index.ts
index 0785e7ec28e..f5fa4356457 100644
--- a/js-packages/web-console/src/lib/services/manager/index.ts
+++ b/js-packages/web-console/src/lib/services/manager/index.ts
@@ -417,10 +417,12 @@ export type {
   ListTenantUsersErrors,
   ListTenantUsersResponse,
   ListTenantUsersResponses,
+  MemberRole,
   MemoryPressure,
   MergerType,
   MetricsFormat,
   MetricsParameters,
+  MintableKeyRole,
   MirInput,
   MirNode,
   MonitorStatus,
diff --git a/js-packages/web-console/src/lib/services/manager/sdk.gen.ts b/js-packages/web-console/src/lib/services/manager/sdk.gen.ts
index 78e9b72f222..2dffac80c40 100644
--- a/js-packages/web-console/src/lib/services/manager/sdk.gen.ts
+++ b/js-packages/web-console/src/lib/services/manager/sdk.gen.ts
@@ -260,6 +260,8 @@ export const getConfigAuthentication = <ThrowOnError extends boolean = true>(
 /**
  * List API Keys
  *
+ * Required role: `write` or higher.
+ *
  * Retrieve a list of your API keys.
  */
 export const listApiKeys = <ThrowOnError extends boolean = true>(
@@ -275,6 +277,8 @@ export const listApiKeys = <ThrowOnError extends boolean = true>(
 /**
  * Create API Key
  *
+ * Required role: `write` or higher.
+ *
  * Create a new API key with the specified name. The generated API key
  * will be returned in the response and cannot be retrieved again later.
  */
@@ -295,6 +299,8 @@ export const postApiKey = <ThrowOnError extends boolean = true>(
 /**
  * Delete API Key
  *
+ * Required role: `write` or higher.
+ *
  * Remove an API key by its name.
  */
 export const deleteApiKey = <ThrowOnError extends boolean = true>(
@@ -315,6 +321,8 @@ export const deleteApiKey = <ThrowOnError extends boolean = true>(
 /**
  * Get API Key
  *
+ * Required role: `write` or higher.
+ *
  * Retrieve the metadata of a specific API key by its name.
  */
 export const getApiKey = <ThrowOnError extends boolean = true>(
@@ -330,6 +338,8 @@ export const getApiKey = <ThrowOnError extends boolean = true>(
 /**
  * List Cluster Events
  *
+ * Required role: `read` or higher.
+ *
  * Retrieve a list of retained cluster monitor events ordered from most recent to least recent.
  *
  * The returned events only have limited details, the full details can be retrieved using
@@ -359,6 +369,8 @@ export const listClusterEvents = <ThrowOnError extends boolean = true>(
 /**
  * Get Cluster Event
  *
+ * Required role: `read` or higher.
+ *
  * Get specific cluster monitor event.
  *
  * The identifiers of the events can be retrieved via `GET /v0/cluster/events`.
@@ -384,6 +396,8 @@ export const getClusterEvent = <ThrowOnError extends boolean = true>(
 /**
  * Check Cluster Health
  *
+ * Required role: `read` or higher.
+ *
  * Determine the latest cluster health via the latest cluster monitor event.
  */
 export const getClusterHealth = <ThrowOnError extends boolean = true>(
@@ -404,6 +418,8 @@ export const getClusterHealth = <ThrowOnError extends boolean = true>(
 /**
  * Get Platform Config
  *
+ * Required role: `read` or higher.
+ *
  * Retrieve configuration of the Feldera Platform.
  */
 export const getConfig = <ThrowOnError extends boolean = true>(
@@ -419,6 +435,8 @@ export const getConfig = <ThrowOnError extends boolean = true>(
 /**
  * List Demos
  *
+ * Required role: `read` or higher.
+ *
  * Retrieve the list of demos available in the WebConsole.
  */
 export const getConfigDemos = <ThrowOnError extends boolean = true>(
@@ -439,6 +457,8 @@ export const getConfigDemos = <ThrowOnError extends boolean = true>(
 /**
  * Get Session
  *
+ * Required role: `read` or higher.
+ *
  * Retrieve login session information for your current user session.
  */
 export const getConfigSession = <ThrowOnError extends boolean = true>(
@@ -459,6 +479,8 @@ export const getConfigSession = <ThrowOnError extends boolean = true>(
 /**
  * List All Metrics
  *
+ * Required role: `read` or higher.
+ *
  * Retrieve the metrics of all running pipelines belonging to this tenant.
  *
  * The metrics are collected by making individual HTTP requests to `/metrics`
@@ -476,7 +498,9 @@ export const getMetrics = <ThrowOnError extends boolean = true>(
   })
 
 /**
- * List OIDC trust relationships
+ * List OIDC Trust
+ *
+ * Required role: `admin` or higher.
  */
 export const listOidcTrust = <ThrowOnError extends boolean = true>(
   options?: Options<ListOidcTrustData, ThrowOnError>
@@ -494,7 +518,9 @@ export const listOidcTrust = <ThrowOnError extends boolean = true>(
   })
 
 /**
- * Create OIDC trust relationship
+ * Create OIDC Trust
+ *
+ * Required role: `admin` or higher.
  */
 export const postOidcTrust = <ThrowOnError extends boolean = true>(
   options: Options<PostOidcTrustData, ThrowOnError>
@@ -516,7 +542,9 @@ export const postOidcTrust = <ThrowOnError extends boolean = true>(
   })
 
 /**
- * Delete OIDC trust relationship
+ * Delete OIDC Trust
+ *
+ * Required role: `admin` or higher.
  */
 export const deleteOidcTrust = <ThrowOnError extends boolean = true>(
   options: Options<DeleteOidcTrustData, ThrowOnError>
@@ -534,7 +562,9 @@ export const deleteOidcTrust = <ThrowOnError extends boolean = true>(
   })
 
 /**
- * Get OIDC trust relationship
+ * Get OIDC Trust
+ *
+ * Required role: `admin` or higher.
  */
 export const getOidcTrust = <ThrowOnError extends boolean = true>(
   options: Options<GetOidcTrustData, ThrowOnError>
@@ -549,6 +579,8 @@ export const getOidcTrust = <ThrowOnError extends boolean = true>(
 /**
  * List Pipelines
  *
+ * Required role: `read` or higher.
+ *
  * Retrieve the list of pipelines.
  * Configure which fields are included using the `selector` query parameter.
  */
@@ -570,6 +602,8 @@ export const listPipelines = <ThrowOnError extends boolean = true>(
 /**
  * Create Pipeline
  *
+ * Required role: `write` or higher.
+ *
  * Create a new pipeline with the provided configuration.
  */
 export const postPipeline = <ThrowOnError extends boolean = true>(
@@ -589,6 +623,8 @@ export const postPipeline = <ThrowOnError extends boolean = true>(
 /**
  * Delete Pipeline
  *
+ * Required role: `write` or higher.
+ *
  * Delete an existing pipeline by name.
  */
 export const deletePipeline = <ThrowOnError extends boolean = true>(
@@ -609,6 +645,8 @@ export const deletePipeline = <ThrowOnError extends boolean = true>(
 /**
  * Get Pipeline
  *
+ * Required role: `read` or higher.
+ *
  * Retrieve a pipeline.
  * Configure which fields are included using the `selector` query parameter.
  */
@@ -625,6 +663,8 @@ export const getPipeline = <ThrowOnError extends boolean = true>(
 /**
  * Patch Pipeline
  *
+ * Required role: `write` or higher.
+ *
  * Partially update a pipeline.
  */
 export const patchPipeline = <ThrowOnError extends boolean = true>(
@@ -649,6 +689,8 @@ export const patchPipeline = <ThrowOnError extends boolean = true>(
 /**
  * Upsert Pipeline
  *
+ * Required role: `write` or higher.
+ *
  * Fully update a pipeline if it already exists, otherwise create a new pipeline.
  */
 export const putPipeline = <ThrowOnError extends boolean = true>(
@@ -668,6 +710,8 @@ export const putPipeline = <ThrowOnError extends boolean = true>(
 /**
  * Activate Standby Pipeline
  *
+ * Required role: `write` or higher.
+ *
  * Requests the pipeline to activate if it is currently in standby mode, which it will do
  * asynchronously.
  *
@@ -694,6 +738,8 @@ export const postPipelineActivate = <ThrowOnError extends boolean = true>(
 /**
  * Approve Bootstrap
  *
+ * Required role: `write` or higher.
+ *
  * Approves the pipeline to proceed with bootstrapping.
  *
  * This endpoint is used when a pipeline has been started with
@@ -720,6 +766,8 @@ export const postPipelineApprove = <ThrowOnError extends boolean = true>(
 /**
  * Checkpoint Now
  *
+ * Required role: `write` or higher.
+ *
  * Initiates checkpoint for a running or paused pipeline.
  *
  * Returns a checkpoint sequence number that can be used with `/checkpoint_status` to
@@ -743,6 +791,8 @@ export const checkpointPipeline = <ThrowOnError extends boolean = true>(
 /**
  * Sync Checkpoints To S3
  *
+ * Required role: `write` or higher.
+ *
  * Syncs latest checkpoints to the object store configured in pipeline config.
  */
 export const syncCheckpoint = <ThrowOnError extends boolean = true>(
@@ -763,6 +813,8 @@ export const syncCheckpoint = <ThrowOnError extends boolean = true>(
 /**
  * Get Checkpoint Sync Status
  *
+ * Required role: `read` or higher.
+ *
  * Retrieve status of checkpoint sync activity in a pipeline.
  */
 export const getCheckpointSyncStatus = <ThrowOnError extends boolean = true>(
@@ -783,6 +835,8 @@ export const getCheckpointSyncStatus = <ThrowOnError extends boolean = true>(
 /**
  * Get Checkpoint Status
  *
+ * Required role: `read` or higher.
+ *
  * Retrieve status of checkpoint activity in a pipeline.
  */
 export const getCheckpointStatus = <ThrowOnError extends boolean = true>(
@@ -803,6 +857,8 @@ export const getCheckpointStatus = <ThrowOnError extends boolean = true>(
 /**
  * Get the checkpoints for a pipeline
  *
+ * Required role: `read` or higher.
+ *
  * Retrieve the current checkpoints made by a pipeline.
  *
  * **Stability note**: for multihost pipelines, this endpoint returns the
@@ -827,6 +883,8 @@ export const getCheckpoints = <ThrowOnError extends boolean = true>(
 /**
  * List checkpoints in remote object storage
  *
+ * Required role: `read` or higher.
+ *
  * Retrieve the list of checkpoints available in the configured remote object
  * storage (e.g., S3).  Requires the pipeline to be running with a sync
  * storage configuration.
@@ -849,6 +907,8 @@ export const getRemoteCheckpoints = <ThrowOnError extends boolean = true>(
 /**
  * Performance Profile JSON
  *
+ * Required role: `read` or higher.
+ *
  * Retrieve the circuit performance profile in JSON format of a running or paused pipeline.
  */
 export const getPipelineCircuitJsonProfile = <ThrowOnError extends boolean = true>(
@@ -869,6 +929,8 @@ export const getPipelineCircuitJsonProfile = <ThrowOnError extends boolean = tru
 /**
  * Get Performance Profile
  *
+ * Required role: `read` or higher.
+ *
  * Retrieve the circuit performance profile of a running or paused pipeline.
  */
 export const getPipelineCircuitProfile = <ThrowOnError extends boolean = true>(
@@ -889,6 +951,8 @@ export const getPipelineCircuitProfile = <ThrowOnError extends boolean = true>(
 /**
  * Clear Storage
  *
+ * Required role: `write` or higher.
+ *
  * Clears the pipeline storage asynchronously.
  *
  * IMPORTANT: Clearing means disassociating the storage from the pipeline.
@@ -916,6 +980,8 @@ export const postPipelineClear = <ThrowOnError extends boolean = true>(
 /**
  * Advance Clock
  *
+ * Required role: `write` or higher.
+ *
  * Moves `NOW()` forward by a specified amount. Returns the
  * current clock time of the circuit.
  *
@@ -949,6 +1015,8 @@ export const clockAdvance = <ThrowOnError extends boolean = true>(
 /**
  * Commit Transaction
  *
+ * Required role: `write` or higher.
+ *
  * Commit the current transaction.
  */
 export const commitTransaction = <ThrowOnError extends boolean = true>(
@@ -969,6 +1037,8 @@ export const commitTransaction = <ThrowOnError extends boolean = true>(
 /**
  * Check Completion Status
  *
+ * Required role: `read` or higher.
+ *
  * Check the status of a completion token returned by the `/ingress` or `/completion_token`
  * endpoint.
  */
@@ -990,6 +1060,8 @@ export const completionStatus = <ThrowOnError extends boolean = true>(
 /**
  * Get Dataflow Graph
  *
+ * Required role: `read` or higher.
+ *
  * Retrieve the dataflow graph of a pipeline.
  * The dataflow graph is generated during SQL compilation and shows the structure
  * of the compiled SQL program including the Calcite plan and MIR nodes.
@@ -1012,6 +1084,8 @@ export const getPipelineDataflowGraph = <ThrowOnError extends boolean = true>(
 /**
  * Compute Program Diff
  *
+ * Required role: `read` or higher.
+ *
  * Compute the diff between the pipeline's current program and a proposed new
  * version, without modifying or restarting the pipeline.
  *
@@ -1045,6 +1119,8 @@ export const postPipelineDiff = <ThrowOnError extends boolean = true>(
 /**
  * Dismiss Pipeline Deployment Error
  *
+ * Required role: `write` or higher.
+ *
  * Clears the `deployment_error` field of the pipeline, such that a subsequent call to
  * `/start?dismiss_error=false` succeeds. It will return an error if the pipeline is not fully
  * stopped (i.e., both current and desired status must be `Stopped`) AND a deployment error
@@ -1068,6 +1144,8 @@ export const postPipelineDismissError = <ThrowOnError extends boolean = true>(
 /**
  * Subscribe to View
  *
+ * Required role: `write` or higher.
+ *
  * Subscribe to a stream of updates from a SQL view or table.
  *
  * The pipeline responds with a continuous stream of changes to the specified
@@ -1101,6 +1179,8 @@ export const httpOutput = <ThrowOnError extends boolean = true>(
 /**
  * List Pipeline Events
  *
+ * Required role: `read` or higher.
+ *
  * Retrieve monitoring events in reverse chronological order.
  *
  * Pipeline health is monitored regularly every several seconds.
@@ -1130,6 +1210,8 @@ export const listPipelineEvents = <ThrowOnError extends boolean = true>(
 /**
  * Get Pipeline Event
  *
+ * Required role: `read` or higher.
+ *
  * Get a specific pipeline monitor event.
  *
  * The identifiers of the events can be retrieved via `GET /v0/pipelines/<pipeline>/events`.
@@ -1154,6 +1236,8 @@ export const getPipelineEvent = <ThrowOnError extends boolean = true>(
 /**
  * Get Heap Profile
  *
+ * Required role: `read` or higher.
+ *
  * Retrieve the heap profile of a running or paused pipeline.
  */
 export const getPipelineHeapProfile = <ThrowOnError extends boolean = true>(
@@ -1174,6 +1258,8 @@ export const getPipelineHeapProfile = <ThrowOnError extends boolean = true>(
 /**
  * Insert Data
  *
+ * Required role: `write` or higher.
+ *
  * Push data to a SQL table.
  *
  * The client sends data encoded using the format specified in the `?format=`
@@ -1206,6 +1292,8 @@ export const httpInput = <ThrowOnError extends boolean = true>(
 /**
  * Stream Pipeline Logs
  *
+ * Required role: `read` or higher.
+ *
  * Retrieve logs of a pipeline as a stream.
  *
  * The logs stream catches up to the extent of the internally configured per-pipeline
@@ -1238,6 +1326,8 @@ export const getPipelineLogs = <ThrowOnError extends boolean = true>(
 /**
  * Get Pipeline Metrics
  *
+ * Required role: `read` or higher.
+ *
  * Retrieve the metrics of a running or paused pipeline.
  */
 export const getPipelineMetrics = <ThrowOnError extends boolean = true>(
@@ -1258,6 +1348,8 @@ export const getPipelineMetrics = <ThrowOnError extends boolean = true>(
 /**
  * Pause Pipeline
  *
+ * Required role: `write` or higher.
+ *
  * Requests the pipeline to pause, which it will do asynchronously.
  *
  * Progress should be monitored by polling the pipeline `GET` endpoints.
@@ -1280,6 +1372,8 @@ export const postPipelinePause = <ThrowOnError extends boolean = true>(
 /**
  * Execute Ad-hoc SQL
  *
+ * Required role: `write` or higher.
+ *
  * Execute ad-hoc SQL in a running or paused pipeline.
  *
  * The evaluation is not incremental.
@@ -1302,6 +1396,8 @@ export const pipelineAdhocSql = <ThrowOnError extends boolean = true>(
 /**
  * Initiate rebalancing.
  *
+ * Required role: `write` or higher.
+ *
  * Initiate immediate rebalancing of the pipeline. Normally rebalancing is initiated automatically
  * when the drift in the size of joined relations exceeds a threshold. This endpoint forces the balancer
  * to reevaluate and apply an optimal partitioning policy regardless of the threshold.
@@ -1326,6 +1422,8 @@ export const postPipelineRebalance = <ThrowOnError extends boolean = true>(
 /**
  * Resume Pipeline
  *
+ * Required role: `write` or higher.
+ *
  * Requests the pipeline to resume, which it will do asynchronously.
  *
  * Progress should be monitored by polling the pipeline `GET` endpoints.
@@ -1348,6 +1446,8 @@ export const postPipelineResume = <ThrowOnError extends boolean = true>(
 /**
  * Get Samply Profile
  *
+ * Required role: `read` or higher.
+ *
  * Retrieve the last samply profile of a pipeline, regardless of whether profiling is currently in progress.
  * If ?latest parameter is specified and Samply profile collection is in progress, returns HTTP 307 with Retry-After header.
  */
@@ -1369,6 +1469,8 @@ export const getPipelineSamplyProfile = <ThrowOnError extends boolean = true>(
 /**
  * Start a Samply profile
  *
+ * Required role: `read` or higher.
+ *
  * Profile the pipeline using the Samply profiler for the next `duration_secs` seconds.
  */
 export const startSamplyProfile = <ThrowOnError extends boolean = true>(
@@ -1389,6 +1491,8 @@ export const startSamplyProfile = <ThrowOnError extends boolean = true>(
 /**
  * Start Pipeline
  *
+ * Required role: `write` or higher.
+ *
  * Start the pipeline asynchronously by updating the desired status.
  *
  * The endpoint returns immediately after setting the desired status.
@@ -1420,6 +1524,8 @@ export const postPipelineStart = <ThrowOnError extends boolean = true>(
 /**
  * Initiate compaction.
  *
+ * Required role: `write` or higher.
+ *
  * Initiate immediate compaction of the pipeline's state.
  */
 export const postPipelineStartCompaction = <ThrowOnError extends boolean = true>(
@@ -1440,6 +1546,8 @@ export const postPipelineStartCompaction = <ThrowOnError extends boolean = true>
 /**
  * Begin Transaction
  *
+ * Required role: `write` or higher.
+ *
  * Start a new transaction.
  */
 export const startTransaction = <ThrowOnError extends boolean = true>(
@@ -1460,6 +1568,8 @@ export const startTransaction = <ThrowOnError extends boolean = true>(
 /**
  * Get Pipeline Stats
  *
+ * Required role: `read` or higher.
+ *
  * Retrieve statistics (e.g., performance counters) of a running or paused pipeline.
  */
 export const getPipelineStats = <ThrowOnError extends boolean = true>(
@@ -1480,6 +1590,8 @@ export const getPipelineStats = <ThrowOnError extends boolean = true>(
 /**
  * Stop Pipeline
  *
+ * Required role: `write` or higher.
+ *
  * Stop the pipeline asynchronously by updating the desired state.
  *
  * There are two variants:
@@ -1523,6 +1635,8 @@ export const postPipelineStop = <ThrowOnError extends boolean = true>(
 /**
  * Download Support Bundle
  *
+ * Required role: `read` or higher.
+ *
  * Generate a support bundle for a pipeline.
  *
  * This endpoint collects various diagnostic data from the pipeline including
@@ -1547,6 +1661,8 @@ export const getPipelineSupportBundle = <ThrowOnError extends boolean = true>(
 /**
  * Get Completion Token
  *
+ * Required role: `write` or higher.
+ *
  * Generate a completion token for an input connector.
  *
  * Returns a token that can be passed to the `/completion_status` endpoint
@@ -1571,6 +1687,8 @@ export const completionToken = <ThrowOnError extends boolean = true>(
 /**
  * Get Input Status
  *
+ * Required role: `read` or higher.
+ *
  * Retrieve the status of an input connector.
  */
 export const getPipelineInputConnectorStatus = <ThrowOnError extends boolean = true>(
@@ -1591,6 +1709,8 @@ export const getPipelineInputConnectorStatus = <ThrowOnError extends boolean = t
 /**
  * Control Input Connector
  *
+ * Required role: `write` or higher.
+ *
  * Start (resume) or pause the input connector.
  *
  * The following values of the `action` argument are accepted: `start` and `pause`.
@@ -1637,6 +1757,8 @@ export const postPipelineInputConnectorAction = <ThrowOnError extends boolean =
 /**
  * Get Time Series Stats
  *
+ * Required role: `read` or higher.
+ *
  * Retrieve time series for statistics of a running or paused pipeline.
  */
 export const getPipelineTimeSeries = <ThrowOnError extends boolean = true>(
@@ -1657,6 +1779,8 @@ export const getPipelineTimeSeries = <ThrowOnError extends boolean = true>(
 /**
  * Stream Time Series
  *
+ * Required role: `read` or higher.
+ *
  * Stream time series for statistics of a running or paused pipeline.
  *
  * Returns a snapshot of all existing time series data followed by a continuous stream of
@@ -1682,6 +1806,8 @@ export const getPipelineTimeSeriesStream = <ThrowOnError extends boolean = true>
 /**
  * Recompile Pipeline
  *
+ * Required role: `write` or higher.
+ *
  * Recompile a pipeline with the Feldera runtime version included in the
  * currently installed Feldera platform.
  *
@@ -1722,6 +1848,8 @@ export const postUpdateRuntime = <ThrowOnError extends boolean = true>(
 /**
  * Get Output Status
  *
+ * Required role: `read` or higher.
+ *
  * Retrieve the status of an output connector.
  */
 export const getPipelineOutputConnectorStatus = <ThrowOnError extends boolean = true>(
@@ -1740,7 +1868,9 @@ export const getPipelineOutputConnectorStatus = <ThrowOnError extends boolean =
   })
 
 /**
- * List tenant members
+ * List Tenant Members
+ *
+ * Required role: `admin` or higher.
  *
  * List the users that are members of the acting tenant and their roles.
  */
@@ -1760,7 +1890,9 @@ export const listTenantUsers = <ThrowOnError extends boolean = true>(
   })
 
 /**
- * Pre-provision a tenant member
+ * Provision Tenant Member
+ *
+ * Required role: `admin` or higher.
  *
  * Add a member to the acting tenant by identity, before the user's first
  * login. The grant is dormant until that identity authenticates into the
@@ -1787,9 +1919,13 @@ export const addTenantUser = <ThrowOnError extends boolean = true>(
   })
 
 /**
- * Remove a tenant member
+ * Remove Tenant Member
+ *
+ * Required role: `admin` or higher.
  *
- * Remove a user from the acting tenant.
+ * Remove a user from the acting tenant. This drops their role now, but if the
+ * identity provider still grants them access they are re-added at the default
+ * role on their next login; revoke access at the provider for a durable block.
  */
 export const deleteTenantUser = <ThrowOnError extends boolean = true>(
   options: Options<DeleteTenantUserData, ThrowOnError>
@@ -1807,7 +1943,9 @@ export const deleteTenantUser = <ThrowOnError extends boolean = true>(
   })
 
 /**
- * Assign a member role
+ * Assign Member Role
+ *
+ * Required role: `admin` or higher.
  *
  * Assign or change a user's role in the acting tenant. The role is capped at
  * the caller's own role and may not be `owner`.
@@ -1831,7 +1969,9 @@ export const putTenantUser = <ThrowOnError extends boolean = true>(
 /**
  * List tenants
  *
- * List all tenants in the installation. Owner-only platform view.
+ * Required role: `owner`.
+ *
+ * List all tenants in the installation.
  */
 export const listTenants = <ThrowOnError extends boolean = true>(
   options?: Options<ListTenantsData, ThrowOnError>
@@ -1844,9 +1984,11 @@ export const listTenants = <ThrowOnError extends boolean = true>(
   })
 
 /**
- * Create a tenant
+ * Create Tenant
  *
- * Explicitly create a tenant (owner-only), rather than relying on first login.
+ * Required role: `owner`.
+ *
+ * Explicitly create a tenant, rather than relying on first login.
  * The tenant is keyed to the platform's configured OIDC issuer (statically set
  * at deploy time, e.g. via Helm), so that logins from that issuer resolve into
  * it; the issuer is not caller-settable. Fails with a conflict if a tenant with
@@ -1869,6 +2011,8 @@ export const createTenant = <ThrowOnError extends boolean = true>(
 /**
  * Validate Program
  *
+ * Required role: `read` or higher.
+ *
  * Validate a SQL program by compiling it, without creating a pipeline or
  * building the pipeline binary. Reports SQL errors and warnings and the derived
  * schema and connectors. Set `ir` to also return the program IR (dataflow).
diff --git a/js-packages/web-console/src/lib/services/manager/types.gen.ts b/js-packages/web-console/src/lib/services/manager/types.gen.ts
index 234da582ae9..386b079be63 100644
--- a/js-packages/web-console/src/lib/services/manager/types.gen.ts
+++ b/js-packages/web-console/src/lib/services/manager/types.gen.ts
@@ -32,7 +32,7 @@ export type AddMemberRequest = {
    * Optional email for display in the member list.
    */
   email?: string | null
-  role: Role
+  role: MemberRole
   /**
    * OIDC subject (matches the JWT `sub` claim). The issuer is not settable:
    * members authenticate through the platform's single configured issuer, so
@@ -77,7 +77,7 @@ export type AdhocQueryArgs = {
 export type ApiKeyDescr = {
   id: ApiKeyId
   name: string
-  role: Role
+  role: MintableKeyRole
 }
 
 /**
@@ -3079,6 +3079,13 @@ export type LicenseValidity =
       DoesNotExistOrNotConfirmed: string
     }
 
+/**
+ * A role assignable to a tenant member: `read`, `write`, or `admin`. `owner`
+ * is a platform-wide role, not a tenant membership, so it is not a valid value
+ * here.
+ */
+export type MemberRole = 'read' | 'write' | 'admin'
+
 /**
  * Memory pressure level.
  *
@@ -3114,6 +3121,13 @@ export type MetricsParameters = {
   format?: MetricsFormat
 }
 
+/**
+ * The role an API key carries: `read` or `write`. API keys cannot be granted
+ * `admin` or `owner`; those roles are held only by interactive logins and OIDC
+ * trust relationships.
+ */
+export type MintableKeyRole = 'read' | 'write'
+
 export type MirInput = {
   node: string
   output: number
@@ -3174,7 +3188,7 @@ export type NewApiKeyRequest = {
    * Key name.
    */
   name: string
-  role?: Role | null
+  role?: MintableKeyRole | null
 }
 
 /**
@@ -5300,10 +5314,6 @@ export type ServiceStatus = {
 }
 
 export type SessionInfo = {
-  /**
-   * Whether the caller is a platform owner.
-   */
-  is_owner: boolean
   role: Role
   tenant_id: TenantId
   /**
@@ -5316,7 +5326,7 @@ export type SessionInfo = {
  * Request to assign a role to a user within a tenant.
  */
 export type SetMemberRoleRequest = {
-  role: Role
+  role: MemberRole
 }
 
 /**
@@ -6340,8 +6350,8 @@ export type ListOidcTrustData = {
   path?: never
   query?: {
     /**
-     * Operate on platform-wide owner trusts (which belong to no tenant) instead
-     * of the caller's tenant. Owner-only.
+     * Select the platform-wide owner trusts, which belong to no tenant,
+     * instead of the trusts scoped to the caller's tenant. Owner-only.
      */
     platform?: boolean
   }
@@ -6349,6 +6359,10 @@ export type ListOidcTrustData = {
 }
 
 export type ListOidcTrustErrors = {
+  /**
+   * Caller's role is below the required role, or `platform` was set by a non-owner
+   */
+  403: ErrorResponse
   500: ErrorResponse
 }
 
@@ -6372,13 +6386,18 @@ export type PostOidcTrustData = {
 
 export type PostOidcTrustErrors = {
   /**
-   * Invalid request
+   * A required field is empty
    */
   400: ErrorResponse
+  /**
+   * Caller's role is below the required role, or the requested role exceeds the caller's own
+   */
+  403: ErrorResponse
   /**
    * Name already in use
    */
   409: ErrorResponse
+  500: ErrorResponse
 }
 
 export type PostOidcTrustError = PostOidcTrustErrors[keyof PostOidcTrustErrors]
@@ -6402,8 +6421,8 @@ export type DeleteOidcTrustData = {
   }
   query?: {
     /**
-     * Operate on platform-wide owner trusts (which belong to no tenant) instead
-     * of the caller's tenant. Owner-only.
+     * Select the platform-wide owner trusts, which belong to no tenant,
+     * instead of the trusts scoped to the caller's tenant. Owner-only.
      */
     platform?: boolean
   }
@@ -6411,10 +6430,15 @@ export type DeleteOidcTrustData = {
 }
 
 export type DeleteOidcTrustErrors = {
+  /**
+   * Caller's role is below the required role, or `platform` was set by a non-owner
+   */
+  403: ErrorResponse
   /**
    * No relationship with that name
    */
   404: ErrorResponse
+  500: ErrorResponse
 }
 
 export type DeleteOidcTrustError = DeleteOidcTrustErrors[keyof DeleteOidcTrustErrors]
@@ -6436,8 +6460,8 @@ export type GetOidcTrustData = {
   }
   query?: {
     /**
-     * Operate on platform-wide owner trusts (which belong to no tenant) instead
-     * of the caller's tenant. Owner-only.
+     * Select the platform-wide owner trusts, which belong to no tenant,
+     * instead of the trusts scoped to the caller's tenant. Owner-only.
      */
     platform?: boolean
   }
@@ -6445,10 +6469,15 @@ export type GetOidcTrustData = {
 }
 
 export type GetOidcTrustErrors = {
+  /**
+   * Caller's role is below the required role, or `platform` was set by a non-owner
+   */
+  403: ErrorResponse
   /**
    * No relationship with that name
    */
   404: ErrorResponse
+  500: ErrorResponse
 }
 
 export type GetOidcTrustError = GetOidcTrustErrors[keyof GetOidcTrustErrors]
@@ -8364,6 +8393,10 @@ export type ListTenantUsersData = {
 }
 
 export type ListTenantUsersErrors = {
+  /**
+   * Caller's role is below the required role
+   */
+  403: ErrorResponse
   500: ErrorResponse
 }
 
@@ -8387,9 +8420,10 @@ export type AddTenantUserData = {
 
 export type AddTenantUserErrors = {
   /**
-   * Requested role exceeds caller's role or is owner
+   * Caller's role is below the required role, or the requested role is `owner`
    */
   403: ErrorResponse
+  500: ErrorResponse
 }
 
 export type AddTenantUserError = AddTenantUserErrors[keyof AddTenantUserErrors]
@@ -8416,10 +8450,15 @@ export type DeleteTenantUserData = {
 }
 
 export type DeleteTenantUserErrors = {
+  /**
+   * Caller's role is below the required role
+   */
+  403: ErrorResponse
   /**
    * User is not a member
    */
   404: ErrorResponse
+  500: ErrorResponse
 }
 
 export type DeleteTenantUserError = DeleteTenantUserErrors[keyof DeleteTenantUserErrors]
@@ -8445,9 +8484,14 @@ export type PutTenantUserData = {
 
 export type PutTenantUserErrors = {
   /**
-   * Requested role exceeds caller's role or is owner
+   * Caller's role is below the required role, or the requested role is `owner`
    */
   403: ErrorResponse
+  /**
+   * No user with that identifier
+   */
+  404: ErrorResponse
+  500: ErrorResponse
 }
 
 export type PutTenantUserError = PutTenantUserErrors[keyof PutTenantUserErrors]
@@ -8467,6 +8511,10 @@ export type ListTenantsData = {
 }
 
 export type ListTenantsErrors = {
+  /**
+   * Caller is not a platform owner
+   */
+  403: ErrorResponse
   500: ErrorResponse
 }
 
@@ -8489,10 +8537,15 @@ export type CreateTenantData = {
 }
 
 export type CreateTenantErrors = {
+  /**
+   * Caller is not a platform owner
+   */
+  403: ErrorResponse
   /**
    * A tenant with that name already exists
    */
   409: ErrorResponse
+  500: ErrorResponse
 }
 
 export type CreateTenantError = CreateTenantErrors[keyof CreateTenantErrors]
diff --git a/js-packages/web-console/src/routes/+layout.ts b/js-packages/web-console/src/routes/+layout.ts
index 2a1ce43b681..c7273aa2c95 100644
--- a/js-packages/web-console/src/routes/+layout.ts
+++ b/js-packages/web-console/src/routes/+layout.ts
@@ -416,10 +416,11 @@ function buildFelderaData(
     revision: config.revision,
     tenantId: sessionConfig?.tenant_id || '',
     tenantName: sessionConfig?.tenant_name || '',
-    // `role`/`is_owner` are added by the RBAC backend; the SDK type lags, so read
-    // them off the session payload and default to the least-privileged role.
+    // `role` is added by the RBAC backend; the SDK type lags, so read it off the
+    // session payload and default to the least-privileged role. `owner` is the
+    // top role, so ownership is just that value.
     role: sessionConfig?.role || 'read',
-    isOwner: Boolean(sessionConfig?.is_owner),
+    isOwner: sessionConfig?.role === 'owner',
     authorizedTenants: computeAuthorizedTenants(auth),
     unstableFeatures: config.unstable_features?.split(',').map((f: string) => f.trim()) || [],
     config

From 7879f6ec4bbffe0fa3bbd4762f44589e029e3ecf Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Sat, 25 Jul 2026 23:00:33 -0700
Subject: [PATCH 18/55] [docs] Record the API-key default change and
 owner-trust precedence

Note in the changelog that a new key defaults to read, through both the REST API
and `fda apikey create`. Document on the Roles page that a matching owner trust
outranks a tenant-scoped trust for the same token, so a broad owner-trust
pattern promotes every workload it matches.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 docs.feldera.com/docs/changelog.md                        | 8 +++++---
 .../docs/get-started/enterprise/authentication/roles.md   | 8 ++++++++
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/docs.feldera.com/docs/changelog.md b/docs.feldera.com/docs/changelog.md
index ee87d3ab591..ab0a8c7ae5f 100644
--- a/docs.feldera.com/docs/changelog.md
+++ b/docs.feldera.com/docs/changelog.md
@@ -44,9 +44,11 @@ import TabItem from '@theme/TabItem';
           `scopes` field must read `role` instead. Existing keys are migrated to `write`,
           so their access is unchanged.
 
-        - Breaking change (API keys): `POST /v0/api_keys` without a `role` field now
-          creates a `read`-only key. Previously a new key carried read and write access.
-          Pass `{"role": "write"}` in the request body to keep the previous behavior.
+        - Breaking change (API keys): a new key now defaults to `read` instead of
+          carrying read and write access. `POST /v0/api_keys` without a `role` field
+          creates a `read`-only key; pass `{"role": "write"}` to keep the previous
+          behavior. `fda apikey create` defaults to `--role read` for the same reason;
+          pass `--role write` where a key needs to make changes.
 
         ## v0.322.0
 
diff --git a/docs.feldera.com/docs/get-started/enterprise/authentication/roles.md b/docs.feldera.com/docs/get-started/enterprise/authentication/roles.md
index 21a38fd42c8..2d22b546b92 100644
--- a/docs.feldera.com/docs/get-started/enterprise/authentication/roles.md
+++ b/docs.feldera.com/docs/get-started/enterprise/authentication/roles.md
@@ -42,6 +42,14 @@ can select the tenant it acts in with the `Feldera-Tenant` request header.
   [set-member-role API](/api/assign-member-role).
 - `owner` comes from the `owners` setting or an owner OIDC trust; it is never
   assigned as a tenant membership.
+- A federated token is matched against every trust registered for its issuer, and
+  the most permissive matching role wins. An owner trust outranks any
+  tenant-scoped trust the same token also matches, so a workload that a tenant
+  trust admits at `write` acts as `owner` once a matching owner trust exists.
+  Keep the subject and audience patterns on an owner trust narrow: only a
+  platform owner can create one, but a broad pattern promotes every workload it
+  matches. An owner trust always requires the `Feldera-Tenant` header to name the
+  tenant to act in.
 - An API key carries a role capped at its creator's role, limited to `read` or
   `write`.
 

From c1a29b09f1e8672cd38e7487753feb08ff9e5294 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Sat, 25 Jul 2026 23:00:33 -0700
Subject: [PATCH 19/55] [scripts] dummy_oidc: plain section comments

Drop the dashed rules around the section headers.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 scripts/dummy_oidc.py | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/scripts/dummy_oidc.py b/scripts/dummy_oidc.py
index 34b4b062fb6..4b7a1132b11 100755
--- a/scripts/dummy_oidc.py
+++ b/scripts/dummy_oidc.py
@@ -379,8 +379,7 @@ def _redirect(self, location: str) -> None:
             self.send_header("Content-Length", "0")
             self.end_headers()
 
-        # ---- /authorize: login page + code issuance --------------------------
-
+        # /authorize: login page + code issuance
         def _handle_authorize(self, query: dict[str, list[str]]) -> None:
             def one(name: str) -> str | None:
                 values = query.get(name)
@@ -421,8 +420,7 @@ def one(name: str) -> str | None:
                 params["state"] = state
             self._redirect(append_query(redirect_uri, params))
 
-        # ---- POST /token: code / refresh exchange ----------------------------
-
+        # POST /token: code / refresh exchange
         def _read_body_params(self) -> dict[str, str]:
             length = int(self.headers.get("Content-Length") or 0)
             raw = self.rfile.read(length) if length else b""
@@ -470,8 +468,7 @@ def _handle_token_post(self) -> None:
 
             self._send_json({"error": "unsupported_grant_type", "error_description": f"grant_type={grant_type}"}, 400)
 
-        # ---- GET /userinfo ---------------------------------------------------
-
+        # GET /userinfo
         def _handle_userinfo(self) -> None:
             auth = self.headers.get("Authorization", "")
             if not auth.startswith("Bearer "):
@@ -499,8 +496,7 @@ def _handle_userinfo(self) -> None:
                 info["tenants"] = claims["tenants"]
             self._send_json(info)
 
-        # ---- /logout ---------------------------------------------------------
-
+        # /logout
         def _handle_logout(self, query: dict[str, list[str]]) -> None:
             target = (query.get("post_logout_redirect_uri") or query.get("redirect_uri") or [None])[0]
             if target:
@@ -512,8 +508,7 @@ def _handle_logout(self, query: dict[str, list[str]]) -> None:
                 "<h1>Logged out</h1><p>You may close this window.</p></body></html>"
             )
 
-        # ---- dispatch --------------------------------------------------------
-
+        # dispatch
         def do_OPTIONS(self) -> None:  # noqa: N802 (http.server API)
             self.send_response(204)
             self._cors()

From 455e781c1742b85f12d6dd9af11a960aa3d8c258 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Sat, 25 Jul 2026 23:32:29 -0700
Subject: [PATCH 20/55] [pipeline-manager] Order tenant members
 deterministically

`ORDER BY u.email, u.subject` leaves the order unspecified when rows tie: two
identities can share a subject across providers, and both may have no email, so
the member list could come back in a different order on each call. Add
`u.provider`, which is unique with the subject, to break the tie.

Found by the model-based test added next: postgres and the model disagreed on
the order of two such members.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 crates/pipeline-manager/src/db/operations/user.rs | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/crates/pipeline-manager/src/db/operations/user.rs b/crates/pipeline-manager/src/db/operations/user.rs
index a659b64f627..ebebece8ac4 100644
--- a/crates/pipeline-manager/src/db/operations/user.rs
+++ b/crates/pipeline-manager/src/db/operations/user.rs
@@ -124,9 +124,12 @@ pub async fn list_tenant_members(
 ) -> Result<Vec<TenantMember>, DBError> {
     let stmt = txn
         .prepare_cached(
+            // `provider` breaks the tie: two identities can share a subject
+            // across providers, and both may have no email, which would
+            // otherwise leave the order for those rows unspecified.
             "SELECT u.id, u.provider, u.subject, u.email, m.role \
              FROM tenant_membership m JOIN app_user u ON u.id = m.user_id \
-             WHERE m.tenant_id = $1 ORDER BY u.email, u.subject",
+             WHERE m.tenant_id = $1 ORDER BY u.email, u.subject, u.provider",
         )
         .await?;
     let rows = txn.query(&stmt, &[&tenant_id.0]).await?;

From 48e23bc234523dae04be68822117364d2b60940f Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Sat, 25 Jul 2026 23:32:40 -0700
Subject: [PATCH 21/55] [pipeline-manager] Model-test OIDC trust and tenant
 membership

These operations were stubbed out of the model, so the proptest compared
nothing. Implement them in the model and compare them against postgres:
listing, reading, creating and deleting trusts in both scopes, the trusted-issuer
gate, claim matching, and the user and membership operations.

Runs as its own test rather than as more `StorageAction` variants. That enum and
the future its dispatch builds are already close to the test thread's stack
limit, and adding these actions overflowed it.

Two generator details earn their keep. Trust and user ids are derived from the
identity being created, as `Uuid::now_v7()` would be, because the shared
`limited_uuid` strategy yields so few values that rows collided on the primary
key instead of coexisting, which is what makes matching interesting. Scope and
role are drawn together so every generated trust satisfies the check tying the
platform scope to `owner`.

`resolve_login` stays out: it resolves a tenant by name and creates it when
absent, which the model does not represent. Its own tests cover it.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 .../proptest-regressions/db/test.txt          |   1 +
 crates/pipeline-manager/src/db/test.rs        | 648 ++++++++++++++++--
 crates/pipeline-manager/src/db/types/role.rs  |  11 +
 3 files changed, 610 insertions(+), 50 deletions(-)

diff --git a/crates/pipeline-manager/proptest-regressions/db/test.txt b/crates/pipeline-manager/proptest-regressions/db/test.txt
index 820125afb34..6fa40032404 100644
--- a/crates/pipeline-manager/proptest-regressions/db/test.txt
+++ b/crates/pipeline-manager/proptest-regressions/db/test.txt
@@ -50,3 +50,4 @@ cc db90e416d47dfca52aa161e45eb457083c8b2009dcce37f072d3173889981432 # shrinks to
 cc d6605e5647e1b5eb23391371a18f6138f0e7724dc9b45ea962d289cd6b3b5cc5 # shrinks to [NewPipeline(TenantId(01000000-0000-0000-0000-000000000000), 03000000-0000-0000-0000-000000000000, "v0", PipelineDescr { name: "pipeline-1", description: "", runtime_config: Object {"workers": Number(0), "hosts": Number(0), "storage": Null, "fault_tolerance": Object {"model": String("none"), "checkpoint_interval_secs": Number(60)}, "cpu_profiler": Bool(false), "tracing": Bool(false), "tracing_endpoint_jaeger": String(""), "min_batch_size_records": Number(0), "max_buffering_delay_usecs": Number(0), "resources": Object {"cpu_cores_min": Null, "cpu_cores_max": Null, "memory_mb_min": Null, "memory_mb_max": Null, "storage_mb_max": Null, "storage_class": Null, "service_account_name": Null, "namespace": Null}, "clock_resolution_usecs": Null, "pin_cpus": Array [], "provisioning_timeout_secs": Null, "max_parallel_connector_init": Null, "init_containers": Null, "checkpoint_during_suspend": Bool(false), "http_workers": Null, "io_workers": Null, "dev_tweaks": Object {}, "logging": Null, "pipeline_template_configmap": Null}, program_code: "", udf_rust: "", udf_toml: "", program_config: Object {"profile": String("optimized"), "cache": Bool(false), "runtime_version": Null} }), TransitDeploymentResourcesStatusToStopping(TenantId(01000000-0000-0000-0000-000000000000), PipelineId(03000000-0000-0000-0000-000000000000), Version(1), None, Some(Object {"checkpoints": Array [Object {"uuid": String("00000000-0000-0000-0000-000000000000"), "identifier": Null, "fingerprint": Number(0), "size": Null, "steps": Number(0), "processed_records": Null}]})), TransitDeploymentResourcesStatusToStopped(TenantId(01000000-0000-0000-0000-000000000000), PipelineId(03000000-0000-0000-0000-000000000000), Version(1)), TransitDeploymentResourcesStatusToStopping(TenantId(01000000-0000-0000-0000-000000000000), PipelineId(03000000-0000-0000-0000-000000000000), Version(1), None, None), ListPipelines(TenantId(01000000-0000-0000-0000-000000000000))]
 cc af5f43e12205b0f106500541375df16dbc3ddf92957d61c07b42fe005a94a72a # shrinks to [NewPipeline(TenantId(03000000-0000-0000-0000-000000000000), 01000000-0000-0000-0000-000000000000, "v0", PipelineDescr { name: "pipeline-2", description: "", runtime_config: Object {"workers": Number(0), "max_rss_mb": Null, "hosts": Number(0), "storage": Null, "fault_tolerance": Object {"model": String("none"), "checkpoint_interval_secs": Number(60)}, "cpu_profiler": Bool(false), "tracing": Bool(false), "tracing_endpoint_jaeger": String(""), "min_batch_size_records": Number(0), "max_buffering_delay_usecs": Number(0), "resources": Object {"cpu_cores_min": Null, "cpu_cores_max": Null, "memory_mb_min": Null, "memory_mb_max": Null, "storage_mb_max": Null, "storage_class": Null, "service_account_name": Null, "namespace": Null}, "clock_resolution_usecs": Null, "pin_cpus": Array [], "provisioning_timeout_secs": Null, "max_parallel_connector_init": Null, "init_containers": Null, "checkpoint_during_suspend": Bool(false), "http_workers": Null, "io_workers": Null, "env": Object {}, "dev_tweaks": Object {}, "logging": Null, "pipeline_template_configmap": Null}, program_code: "", udf_rust: "", udf_toml: "", program_config: Object {"profile": String("optimized"), "cache": Bool(false), "runtime_version": Null} }), SetDeploymentResourcesDesiredStatusProvisioned(TenantId(03000000-0000-0000-0000-000000000000), "pipeline-2", Paused, false), TransitDeploymentResourcesStatusToStopping(TenantId(03000000-0000-0000-0000-000000000000), PipelineId(01000000-0000-0000-0000-000000000000), Version(1), None, None), ListPipelineMonitorEvents(TenantId(03000000-0000-0000-0000-000000000000), "pipeline-2")]
 cc 72ce28e30d05cebfed4d1b616013a7691b7647ede4a800c8dcfb95f46d5655ce # shrinks to [NewOrUpdatePipeline(TenantId(03000000-0000-0000-0000-000000000000), 03000000-0000-0000-0000-000000000000, "pipeline-4", "v0", false, PipelineDescr { name: "pipeline-4", description: "", runtime_config: Object {"workers": Number(0), "max_rss_mb": Null, "hosts": Number(0), "storage": Null, "fault_tolerance": Object {"model": String("none"), "checkpoint_interval_secs": Number(60)}, "cpu_profiler": Bool(false), "tracing": Bool(false), "tracing_endpoint_jaeger": String(""), "min_batch_size_records": Number(0), "max_buffering_delay_usecs": Number(0), "resources": Object {"cpu_cores_min": Null, "cpu_cores_max": Null, "memory_mb_min": Null, "memory_mb_max": Null, "storage_mb_max": Null, "storage_class": Null, "service_account_name": Null, "namespace": Null}, "clock_resolution_usecs": Null, "pin_cpus": Array [], "provisioning_timeout_secs": Null, "max_parallel_connector_init": Null, "init_containers": Null, "checkpoint_during_suspend": Bool(false), "http_workers": Null, "io_workers": Null, "env": Object {}, "dev_tweaks": Object {}, "logging": Null, "pipeline_template_configmap": Null}, program_code: "", udf_rust: "", udf_toml: "", program_config: Object {"profile": String("optimized"), "cache": Bool(false), "runtime_version": Null} }), SetDeploymentResourcesDesiredStatusProvisioned(TenantId(03000000-0000-0000-0000-000000000000), "pipeline-4", Paused, false), TransitDeploymentResourcesStatusToStopping(TenantId(03000000-0000-0000-0000-000000000000), PipelineId(03000000-0000-0000-0000-000000000000), Version(1), None, Some(Object {"checkpoints": Array [Object {"uuid": String("00000000-0000-0000-0000-000000000000"), "identifier": Null, "fingerprint": Number(0), "size": Null, "steps": Number(0), "processed_records": Null}]})), DeletePipelineMonitorEventsExceedingRetention(1), GetLatestPipelineMonitorEventShort(TenantId(03000000-0000-0000-0000-000000000000), "pipeline-4")]
+cc 30e449939609250eff53fb4a7f479aee9715a0eb99ed7013ba8c167979b6e343 # shrinks to [CreateOidcTrust(TenantId(03000000-0000-0000-0000-000000000000), false, "trust-1", None, "https://idp1.example", "*", None, Read), CreateOidcTrust(TenantId(03000000-0000-0000-0000-000000000000), false, "trust-2", None, "https://idp1.example", "*", None, Write), MatchOidcTrust("https://idp1.example", "", [])]
diff --git a/crates/pipeline-manager/src/db/test.rs b/crates/pipeline-manager/src/db/test.rs
index 8d4f5acbaaa..d40bcba0444 100644
--- a/crates/pipeline-manager/src/db/test.rs
+++ b/crates/pipeline-manager/src/db/test.rs
@@ -11,6 +11,7 @@ use crate::db::types::monitor::{
     ExtendedPipelineMonitorEvent, MonitorStatus, NewClusterMonitorEvent, PipelineMonitorEvent,
     PipelineMonitorEventId,
 };
+use crate::db::types::oidc_trust::{claim_matches, OidcTrustDescr, OidcTrustId};
 use crate::db::types::pipeline::{
     ClientMetadata, ExtendedPipelineDescr, ExtendedPipelineDescrMonitoring, PatchClientMetadata,
     PipelineDescr, PipelineId,
@@ -24,14 +25,14 @@ use crate::db::types::resources_status::{
     validate_resources_desired_status_transition, validate_resources_status_transition,
     ResourcesDesiredStatus, ResourcesStatus,
 };
-use crate::db::types::role::{MintableKeyRole, Role};
+use crate::db::types::role::{MemberRole, MintableKeyRole, Role};
 use crate::db::types::storage::{validate_storage_status_transition, StorageStatus};
 use crate::db::types::tenant::TenantId;
 use crate::db::types::user::{TenantInfo, TenantMember, UserId};
 use crate::db::types::utils::{
-    validate_api_key_name, validate_deployment_config, validate_pipeline_name,
-    validate_program_config, validate_program_info, validate_runtime_config,
-    validate_storage_status_details, MAXIMUM_TAG_LENGTH,
+    validate_api_key_name, validate_deployment_config, validate_oidc_trust_name,
+    validate_pipeline_name, validate_program_config, validate_program_info,
+    validate_runtime_config, validate_storage_status_details, MAXIMUM_TAG_LENGTH,
 };
 use crate::db::types::version::Version;
 use async_trait::async_trait;
@@ -299,6 +300,100 @@ fn map_val_to_limited_pipeline_name(val: PipelineNamePropVal) -> String {
     }
 }
 
+/// Generates a limited OIDC trust name (1/4 is invalid).
+fn limited_oidc_trust_name() -> impl Strategy<Value = String> {
+    any::<u8>().prop_map(|val| match val % 4 {
+        0 => "".to_string(), // An invalid trust name
+        n => format!("trust-{n}"),
+    })
+}
+
+/// Generates one of a few issuers, so that trusts collide on issuer often
+/// enough to exercise matching and the trusted-issuer gate.
+fn limited_issuer() -> impl Strategy<Value = String> {
+    any::<u8>().prop_map(|val| match val % 3 {
+        0 => "".to_string(), // An invalid (empty) issuer
+        n => format!("https://idp{n}.example"),
+    })
+}
+
+/// Generates a claim pattern, mixing concrete values with `*` wildcards so that
+/// matching is exercised in both directions.
+fn limited_claim_pattern() -> impl Strategy<Value = String> {
+    any::<u8>().prop_map(|val| {
+        match val % 6 {
+            0 => "".to_string(), // An invalid (empty) subject pattern
+            1 => "*".to_string(),
+            2 => "repo:acme/*".to_string(),
+            3 => "repo:acme/api".to_string(),
+            4 => "*:prod".to_string(),
+            _ => "system:sa:*:default".to_string(),
+        }
+    })
+}
+
+/// Generates a concrete claim value to match patterns against.
+fn limited_claim_value() -> impl Strategy<Value = String> {
+    any::<u8>().prop_map(|val| match val % 5 {
+        0 => "".to_string(),
+        1 => "repo:acme/api".to_string(),
+        2 => "repo:acme/api:prod".to_string(),
+        3 => "system:sa:kube:default".to_string(),
+        _ => "other".to_string(),
+    })
+}
+
+/// Generates a limited OIDC identity `(provider, subject)`, small enough that
+/// the same identity recurs and exercises the get-or-create path.
+fn limited_identity() -> impl Strategy<Value = (String, String)> {
+    (any::<u8>(), any::<u8>()).prop_map(|(p, s)| {
+        (
+            format!("https://idp{}.example", p % 2),
+            format!("user-{}", s % 3),
+        )
+    })
+}
+
+/// The user id a caller would mint for an identity. Callers pass a fresh
+/// `Uuid::now_v7()`, so two identities never share one; deriving the id from the
+/// identity keeps that true here, where `limited_uuid` would collide and hit a
+/// primary-key violation instead of the get-or-create path under test.
+fn user_id_for_identity(provider: &str, subject: &str) -> Uuid {
+    use std::hash::{Hash, Hasher};
+    let mut hasher = std::collections::hash_map::DefaultHasher::new();
+    provider.hash(&mut hasher);
+    subject.hash(&mut hasher);
+    let half = hasher.finish().to_be_bytes();
+    let mut bytes = [0u8; 16];
+    bytes[..8].copy_from_slice(&half);
+    bytes[8..].copy_from_slice(&half);
+    Uuid::from_bytes(bytes)
+}
+
+/// The id a caller would mint for a trust. Distinct trusts get distinct ids, as
+/// `Uuid::now_v7()` would give them, so that several can coexist; re-creating
+/// the same trust reuses the id and collides on the name, as intended.
+fn trust_id_for(platform: bool, name: &str) -> Uuid {
+    use std::hash::{Hash, Hasher};
+    let mut hasher = std::collections::hash_map::DefaultHasher::new();
+    platform.hash(&mut hasher);
+    name.hash(&mut hasher);
+    let half = hasher.finish().to_be_bytes();
+    let mut bytes = [0u8; 16];
+    bytes[..8].copy_from_slice(&half);
+    bytes[8..].copy_from_slice(&half);
+    Uuid::from_bytes(bytes)
+}
+
+/// Generates an optional email, including the absent case that exercises the
+/// COALESCE on update and the NULL ordering in the member listing.
+fn limited_email() -> impl Strategy<Value = Option<String>> {
+    any::<u8>().prop_map(|val| match val % 3 {
+        0 => None,
+        n => Some(format!("user{n}@example.com")),
+    })
+}
+
 /// Generates a limited runtime configuration (1/8 is invalid).
 fn map_val_to_limited_runtime_config(val: RuntimeConfigPropVal) -> serde_json::Value {
     if val.invalid0.is_multiple_of(8) {
@@ -3522,6 +3617,243 @@ async fn pipeline_concurrent_access_deadlock() {
 //////////////////////////////////////////////////////////////////////////////
 /////                           PROP TESTS                               /////
 
+/// Compare the model and the implementation for one OIDC trust or membership
+/// action. Kept out of the main dispatch loop so its locals do not add to that
+/// already very large future.
+async fn check_rbac_action(
+    i: usize,
+    model: &Mutex<DbModel>,
+    handle: &DbHandle,
+    action: RbacAction,
+) {
+    match action {
+        RbacAction::ListOidcTrust(tenant_id, platform) => {
+            create_tenants_if_not_exists(model, handle, tenant_id)
+                .await
+                .unwrap();
+            let scope = if platform { None } else { Some(tenant_id) };
+            let mut model_response = model.list_oidc_trust(scope).await.unwrap();
+            let mut impl_response = handle.db.list_oidc_trust(scope).await.unwrap();
+            model_response.sort_by(|a, b| a.name.cmp(&b.name));
+            impl_response.sort_by(|a, b| a.name.cmp(&b.name));
+            assert_eq!(model_response, impl_response);
+        }
+        RbacAction::GetOidcTrust(tenant_id, platform, name) => {
+            create_tenants_if_not_exists(model, handle, tenant_id)
+                .await
+                .unwrap();
+            let scope = if platform { None } else { Some(tenant_id) };
+            let model_response = model.get_oidc_trust(scope, &name).await;
+            let impl_response = handle.db.get_oidc_trust(scope, &name).await;
+            check_responses(i, model_response, impl_response);
+        }
+        RbacAction::DeleteOidcTrust(tenant_id, platform, name) => {
+            create_tenants_if_not_exists(model, handle, tenant_id)
+                .await
+                .unwrap();
+            let scope = if platform { None } else { Some(tenant_id) };
+            let model_response = model.delete_oidc_trust(scope, &name).await;
+            let impl_response = handle.db.delete_oidc_trust(scope, &name).await;
+            check_responses(i, model_response, impl_response);
+        }
+        RbacAction::CreateOidcTrust(
+            tenant_id,
+            platform,
+            name,
+            description,
+            issuer,
+            subject,
+            audience,
+            role,
+        ) => {
+            create_tenants_if_not_exists(model, handle, tenant_id)
+                .await
+                .unwrap();
+            let id = trust_id_for(platform, &name);
+            // The schema ties the platform scope to `owner`.
+            let (scope, role) = if platform {
+                (None, Role::Owner)
+            } else {
+                (Some(tenant_id), role.role())
+            };
+            let model_response = model
+                .create_oidc_trust(
+                    scope,
+                    id,
+                    &name,
+                    description.as_deref(),
+                    &issuer,
+                    &subject,
+                    audience.as_deref(),
+                    role,
+                )
+                .await;
+            let impl_response = handle
+                .db
+                .create_oidc_trust(
+                    scope,
+                    id,
+                    &name,
+                    description.as_deref(),
+                    &issuer,
+                    &subject,
+                    audience.as_deref(),
+                    role,
+                )
+                .await;
+            check_responses(i, model_response, impl_response);
+        }
+        RbacAction::IsTrustedIssuer(issuer) => {
+            let model_response = model.is_trusted_issuer(&issuer).await;
+            let impl_response = handle.db.is_trusted_issuer(&issuer).await;
+            check_responses(i, model_response, impl_response);
+        }
+        RbacAction::MatchOidcTrust(issuer, subject, audiences) => {
+            let model_response = model.match_oidc_trust(&issuer, &subject, &audiences).await;
+            let impl_response = handle
+                .db
+                .match_oidc_trust(&issuer, &subject, &audiences)
+                .await;
+            check_responses(i, model_response, impl_response);
+        }
+        RbacAction::ListTenants => {
+            let mut model_response = model.list_tenants().await.unwrap();
+            let mut impl_response = handle.db.list_tenants().await.unwrap();
+            model_response.sort_by(|a, b| a.id.cmp(&b.id));
+            impl_response.sort_by(|a, b| a.id.cmp(&b.id));
+            assert_eq!(model_response, impl_response);
+        }
+        RbacAction::GetOrCreateUser((provider, subject), email) => {
+            let id = user_id_for_identity(&provider, &subject);
+            let model_response = model
+                .get_or_create_user(id, &provider, &subject, email.as_deref())
+                .await;
+            let impl_response = handle
+                .db
+                .get_or_create_user(id, &provider, &subject, email.as_deref())
+                .await;
+            check_responses(i, model_response, impl_response);
+        }
+        RbacAction::ListTenantMembers(tenant_id) => {
+            create_tenants_if_not_exists(model, handle, tenant_id)
+                .await
+                .unwrap();
+            let model_response = model.list_tenant_members(tenant_id).await;
+            let impl_response = handle.db.list_tenant_members(tenant_id).await;
+            check_responses(i, model_response, impl_response);
+        }
+        RbacAction::UpsertMemberRole(tenant_id, (provider, subject), role) => {
+            let user_id = user_id_for_identity(&provider, &subject);
+            create_tenants_if_not_exists(model, handle, tenant_id)
+                .await
+                .unwrap();
+            let model_response = model
+                .upsert_member_role(tenant_id, UserId(user_id), role.role())
+                .await;
+            let impl_response = handle
+                .db
+                .upsert_member_role(tenant_id, UserId(user_id), role.role())
+                .await;
+            check_responses(i, model_response, impl_response);
+        }
+        RbacAction::RemoveMember(tenant_id, (provider, subject)) => {
+            let user_id = user_id_for_identity(&provider, &subject);
+            create_tenants_if_not_exists(model, handle, tenant_id)
+                .await
+                .unwrap();
+            let model_response = model.remove_member(tenant_id, UserId(user_id)).await;
+            let impl_response = handle.db.remove_member(tenant_id, UserId(user_id)).await;
+            check_responses(i, model_response, impl_response);
+        }
+        RbacAction::PreprovisionMember(tenant_id, (provider, subject), email, role) => {
+            let new_user_id = user_id_for_identity(&provider, &subject);
+            create_tenants_if_not_exists(model, handle, tenant_id)
+                .await
+                .unwrap();
+            let model_response = model
+                .preprovision_member(
+                    new_user_id,
+                    tenant_id,
+                    &provider,
+                    &subject,
+                    email.as_deref(),
+                    role.role(),
+                )
+                .await;
+            let impl_response = handle
+                .db
+                .preprovision_member(
+                    new_user_id,
+                    tenant_id,
+                    &provider,
+                    &subject,
+                    email.as_deref(),
+                    role.role(),
+                )
+                .await;
+            check_responses(i, model_response, impl_response);
+        }
+    }
+}
+
+/// Actions covering OIDC trust relationships and tenant membership.
+#[derive(Debug, Clone, Arbitrary)]
+enum RbacAction {
+    // OIDC trust relationships. `platform` selects the platform-wide owner
+    // scope, which the schema ties to the `owner` role; the tenant scope takes
+    // any assignable role. Generating the pair together keeps every action
+    // inside the `oidc_trust_owner_is_platform` check.
+    ListOidcTrust(TenantId, bool),
+    GetOidcTrust(
+        TenantId,
+        bool,
+        #[proptest(strategy = "limited_oidc_trust_name()")] String,
+    ),
+    DeleteOidcTrust(
+        TenantId,
+        bool,
+        #[proptest(strategy = "limited_oidc_trust_name()")] String,
+    ),
+    CreateOidcTrust(
+        TenantId,
+        bool,
+        #[proptest(strategy = "limited_oidc_trust_name()")] String,
+        Option<String>,
+        #[proptest(strategy = "limited_issuer()")] String,
+        #[proptest(strategy = "limited_claim_pattern()")] String,
+        #[proptest(strategy = "proptest::option::of(limited_claim_pattern())")] Option<String>,
+        MemberRole,
+    ),
+    IsTrustedIssuer(#[proptest(strategy = "limited_issuer()")] String),
+    MatchOidcTrust(
+        #[proptest(strategy = "limited_issuer()")] String,
+        #[proptest(strategy = "limited_claim_value()")] String,
+        #[proptest(strategy = "prop::collection::vec(limited_claim_value(), 0..3)")] Vec<String>,
+    ),
+    // Users and tenant memberships
+    ListTenants,
+    GetOrCreateUser(
+        #[proptest(strategy = "limited_identity()")] (String, String),
+        #[proptest(strategy = "limited_email()")] Option<String>,
+    ),
+    ListTenantMembers(TenantId),
+    UpsertMemberRole(
+        TenantId,
+        #[proptest(strategy = "limited_identity()")] (String, String),
+        MemberRole,
+    ),
+    RemoveMember(
+        TenantId,
+        #[proptest(strategy = "limited_identity()")] (String, String),
+    ),
+    PreprovisionMember(
+        TenantId,
+        #[proptest(strategy = "limited_identity()")] (String, String),
+        #[proptest(strategy = "limited_email()")] Option<String>,
+        MemberRole,
+    ),
+}
+
 /// Actions we can do on the Storage trait.
 #[derive(Debug, Clone, Arbitrary)]
 enum StorageAction {
@@ -4206,6 +4538,9 @@ fn db_impl_behaves_like_model() {
                     pipelines: BTreeMap::new(),
                     pipeline_events: BTreeMap::new(),
                     cluster_events: BTreeMap::new(),
+                    oidc_trusts: BTreeMap::new(),
+                    users: BTreeMap::new(),
+                    memberships: BTreeMap::new(),
                 });
                 runtime.block_on(async {
                     // We empty all tables in the database before each test
@@ -4582,6 +4917,65 @@ fn db_impl_behaves_like_model() {
     }
 }
 
+/// Compares the OIDC trust and tenant-membership operations against the model.
+///
+/// Kept separate from `db_impl_behaves_like_model` rather than folded into
+/// `StorageAction`: that enum and the future its dispatch builds are already
+/// near the test thread's stack limit, and adding these actions overflowed it.
+#[test]
+#[allow(clippy::field_reassign_with_default)]
+fn rbac_db_impl_behaves_like_model() {
+    let _ = tracing_subscriber::fmt::try_init();
+    let runtime = tokio::runtime::Runtime::new().unwrap();
+    let handle = runtime.block_on(async { test_setup().await });
+
+    let mut config = Config::default();
+    config.max_shrink_iters = u32::MAX;
+    config.source_file = Some("src/db/test.rs");
+    let mut runner = TestRunner::new(config);
+    let res = runner.run(
+        &prop::collection::vec(any::<RbacAction>(), 0..64),
+        |actions: Vec<RbacAction>| {
+            let model = Mutex::new(DbModel {
+                tenants: BTreeMap::new(),
+                api_keys: BTreeMap::new(),
+                pipelines: BTreeMap::new(),
+                pipeline_events: BTreeMap::new(),
+                cluster_events: BTreeMap::new(),
+                oidc_trusts: BTreeMap::new(),
+                users: BTreeMap::new(),
+                memberships: BTreeMap::new(),
+            });
+            runtime.block_on(async {
+                handle
+                    .db
+                    .pool
+                    .get()
+                    .await
+                    .unwrap()
+                    .execute(
+                        "DO $$ DECLARE r RECORD;
+                            BEGIN
+                                FOR r IN (SELECT tablename FROM pg_tables WHERE schemaname = current_schema()) LOOP
+                                EXECUTE 'TRUNCATE TABLE ' || quote_ident(r.tablename) || ' RESTART IDENTITY CASCADE';
+                                END LOOP;
+                            END $$;",
+                        &[],
+                    )
+                    .await
+                    .unwrap();
+                for (i, action) in actions.into_iter().enumerate() {
+                    check_rbac_action(i, &model, &handle, action).await;
+                }
+            });
+            Ok(())
+        },
+    );
+    if let Err(e) = res {
+        panic!("{e:#}");
+    }
+}
+
 /// Model of the database to which its operations are compared.
 #[derive(Debug)]
 struct DbModel {
@@ -4590,6 +4984,13 @@ struct DbModel {
     pub pipelines: BTreeMap<(TenantId, PipelineId), ExtendedPipelineDescr>,
     pub pipeline_events: BTreeMap<(TenantId, PipelineId), Vec<ExtendedPipelineMonitorEvent>>,
     pub cluster_events: BTreeMap<ClusterMonitorEventId, ExtendedClusterMonitorEvent>,
+    /// Keyed by scope and name, mirroring the table's uniqueness: `None` is the
+    /// platform-wide owner scope, `Some(t)` a tenant's own trusts.
+    pub oidc_trusts: BTreeMap<(Option<TenantId>, String), OidcTrustDescr>,
+    /// Keyed by the `(provider, subject)` identity, holding the user's id and
+    /// the email last seen for it.
+    pub users: BTreeMap<(String, String), (UserId, Option<String>)>,
+    pub memberships: BTreeMap<(TenantId, UserId), Role>,
 }
 
 #[async_trait]
@@ -5157,58 +5558,129 @@ impl Storage for Mutex<DbModel> {
         }
     }
 
-    // OIDC trust relationships are not exercised by the proptest model.
     async fn list_oidc_trust(
         &self,
-        _tenant_id: Option<TenantId>,
+        tenant_id: Option<TenantId>,
     ) -> DBResult<Vec<crate::db::types::oidc_trust::OidcTrustDescr>> {
-        Ok(vec![])
+        let s = self.lock().await;
+        Ok(s.oidc_trusts
+            .iter()
+            .filter(
+                |((scope, _), _): &(&(Option<TenantId>, String), &OidcTrustDescr)| {
+                    *scope == tenant_id
+                },
+            )
+            .map(|(_, descr)| descr.clone())
+            .collect())
     }
 
     async fn get_oidc_trust(
         &self,
-        _tenant_id: Option<TenantId>,
+        tenant_id: Option<TenantId>,
         name: &str,
     ) -> DBResult<crate::db::types::oidc_trust::OidcTrustDescr> {
-        Err(DBError::UnknownOidcTrust {
-            name: name.to_string(),
-        })
+        let s = self.lock().await;
+        s.oidc_trusts
+            .get(&(tenant_id, name.to_string()))
+            .cloned()
+            .ok_or(DBError::UnknownOidcTrust {
+                name: name.to_string(),
+            })
     }
 
-    async fn delete_oidc_trust(&self, _tenant_id: Option<TenantId>, name: &str) -> DBResult<()> {
-        Err(DBError::UnknownOidcTrust {
-            name: name.to_string(),
-        })
+    async fn delete_oidc_trust(&self, tenant_id: Option<TenantId>, name: &str) -> DBResult<()> {
+        let mut s = self.lock().await;
+        s.oidc_trusts
+            .remove(&(tenant_id, name.to_string()))
+            .map(|_| ())
+            .ok_or(DBError::UnknownOidcTrust {
+                name: name.to_string(),
+            })
     }
 
+    #[allow(clippy::too_many_arguments)]
     async fn create_oidc_trust(
         &self,
-        _tenant_id: Option<TenantId>,
-        _id: Uuid,
-        _name: &str,
-        _description: Option<&str>,
-        _issuer: &str,
-        _subject: &str,
-        _audience: Option<&str>,
-        _role: Role,
+        tenant_id: Option<TenantId>,
+        id: Uuid,
+        name: &str,
+        description: Option<&str>,
+        issuer: &str,
+        subject: &str,
+        audience: Option<&str>,
+        role: Role,
     ) -> DBResult<()> {
+        validate_oidc_trust_name(name)?;
+        if issuer.is_empty() {
+            return Err(DBError::EmptyOidcTrustField {
+                field: "issuer".to_string(),
+            });
+        }
+        if subject.is_empty() {
+            return Err(DBError::EmptyOidcTrustField {
+                field: "subject".to_string(),
+            });
+        }
+        let mut s = self.lock().await;
+        // Postgres checks the unique indexes (primary key and the name indexes)
+        // during the insert and the foreign key only at the end of the
+        // statement, so uniqueness is reported first. Both index violations map
+        // to the same error, so their relative order does not matter.
+        let duplicate_id = s.oidc_trusts.values().any(|d| d.id.0 == id);
+        if duplicate_id || s.oidc_trusts.contains_key(&(tenant_id, name.to_string())) {
+            return Err(DBError::DuplicateName);
+        }
+        if let Some(t) = tenant_id {
+            if !s.tenants.contains_key(&t) {
+                return Err(DBError::UnknownTenant { tenant_id: t });
+            }
+        }
+        s.oidc_trusts.insert(
+            (tenant_id, name.to_string()),
+            OidcTrustDescr {
+                id: OidcTrustId(id),
+                name: name.to_string(),
+                description: description.map(str::to_string),
+                issuer: issuer.to_string(),
+                subject: subject.to_string(),
+                audience: audience.map(str::to_string),
+                role,
+            },
+        );
         Ok(())
     }
 
-    async fn is_trusted_issuer(&self, _issuer: &str) -> DBResult<bool> {
-        Ok(false)
+    async fn is_trusted_issuer(&self, issuer: &str) -> DBResult<bool> {
+        let s = self.lock().await;
+        Ok(s.oidc_trusts.values().any(|d| d.issuer == issuer))
     }
 
     async fn match_oidc_trust(
         &self,
-        _issuer: &str,
-        _subject: &str,
-        _audiences: &[String],
+        issuer: &str,
+        subject: &str,
+        audiences: &[String],
     ) -> DBResult<Vec<(Option<TenantId>, Role)>> {
-        Ok(vec![])
+        let s = self.lock().await;
+        let mut matched: Vec<(Option<TenantId>, Role)> = Vec::new();
+        for ((scope, _), descr) in s.oidc_trusts.iter() {
+            if descr.issuer != issuer || !claim_matches(&descr.subject, subject) {
+                continue;
+            }
+            if let Some(pattern) = &descr.audience {
+                if !audiences.iter().any(|a| claim_matches(pattern, a)) {
+                    continue;
+                }
+            }
+            match matched.iter_mut().find(|(t, _)| t == scope) {
+                Some(entry) => entry.1 = entry.1.max(descr.role),
+                None => matched.push((*scope, descr.role)),
+            }
+        }
+        matched.sort_by_key(|(t, _)| t.map(|x| x.0));
+        Ok(matched)
     }
 
-    // RBAC user/membership methods are not exercised by the proptest model.
     async fn resolve_tenant_selector(&self, selector: &str) -> DBResult<TenantId> {
         let s = self.lock().await;
         if let Ok(uuid) = Uuid::parse_str(selector) {
@@ -5228,9 +5700,24 @@ impl Storage for Mutex<DbModel> {
     }
 
     async fn list_tenants(&self) -> DBResult<Vec<TenantInfo>> {
-        Ok(vec![])
+        let s = self.lock().await;
+        Ok(s.tenants
+            .iter()
+            .map(|(id, t)| TenantInfo {
+                id: *id,
+                name: t.tenant.clone(),
+                provider: t.provider.clone(),
+            })
+            .collect())
     }
 
+    /// `resolve_login` is left out of the model: it resolves a tenant by
+    /// `(name, provider)` and creates it when absent, whereas the model takes
+    /// tenant ids straight from proptest and so does not model tenant creation
+    /// by name (see `get_or_create_tenant_id`). It is covered instead by the
+    /// targeted tests `rbac_login_resolution_and_membership`,
+    /// `rbac_first_user_role_configurable` and
+    /// `preprovision_member_survives_first_login`.
     #[allow(clippy::too_many_arguments)]
     async fn resolve_login(
         &self,
@@ -5249,42 +5736,103 @@ impl Storage for Mutex<DbModel> {
     async fn get_or_create_user(
         &self,
         new_id: Uuid,
-        _provider: &str,
-        _subject: &str,
-        _email: Option<&str>,
+        provider: &str,
+        subject: &str,
+        email: Option<&str>,
     ) -> DBResult<UserId> {
-        Ok(UserId(new_id))
+        let mut s = self.lock().await;
+        let key = (provider.to_string(), subject.to_string());
+        match s.users.get_mut(&key) {
+            Some((id, stored_email)) => {
+                // COALESCE: a token without an email leaves the stored one be.
+                if let Some(email) = email {
+                    *stored_email = Some(email.to_string());
+                }
+                Ok(*id)
+            }
+            None => {
+                let id = UserId(new_id);
+                s.users.insert(key, (id, email.map(str::to_string)));
+                Ok(id)
+            }
+        }
     }
 
-    async fn list_tenant_members(&self, _tenant_id: TenantId) -> DBResult<Vec<TenantMember>> {
-        Ok(vec![])
+    async fn list_tenant_members(&self, tenant_id: TenantId) -> DBResult<Vec<TenantMember>> {
+        let s = self.lock().await;
+        let mut members: Vec<TenantMember> = s
+            .memberships
+            .iter()
+            .filter(|((t, _), _)| *t == tenant_id)
+            .filter_map(|((_, user_id), role)| {
+                s.users.iter().find(|(_, (id, _))| id == user_id).map(
+                    |((provider, subject), (id, email))| TenantMember {
+                        user_id: *id,
+                        provider: provider.clone(),
+                        subject: subject.clone(),
+                        email: email.clone(),
+                        role: *role,
+                    },
+                )
+            })
+            .collect();
+        // ORDER BY u.email, u.subject, u.provider. Postgres sorts NULLs last
+        // ascending, whereas `Option::None` sorts first in Rust, so lead the
+        // key with `email.is_none()` to match.
+        members.sort_by(|a, b| {
+            (a.email.is_none(), &a.email, &a.subject, &a.provider).cmp(&(
+                b.email.is_none(),
+                &b.email,
+                &b.subject,
+                &b.provider,
+            ))
+        });
+        Ok(members)
     }
 
     async fn upsert_member_role(
         &self,
-        _tenant_id: TenantId,
-        _user_id: UserId,
-        _role: Role,
+        tenant_id: TenantId,
+        user_id: UserId,
+        role: Role,
     ) -> DBResult<()> {
+        let mut s = self.lock().await;
+        if !s.tenants.contains_key(&tenant_id) {
+            return Err(DBError::UnknownTenant { tenant_id });
+        }
+        if !s.users.values().any(|(id, _)| *id == user_id) {
+            return Err(DBError::UnknownUser {
+                user_id: user_id.to_string(),
+            });
+        }
+        s.memberships.insert((tenant_id, user_id), role);
         Ok(())
     }
 
-    async fn remove_member(&self, _tenant_id: TenantId, user_id: UserId) -> DBResult<()> {
-        Err(DBError::UnknownUser {
-            user_id: user_id.to_string(),
-        })
+    async fn remove_member(&self, tenant_id: TenantId, user_id: UserId) -> DBResult<()> {
+        let mut s = self.lock().await;
+        s.memberships
+            .remove(&(tenant_id, user_id))
+            .map(|_| ())
+            .ok_or(DBError::UnknownUser {
+                user_id: user_id.to_string(),
+            })
     }
 
     async fn preprovision_member(
         &self,
         new_user_id: Uuid,
-        _tenant_id: TenantId,
-        _provider: &str,
-        _subject: &str,
-        _email: Option<&str>,
-        _role: Role,
+        tenant_id: TenantId,
+        provider: &str,
+        subject: &str,
+        email: Option<&str>,
+        role: Role,
     ) -> DBResult<UserId> {
-        Ok(UserId(new_user_id))
+        let user_id = self
+            .get_or_create_user(new_user_id, provider, subject, email)
+            .await?;
+        self.upsert_member_role(tenant_id, user_id, role).await?;
+        Ok(user_id)
     }
 
     async fn list_pipelines(
diff --git a/crates/pipeline-manager/src/db/types/role.rs b/crates/pipeline-manager/src/db/types/role.rs
index 29da359d3ec..cee982e8585 100644
--- a/crates/pipeline-manager/src/db/types/role.rs
+++ b/crates/pipeline-manager/src/db/types/role.rs
@@ -97,6 +97,7 @@ pub enum MintableKeyRole {
 /// is a platform-wide role, not a tenant membership, so it is not a valid value
 /// here.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, ToSchema)]
+#[cfg_attr(test, derive(proptest_derive::Arbitrary))]
 #[serde(rename_all = "lowercase")]
 pub enum MemberRole {
     Read,
@@ -104,6 +105,16 @@ pub enum MemberRole {
     Admin,
 }
 
+impl MemberRole {
+    pub fn role(self) -> Role {
+        match self {
+            MemberRole::Read => Role::Read,
+            MemberRole::Write => Role::Write,
+            MemberRole::Admin => Role::Admin,
+        }
+    }
+}
+
 impl MintableKeyRole {
     /// Narrow a `Role` to a key-mintable role, rejecting `admin`/`owner`.
     pub fn from_role(role: Role) -> Option<Self> {

From ce1a1cebda411fefc20cd44d4e8d26a7c6d18084 Mon Sep 17 00:00:00 2001
From: feldera-bot <feldera-bot@feldera.com>
Date: Sun, 26 Jul 2026 06:45:12 +0000
Subject: [PATCH 22/55] [ci] apply automatic fixes

Signed-off-by: feldera-bot <feldera-bot@feldera.com>
---
 python/feldera/rest/errors.py              |  4 +-
 python/tests/unit/test_callable_api_key.py |  2 +-
 scripts/dummy_oidc.py                      | 86 ++++++++++++++++++----
 scripts/rbac_demo.py                       | 70 ++++++++++++++----
 4 files changed, 130 insertions(+), 32 deletions(-)

diff --git a/python/feldera/rest/errors.py b/python/feldera/rest/errors.py
index 1f9acab913a..7fec2d81f03 100644
--- a/python/feldera/rest/errors.py
+++ b/python/feldera/rest/errors.py
@@ -79,7 +79,9 @@ def __init__(self, error: str, request: Response) -> None:
         if int(request.status_code) == 401:
             parsed = urlparse(request.request.url)
 
-            auth_err = f"\nAuthorization error at '{parsed.scheme}://{parsed.hostname}': "
+            auth_err = (
+                f"\nAuthorization error at '{parsed.scheme}://{parsed.hostname}': "
+            )
             auth = request.request.headers.get("Authorization")
             if auth is None:
                 err_msg += f"{auth_err}no credential provided"
diff --git a/python/tests/unit/test_callable_api_key.py b/python/tests/unit/test_callable_api_key.py
index 28cdfdd3bc6..c1c8beba7ad 100644
--- a/python/tests/unit/test_callable_api_key.py
+++ b/python/tests/unit/test_callable_api_key.py
@@ -4,7 +4,7 @@
 from __future__ import annotations
 
 from contextlib import contextmanager
-from typing import Iterable, List, Optional
+from typing import Iterable, Optional
 from unittest import mock
 
 import pytest
diff --git a/scripts/dummy_oidc.py b/scripts/dummy_oidc.py
index 4b7a1132b11..2f7e57939cf 100755
--- a/scripts/dummy_oidc.py
+++ b/scripts/dummy_oidc.py
@@ -90,7 +90,9 @@ class KeyMaterial:
     """RSA-2048 keypair plus the JWK/PEM views the server needs."""
 
     def __init__(self) -> None:
-        self.private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+        self.private_key = rsa.generate_private_key(
+            public_exponent=65537, key_size=2048
+        )
         self.private_pem = self.private_key.private_bytes(
             encoding=serialization.Encoding.PEM,
             format=serialization.PrivateFormat.PKCS8,
@@ -111,7 +113,9 @@ def __init__(self) -> None:
         }
 
 
-def make_handler(keys: KeyMaterial, issuer: str, default_audience: str, demo_tenants: list[str]):
+def make_handler(
+    keys: KeyMaterial, issuer: str, default_audience: str, demo_tenants: list[str]
+):
     """Build a request handler bound to one keypair and issuer.
 
     `demo_tenants` is the tenants claim given to the built-in tenanted demo users
@@ -300,7 +304,7 @@ def login_page_html(query: dict[str, list[str]]) -> str:
 <body><div class="card">
   <h1>Feldera dev login</h1>
   <p class="sub">Pick a role to sign in as.</p>
-  <div class="grid">{''.join(buttons)}</div>
+  <div class="grid">{"".join(buttons)}</div>
   <p class="warn">DEV ONLY, INSECURE: no password, any role is granted on click.</p>
 </div></body></html>"""
 
@@ -390,12 +394,24 @@ def one(name: str) -> str | None:
                 self._send_html(login_page_html(query))
                 return
             if login_as not in ROLES:
-                self._send_json({"error": "invalid_request", "error_description": f"unknown role {login_as}"}, 400)
+                self._send_json(
+                    {
+                        "error": "invalid_request",
+                        "error_description": f"unknown role {login_as}",
+                    },
+                    400,
+                )
                 return
 
             redirect_uri = one("redirect_uri")
             if not redirect_uri:
-                self._send_json({"error": "invalid_request", "error_description": "missing redirect_uri"}, 400)
+                self._send_json(
+                    {
+                        "error": "invalid_request",
+                        "error_description": "missing redirect_uri",
+                    },
+                    400,
+                )
                 return
 
             profile = ROLES[login_as]
@@ -443,13 +459,31 @@ def _handle_token_post(self) -> None:
                 code = params.get("code")
                 stored = auth_codes.pop(code, None) if code else None
                 if not stored or stored["expires_at"] < time.time():
-                    self._send_json({"error": "invalid_grant", "error_description": "code missing, expired, or already used"}, 400)
+                    self._send_json(
+                        {
+                            "error": "invalid_grant",
+                            "error_description": "code missing, expired, or already used",
+                        },
+                        400,
+                    )
                     return
                 if params.get("redirect_uri") != stored["redirect_uri"]:
-                    self._send_json({"error": "invalid_grant", "error_description": "redirect_uri mismatch"}, 400)
+                    self._send_json(
+                        {
+                            "error": "invalid_grant",
+                            "error_description": "redirect_uri mismatch",
+                        },
+                        400,
+                    )
                     return
                 if not verify_pkce(stored, params.get("code_verifier")):
-                    self._send_json({"error": "invalid_grant", "error_description": "PKCE verification failed"}, 400)
+                    self._send_json(
+                        {
+                            "error": "invalid_grant",
+                            "error_description": "PKCE verification failed",
+                        },
+                        400,
+                    )
                     return
                 refresh = secrets.token_urlsafe(32)
                 refresh_tokens[refresh] = stored
@@ -460,21 +494,39 @@ def _handle_token_post(self) -> None:
                 refresh = params.get("refresh_token")
                 stored = refresh_tokens.get(refresh) if refresh else None
                 if not stored:
-                    self._send_json({"error": "invalid_grant", "error_description": "unknown refresh_token"}, 400)
+                    self._send_json(
+                        {
+                            "error": "invalid_grant",
+                            "error_description": "unknown refresh_token",
+                        },
+                        400,
+                    )
                     return
                 # Reuse the same refresh token (sufficient for dev).
                 self._send_json(token_pair(stored, refresh))
                 return
 
-            self._send_json({"error": "unsupported_grant_type", "error_description": f"grant_type={grant_type}"}, 400)
+            self._send_json(
+                {
+                    "error": "unsupported_grant_type",
+                    "error_description": f"grant_type={grant_type}",
+                },
+                400,
+            )
 
         # GET /userinfo
         def _handle_userinfo(self) -> None:
             auth = self.headers.get("Authorization", "")
             if not auth.startswith("Bearer "):
-                self._send_json({"error": "invalid_token", "error_description": "missing bearer token"}, 401)
+                self._send_json(
+                    {
+                        "error": "invalid_token",
+                        "error_description": "missing bearer token",
+                    },
+                    401,
+                )
                 return
-            token = auth[len("Bearer "):].strip()
+            token = auth[len("Bearer ") :].strip()
             try:
                 claims = jwt.decode(
                     token,
@@ -483,7 +535,9 @@ def _handle_userinfo(self) -> None:
                     options={"verify_aud": False},
                 )
             except jwt.PyJWTError as err:
-                self._send_json({"error": "invalid_token", "error_description": str(err)}, 401)
+                self._send_json(
+                    {"error": "invalid_token", "error_description": str(err)}, 401
+                )
                 return
             sub = claims.get("sub", "")
             info = {
@@ -498,7 +552,11 @@ def _handle_userinfo(self) -> None:
 
         # /logout
         def _handle_logout(self, query: dict[str, list[str]]) -> None:
-            target = (query.get("post_logout_redirect_uri") or query.get("redirect_uri") or [None])[0]
+            target = (
+                query.get("post_logout_redirect_uri")
+                or query.get("redirect_uri")
+                or [None]
+            )[0]
             if target:
                 self._redirect(target)
                 return
diff --git a/scripts/rbac_demo.py b/scripts/rbac_demo.py
index 2c36a28ae95..8f4714ccf4a 100755
--- a/scripts/rbac_demo.py
+++ b/scripts/rbac_demo.py
@@ -104,12 +104,19 @@ def main() -> int:
     wid = members.get("writer@example.com")
     if wid:
         code, _ = call(
-            m, "PUT", f"/tenant/users/{wid}", tok["admin"], tenant=tenant,
+            m,
+            "PUT",
+            f"/tenant/users/{wid}",
+            tok["admin"],
+            tenant=tenant,
             body={"role": "write"},
         )
         print(f"  admin set writer@ -> write: HTTP {code}")
     else:
-        print("  !! writer@ not found among members; the write row may fail", file=sys.stderr)
+        print(
+            "  !! writer@ not found among members; the write row may fail",
+            file=sys.stderr,
+        )
 
     # 5. Print ready-to-use tokens.
     print("\n" + "=" * 72)
@@ -119,7 +126,9 @@ def main() -> int:
     for role in ("read", "write", "admin", "owner"):
         print(f"\n{role.upper()}={tok[role]}")
     if True:
-        print(f"\n(owner acts in a tenant by adding the header: -H '{TENANT_HEADER}: {tenant}')")
+        print(
+            f"\n(owner acts in a tenant by adding the header: -H '{TENANT_HEADER}: {tenant}')"
+        )
 
     # 6. Verification matrix: each row is (role, method, path, expected, note).
     #    `expected` is the status family we assert: 'ok' = not 403, 'deny' = 403.
@@ -127,18 +136,45 @@ def main() -> int:
     print("VERIFICATION MATRIX (deny = 403 by RBAC; ok = passed RBAC)")
     print("=" * 72)
     checks = [
-        ("read",  "GET",  "/pipelines",     None,                  "ok",   "monitor"),
-        ("read",  "POST", "/pipelines",     {"name": "x"},         "deny", "no mutate"),
-        ("read",  "GET",  "/tenant/users",  None,                  "deny", "not admin"),
-        ("write", "GET",  "/pipelines",     None,                  "ok",   "monitor"),
-        ("write", "POST", "/api_keys",      {"name": "w1", "role": "read"},  "ok",   "mint read key"),
-        ("write", "POST", "/api_keys",      {"name": "w2", "role": "admin"}, "deny", "cannot mint admin key"),
-        ("write", "GET",  "/tenant/users",  None,                  "deny", "not admin"),
-        ("admin", "GET",  "/tenant/users",  None,                  "ok",   "manage users"),
-        ("admin", "POST", "/oidc_trust",    {"name": "t1", "issuer": "https://x", "subject": "s", "audience": "acme", "role": "write"}, "ok", "create trust (write needs concrete audience)"),
-        ("admin", "GET",  "/tenants",       None,                  "deny", "owner only"),
-        ("owner", "GET",  "/tenants",       None,                  "ok",   "platform view"),
-        ("owner", "GET",  "/tenant/users",  None,                  "ok",   "acts in tenant"),
+        ("read", "GET", "/pipelines", None, "ok", "monitor"),
+        ("read", "POST", "/pipelines", {"name": "x"}, "deny", "no mutate"),
+        ("read", "GET", "/tenant/users", None, "deny", "not admin"),
+        ("write", "GET", "/pipelines", None, "ok", "monitor"),
+        (
+            "write",
+            "POST",
+            "/api_keys",
+            {"name": "w1", "role": "read"},
+            "ok",
+            "mint read key",
+        ),
+        (
+            "write",
+            "POST",
+            "/api_keys",
+            {"name": "w2", "role": "admin"},
+            "deny",
+            "cannot mint admin key",
+        ),
+        ("write", "GET", "/tenant/users", None, "deny", "not admin"),
+        ("admin", "GET", "/tenant/users", None, "ok", "manage users"),
+        (
+            "admin",
+            "POST",
+            "/oidc_trust",
+            {
+                "name": "t1",
+                "issuer": "https://x",
+                "subject": "s",
+                "audience": "acme",
+                "role": "write",
+            },
+            "ok",
+            "create trust (write needs concrete audience)",
+        ),
+        ("admin", "GET", "/tenants", None, "deny", "owner only"),
+        ("owner", "GET", "/tenants", None, "ok", "platform view"),
+        ("owner", "GET", "/tenant/users", None, "ok", "acts in tenant"),
     ]
     passed = failed = 0
     for role, method, path, body, expected, note in checks:
@@ -152,7 +188,9 @@ def main() -> int:
         passed += good
         failed += not good
         mark = "PASS" if good else "FAIL"
-        print(f"  [{mark}] {role:5} {method:4} {path:16} -> {code:3} (want {expected:4}; {note})")
+        print(
+            f"  [{mark}] {role:5} {method:4} {path:16} -> {code:3} (want {expected:4}; {note})"
+        )
     print(f"\n{passed} passed, {failed} failed")
     return 0 if failed == 0 else 2
 

From 1e792d74ab183f81acf93018c0b572a7699c1caa Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Sun, 26 Jul 2026 00:30:07 -0700
Subject: [PATCH 23/55] [pipeline-manager] Fix the rustdoc failures in
 pre-commit

`cargo doc -D warnings` failed three ways on this branch:

`ApiKeyDescr`'s doc comment linked to `crate::db::types::role::MintableKeyRole`.
utoipa copies that comment into the OpenAPI schema description, and progenitor
copies it again into the generated client, where the path cannot resolve. Write
it for API consumers instead, and note next to it why intra-doc links are wrong
there.

The `rbac` module doc linked to `AuthenticatedPrincipal` and `ROUTE_MIN_ROLE`,
both private to the crate, from a public module.

The `owners` examples in the config included a bare URL. Wrap the examples in
code spans so rustdoc reads them as literal text.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 crates/pipeline-manager/src/api/rbac.rs         | 4 ++--
 crates/pipeline-manager/src/config.rs           | 6 +++---
 crates/pipeline-manager/src/db/types/api_key.rs | 8 ++++++--
 openapi.json                                    | 2 +-
 4 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/crates/pipeline-manager/src/api/rbac.rs b/crates/pipeline-manager/src/api/rbac.rs
index f0614ab8271..bb89ad55553 100644
--- a/crates/pipeline-manager/src/api/rbac.rs
+++ b/crates/pipeline-manager/src/api/rbac.rs
@@ -1,9 +1,9 @@
 //! Role-based access-control enforcement.
 //!
 //! A single middleware over the authenticated `/v0` scope reads the
-//! [`AuthenticatedPrincipal`] that `auth_validator` installed and compares its
+//! `AuthenticatedPrincipal` that `auth_validator` installed and compares its
 //! role against the minimum role declared for the matched route. The
-//! [`ROUTE_MIN_ROLE`] table below is the single source of truth for the
+//! `ROUTE_MIN_ROLE` table below is the single source of truth for the
 //! access-control model. Enforcement is deny-by-default: a route that is
 //! reached but absent from the table is refused, so a
 //! newly added endpoint cannot ship silently world-accessible. The
diff --git a/crates/pipeline-manager/src/config.rs b/crates/pipeline-manager/src/config.rs
index 611bac242af..60cfe515ec2 100644
--- a/crates/pipeline-manager/src/config.rs
+++ b/crates/pipeline-manager/src/config.rs
@@ -981,9 +981,9 @@ pub struct ApiServerConfig {
     /// Identities granted the platform-wide `owner` role, comma-separated. Each
     /// entry matches an access token in one of three forms:
     ///
-    ///   - a provider-verified email:      "ops@acme.com"
-    ///   - a bare OIDC subject (`sub`):    "a1b2c3d4-5e6f-7890-abcd-ef1234567890"
-    ///   - a provider-qualified subject:   "https://accounts.google.com 1234567890"
+    ///   - a provider-verified email:      `ops@acme.com`
+    ///   - a bare OIDC subject (`sub`):    `a1b2c3d4-5e6f-7890-abcd-ef1234567890`
+    ///   - a provider-qualified subject:   `https://accounts.google.com 1234567890`
     ///
     /// An email matches only when the provider marks it verified, so prefer the
     /// subject forms, which are stable and not user-settable.
diff --git a/crates/pipeline-manager/src/db/types/api_key.rs b/crates/pipeline-manager/src/db/types/api_key.rs
index 720d0a54b48..ddc6f70ec3f 100644
--- a/crates/pipeline-manager/src/db/types/api_key.rs
+++ b/crates/pipeline-manager/src/db/types/api_key.rs
@@ -19,10 +19,14 @@ impl Display for ApiKeyId {
     }
 }
 
+// This doc comment becomes the schema description in the OpenAPI document, and
+// is copied verbatim into the generated clients, so it is written for API
+// consumers and must not use rustdoc intra-doc links: they cannot resolve in the
+// generated crate and fail its `cargo doc -D warnings`.
 /// API key descriptor.
 ///
-/// A key carries a single [`Role`], capped at `write`: `admin` and `owner` are
-/// never issuable as static keys (see [`crate::db::types::role::MintableKeyRole`]).
+/// A key carries a single role, `read` or `write`. `admin` and `owner` are
+/// never issuable as API keys.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, ToSchema)]
 pub struct ApiKeyDescr {
     pub id: ApiKeyId,
diff --git a/openapi.json b/openapi.json
index 22b5b7b0130..2d643a91632 100644
--- a/openapi.json
+++ b/openapi.json
@@ -7888,7 +7888,7 @@
       },
       "ApiKeyDescr": {
         "type": "object",
-        "description": "API key descriptor.\n\nA key carries a single [`Role`], capped at `write`: `admin` and `owner` are\nnever issuable as static keys (see [`crate::db::types::role::MintableKeyRole`]).",
+        "description": "API key descriptor.\n\nA key carries a single role, `read` or `write`. `admin` and `owner` are\nnever issuable as API keys.",
         "required": [
           "id",
           "name",

From 0d9590d7289dc2919f3b50103adfef285e41721e Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Sun, 26 Jul 2026 18:08:34 -0700
Subject: [PATCH 24/55] [pipeline-manager] Identify a tenant by its name alone

The tenant table keyed on (tenant, provider), where `provider` is the OIDC
issuer. Only one issuer is ever configured, so the pair never distinguished two
tenants. What it did do was tie a tenant's identity to the issuer string:
changing FELDERA_AUTH_ISSUER, as an IdP migration or a move to a custom domain
does, made the next login miss the conflict target and create a second tenant of
the same name, leaving every pipeline on the first one and no longer reachable.
It also left tenant names ambiguous in principle, which name-based
`Feldera-Tenant` resolution had to allow for.

Key on the name and keep `provider` as provenance: the issuer the tenant was
first seen under.

A deployment whose issuer changed before this migration already has two tenants
of one name, and nothing can tell from the outside which deployments those are.
The migration renames rather than refuses: failing would stop the manager from
starting and leave no in-product way out, and merging would move pipelines
between tenants. Nothing is merged, moved or deleted. The name stays with the
tenant users already reach, which is the one registered under the issuer that is
configured now, since only that one was reachable before; the upgrade therefore
does not change what anyone sees. Without a configured issuer it falls back to
the tenant holding the most pipelines. The others keep their own pipelines under
a name qualified by their id.

`run_migrations` passes the issuer to the migration as a session setting rather
than generating the SQL. Refinery checksums a migration's text and aborts
startup when it diverges, so text that varied with the environment would break
the manager the day someone changed the issuer, which is the failure this whole
change exists to prevent.

`tenant_creation` asserted the old behaviour and now asserts the new;
`tenant_survives_a_changed_issuer` covers the case that used to fork; and
`duplicate_tenant_names_are_renamed_not_rejected` runs the migration against a
table that already has a duplicate, with the two ranking criteria deliberately
in conflict, and covers the no-issuer fallback too. It executes the migration
file itself rather than a copy, so the two cannot drift, and the migration's
closing ADD CONSTRAINT is part of the assertion: it only succeeds if the rename
left the names unique.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 .../pipeline-manager/migrations/V35__rbac.sql |  88 +++++++++-
 .../src/db/operations/tenant.rs               |  47 +++---
 .../src/db/storage_postgres.rs                |  16 ++
 crates/pipeline-manager/src/db/test.rs        | 159 +++++++++++++++++-
 4 files changed, 279 insertions(+), 31 deletions(-)

diff --git a/crates/pipeline-manager/migrations/V35__rbac.sql b/crates/pipeline-manager/migrations/V35__rbac.sql
index 47bf8c80a1a..0ef13fe7036 100644
--- a/crates/pipeline-manager/migrations/V35__rbac.sql
+++ b/crates/pipeline-manager/migrations/V35__rbac.sql
@@ -1,4 +1,4 @@
--- Role-based access control and OIDC workload-identity trust.
+-- Role-based access control, OIDC workload-identity trust, and tenant identity.
 --
 -- Adds the user concept and the per-(user, tenant) role link that the platform
 -- previously lacked (the only principal was the tenant). The released `api_key`
@@ -6,6 +6,8 @@
 -- Roles: 'read' < 'write' < 'admin' (and 'owner', which is platform-wide and
 -- never stored in a membership; it is sourced from configuration or an owner
 -- OIDC trust relationship).
+--
+-- The second half makes a tenant's name, on its own, its identity.
 
 CREATE TABLE IF NOT EXISTS app_user (
     id       uuid PRIMARY KEY,
@@ -67,3 +69,87 @@ CREATE UNIQUE INDEX IF NOT EXISTS idx_oidc_owner_trust_name
 
 -- The auth hot path resolves a federated token by its issuer, so index it.
 CREATE INDEX IF NOT EXISTS idx_oidc_trust_issuer ON oidc_trust_relationship (issuer);
+
+-- BEGIN tenant identity
+--
+-- db/test.rs runs the section between these markers on its own, against temp
+-- tables, so keep both markers and keep the section free of the tables above.
+--
+-- Make the tenant name, on its own, the tenant's identity.
+--
+-- V0 keyed a tenant by (tenant, provider), where `provider` is the OIDC issuer
+-- its users authenticate through. Only one issuer is ever configured, so the
+-- pair never distinguished two tenants. What it did do was tie a tenant's
+-- identity to the issuer string: changing FELDERA_AUTH_ISSUER (an IdP migration,
+-- a custom domain, a recreated Cognito pool) made the next login miss the
+-- conflict target and create a second tenant of the same name, leaving every
+-- pipeline on the unreachable first one.
+--
+-- Keying on the name alone makes that case reuse the existing tenant. The issuer
+-- stays as provenance, under a name that says so: `initial_provider`.
+
+-- A deployment whose issuer changed before this migration already has two
+-- tenants sharing a name, and we cannot tell from here which deployments those
+-- are. Rename rather than refuse: a failed migration would stop the manager from
+-- starting and leave no in-product way out, whereas renaming keeps every tenant
+-- present, reachable and unchanged.
+--
+-- Nothing is merged, moved or deleted. The name stays with the tenant users
+-- already reach today, which is the one registered under the issuer that is
+-- configured now: only that one was reachable before this migration, since a
+-- login resolved (name, issuer). Keeping the name there means the upgrade does
+-- not change what anyone sees. `feldera.auth_issuer` is set on this connection
+-- by `run_migrations`; when it is absent, as with authentication disabled, fall
+-- back to the tenant holding the most pipelines so the name still follows the
+-- work. Ties break on the id for determinism.
+--
+-- The others keep all of their own pipelines under a name qualified by their id,
+-- which is unique. An owner finds them through `GET /v0/tenants`, acts in them
+-- with the `Feldera-Tenant` header, and can rename them.
+DO $$
+DECLARE renamed int;
+BEGIN
+    WITH ranked AS (
+        SELECT t.id,
+               row_number() OVER (
+                   PARTITION BY t.tenant
+                   ORDER BY (t.provider IS NOT DISTINCT FROM
+                             current_setting('feldera.auth_issuer', true)) DESC,
+                            (SELECT count(*) FROM pipeline p WHERE p.tenant_id = t.id) DESC,
+                            t.id
+               ) AS rank_in_name
+        FROM tenant t
+    )
+    UPDATE tenant
+    SET tenant = tenant.tenant || ' (' || tenant.id || ')'
+    FROM ranked
+    WHERE tenant.id = ranked.id AND ranked.rank_in_name > 1;
+
+    GET DIAGNOSTICS renamed = ROW_COUNT;
+    IF renamed > 0 THEN
+        RAISE NOTICE
+            'Renamed % tenant(s) whose name was shared with another tenant, '
+            'which happens when the configured OIDC issuer changed. Their '
+            'pipelines are untouched; list them with GET /v0/tenants.',
+            renamed;
+    END IF;
+END $$;
+
+-- The old constraint was declared inline, so its name is whatever PostgreSQL
+-- generated; look it up rather than assume.
+DO $$
+DECLARE old_constraint text;
+BEGIN
+    SELECT conname INTO old_constraint
+    FROM pg_constraint
+    WHERE conrelid = 'tenant'::regclass
+      AND contype = 'u'
+      AND pg_get_constraintdef(oid) LIKE 'UNIQUE (tenant, provider)%';
+
+    IF old_constraint IS NOT NULL THEN
+        EXECUTE format('ALTER TABLE tenant DROP CONSTRAINT %I', old_constraint);
+    END IF;
+END $$;
+
+ALTER TABLE tenant ADD CONSTRAINT unique_tenant_name UNIQUE (tenant);
+-- END tenant identity
diff --git a/crates/pipeline-manager/src/db/operations/tenant.rs b/crates/pipeline-manager/src/db/operations/tenant.rs
index f0727c9cbc4..5d19d4baefb 100644
--- a/crates/pipeline-manager/src/db/operations/tenant.rs
+++ b/crates/pipeline-manager/src/db/operations/tenant.rs
@@ -3,7 +3,6 @@ use crate::db::operations::utils::maybe_unique_violation;
 use crate::db::types::tenant::TenantId;
 use crate::db::types::user::TenantInfo;
 use deadpool_postgres::Transaction;
-use tracing::error;
 use uuid::Uuid;
 
 /// Retrieves tenant, which is uniquely identified by the tuple (name, provider).
@@ -31,51 +30,43 @@ pub async fn get_or_create_tenant_id_created(
 ) -> Result<(TenantId, bool), DBError> {
     // Atomic get-or-create: a single INSERT ... ON CONFLICT DO NOTHING avoids
     // the SELECT-then-INSERT race where two concurrent first-logins to a fresh
-    // (name, provider) both miss the SELECT, then one INSERT wins and the other
-    // fails with a unique violation. `inserted` (1 vs 0 rows affected) tells us
-    // whether THIS call created the tenant, which decides the first-member-admin
-    // grant in `resolve_login`. A subsequent SELECT always finds the row.
+    // name both miss the SELECT, then one INSERT wins and the other fails with a
+    // unique violation. `inserted` (1 vs 0 rows affected) tells us whether THIS
+    // call created the tenant, which decides the first-member grant in
+    // `resolve_login`. A subsequent SELECT always finds the row.
+    //
+    // The name alone identifies the tenant. `provider` is recorded as the issuer
+    // it was first seen under, and deliberately not matched on: were it part of
+    // the key, changing the configured issuer would miss here and fork a second
+    // tenant of the same name, stranding the pipelines on the first.
     let stmt_insert = txn
         .prepare_cached(
             "INSERT INTO tenant (id, tenant, provider) VALUES ($1, $2, $3) \
-             ON CONFLICT (tenant, provider) DO NOTHING",
+             ON CONFLICT (tenant) DO NOTHING",
         )
         .await?;
     let inserted = txn
         .execute(&stmt_insert, &[&new_id, &name, &provider])
         .await?;
     let stmt_select = txn
-        .prepare_cached("SELECT id FROM tenant WHERE tenant = $1 AND provider = $2")
+        .prepare_cached("SELECT id FROM tenant WHERE tenant = $1")
         .await?;
-    let row = txn.query_one(&stmt_select, &[&name, &provider]).await?;
+    let row = txn.query_one(&stmt_select, &[&name]).await?;
     Ok((TenantId(row.get(0)), inserted == 1))
 }
 
-/// Strict lookup of a tenant by name only, used to resolve a `Feldera-Tenant`
-/// header. Never creates a tenant; errors on miss, and on the ambiguity that a
-/// name shared across providers would create.
+/// Strict lookup of a tenant by name, used to resolve a `Feldera-Tenant` header.
+/// Never creates a tenant; a miss is an error. The name is unique, so at most
+/// one tenant can match.
 pub async fn get_tenant_id_by_name(txn: &Transaction<'_>, name: &str) -> Result<TenantId, DBError> {
     let stmt = txn
         .prepare_cached("SELECT id FROM tenant WHERE tenant = $1")
         .await?;
-    let rows = txn.query(&stmt, &[&name]).await?;
-    match rows.len() {
-        1 => Ok(TenantId(rows[0].get(0))),
-        0 => Err(DBError::UnknownTenantName {
+    let row = txn.query_opt(&stmt, &[&name]).await?;
+    row.map(|row| TenantId(row.get(0)))
+        .ok_or(DBError::UnknownTenantName {
             name: name.to_string(),
-        }),
-        n => {
-            // Tenants are unique per (name, provider), so this needs a second
-            // configured provider to happen at all. Refuse to guess which one.
-            error!(
-                "Tenant name '{name}' resolves to {n} tenants across providers; \
-                 select the tenant by its UUID instead"
-            );
-            Err(DBError::UnknownTenantName {
-                name: name.to_string(),
-            })
-        }
-    }
+        })
 }
 
 /// Strict resolution of a `Feldera-Tenant` selector, used wherever a principal
diff --git a/crates/pipeline-manager/src/db/storage_postgres.rs b/crates/pipeline-manager/src/db/storage_postgres.rs
index 39c39e5e6a1..e160a3249c1 100644
--- a/crates/pipeline-manager/src/db/storage_postgres.rs
+++ b/crates/pipeline-manager/src/db/storage_postgres.rs
@@ -1872,6 +1872,22 @@ impl StoragePostgres {
     pub async fn run_migrations(&self) -> Result<(), DBError> {
         debug!("Applying database migrations if needed...");
         let mut client = self.pool.get().await?;
+
+        // Expose the configured OIDC issuer to migrations that need it, as a
+        // session setting on the connection refinery is about to use. Passing it
+        // this way rather than generating the SQL keeps each migration's text
+        // fixed: refinery checksums that text and refuses to start on a mismatch,
+        // so a migration whose text varied with the environment would abort
+        // startup the day someone changed the issuer. Empty when auth is off,
+        // which reads back as NULL through `current_setting(.., true)`.
+        let configured_issuer = std::env::var("FELDERA_AUTH_ISSUER").unwrap_or_default();
+        client
+            .execute(
+                "SELECT set_config('feldera.auth_issuer', $1, false)",
+                &[&configured_issuer],
+            )
+            .await?;
+
         let report = embedded::migrations::runner()
             .run_async(&mut **client)
             .await?;
diff --git a/crates/pipeline-manager/src/db/test.rs b/crates/pipeline-manager/src/db/test.rs
index d40bcba0444..f871e14d657 100644
--- a/crates/pipeline-manager/src/db/test.rs
+++ b/crates/pipeline-manager/src/db/test.rs
@@ -787,7 +787,8 @@ fn limited_retention_num() -> impl Strategy<Value = u32> {
 //////////////////////////////////////////////////////////////////////////////
 /////                          MANUAL TESTS                              /////
 
-/// Creation and retrieval of tenants.
+/// Creation and retrieval of tenants: the name identifies the tenant, and the
+/// provider recorded alongside it does not.
 #[tokio::test]
 async fn tenant_creation() {
     let handle = test_setup().await;
@@ -816,11 +817,15 @@ async fn tenant_creation() {
         .get_or_create_tenant_id(Uuid::now_v7(), "x".to_string(), "z".to_string())
         .await
         .unwrap();
+    // Repeating a name resolves to the same tenant.
     assert_eq!(tenant_id_1, tenant_id_2);
     assert_eq!(tenant_id_2, tenant_id_3);
+    // A different name is a different tenant.
     assert_ne!(tenant_id_3, tenant_id_4);
     assert_ne!(tenant_id_4, tenant_id_5);
-    assert_ne!(tenant_id_3, tenant_id_5);
+    // The same name under another provider is still that tenant, so changing
+    // the configured issuer does not fork it.
+    assert_eq!(tenant_id_3, tenant_id_5);
 }
 
 /// Creation, deletion and validation of API keys.
@@ -873,6 +878,156 @@ async fn api_key_store_and_validation() {
     }
 }
 
+/// The tenant-identity section of `V35__rbac.sql`, delimited in the file by
+/// `BEGIN tenant identity` / `END tenant identity`.
+fn tenant_identity_migration() -> &'static str {
+    let migration = include_str!("../../migrations/V35__rbac.sql");
+    let (_, after_begin) = migration
+        .split_once("-- BEGIN tenant identity")
+        .expect("V35__rbac.sql lost its `BEGIN tenant identity` marker");
+    let (section, _) = after_begin
+        .split_once("-- END tenant identity")
+        .expect("V35__rbac.sql lost its `END tenant identity` marker");
+    section
+}
+
+/// Upgrading a deployment that already has two tenants of one name renames
+/// rather than fails, and the name stays with the tenant users already reach.
+#[tokio::test]
+async fn duplicate_tenant_names_are_renamed_not_rejected() {
+    let handle = test_setup().await;
+    let client = handle.db.pool.get().await.unwrap();
+
+    let live = Uuid::parse_str("00000000-0000-0000-0000-0000000000a1").unwrap();
+    let orphan = Uuid::parse_str("00000000-0000-0000-0000-0000000000a2").unwrap();
+    let untouched = Uuid::parse_str("00000000-0000-0000-0000-0000000000a3").unwrap();
+    let name_of = |id: Uuid| {
+        let client = &client;
+        async move {
+            client
+                .query_one("SELECT tenant FROM tenant WHERE id = $1", &[&id])
+                .await
+                .unwrap()
+                .get::<_, String>(0)
+        }
+    };
+    // Reproduce the shape from before this migration: a `tenant` table whose
+    // name is not unique, and enough of `pipeline` to count. Temp tables shadow
+    // the real ones, so the migration below can run against them unmodified.
+    // `live` is registered under the currently configured issuer but holds
+    // nothing, while the `orphan` left behind by an earlier issuer holds the
+    // pipelines, so the two ranking criteria disagree.
+    let build = "CREATE TEMP TABLE tenant (id uuid PRIMARY KEY, tenant varchar NOT NULL, provider varchar NOT NULL);
+         CREATE TEMP TABLE pipeline (id uuid PRIMARY KEY, tenant_id uuid NOT NULL);
+         INSERT INTO tenant VALUES
+           ('00000000-0000-0000-0000-0000000000a1', 'acme', 'https://new-idp.example'),
+           ('00000000-0000-0000-0000-0000000000a2', 'acme', 'https://old-idp.example'),
+           ('00000000-0000-0000-0000-0000000000a3', 'beta', 'https://new-idp.example');
+         INSERT INTO pipeline VALUES
+           ('00000000-0000-0000-0000-0000000000b1', '00000000-0000-0000-0000-0000000000a2'),
+           ('00000000-0000-0000-0000-0000000000b2', '00000000-0000-0000-0000-0000000000a2');";
+    // Run the migration itself, not a copy, so the two cannot drift. Only the
+    // tenant-identity section applies to these tables; the rest of V35 creates
+    // the RBAC tables, which the test database already has. The ADD CONSTRAINT
+    // that closes the section is part of the assertion: it only succeeds if the
+    // rename left the names unique.
+    let migration = tenant_identity_migration();
+    // Qualified with pg_temp so a reset can never reach the real tables.
+    let reset = "DROP TABLE pg_temp.tenant; DROP TABLE pg_temp.pipeline;";
+
+    client.batch_execute(build).await.unwrap();
+    client
+        .execute(
+            "SELECT set_config('feldera.auth_issuer', $1, false)",
+            &[&"https://new-idp.example"],
+        )
+        .await
+        .unwrap();
+    client.batch_execute(migration).await.unwrap();
+
+    // The tenant on the configured issuer keeps the name even though the other
+    // holds the pipelines, so the upgrade does not move anyone.
+    assert_eq!(name_of(live).await, "acme");
+    // The orphan keeps its own pipelines under a name an owner can still reach.
+    assert_eq!(name_of(orphan).await, format!("acme ({orphan})"));
+    // A name that was never shared is untouched.
+    assert_eq!(name_of(untouched).await, "beta");
+
+    // With no issuer configured, as when authentication is off, the name falls
+    // back to following the pipelines.
+    client.batch_execute(reset).await.unwrap();
+    client.batch_execute(build).await.unwrap();
+    client
+        .execute(
+            "SELECT set_config('feldera.auth_issuer', $1, false)",
+            &[&""],
+        )
+        .await
+        .unwrap();
+    client.batch_execute(migration).await.unwrap();
+    assert_eq!(name_of(orphan).await, "acme");
+    assert_eq!(name_of(live).await, format!("acme ({live})"));
+}
+
+/// A tenant is identified by its name alone, so changing the configured issuer
+/// reuses the existing tenant instead of creating a second one of the same name.
+#[tokio::test]
+async fn tenant_survives_a_changed_issuer() {
+    let handle = test_setup().await;
+
+    let before = handle
+        .db
+        .get_or_create_tenant_id(
+            Uuid::now_v7(),
+            "acme".to_string(),
+            "https://old-idp.example".to_string(),
+        )
+        .await
+        .unwrap();
+
+    // The same tenant name under a new issuer resolves to the same tenant, so
+    // an IdP migration does not strand the pipelines on an unreachable one.
+    let after = handle
+        .db
+        .get_or_create_tenant_id(
+            Uuid::now_v7(),
+            "acme".to_string(),
+            "https://new-idp.example".to_string(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(before, after);
+
+    let named = handle.db.resolve_tenant_selector("acme").await.unwrap();
+    assert_eq!(named, before);
+    let tenants = handle.db.list_tenants().await.unwrap();
+    assert_eq!(
+        tenants.iter().filter(|t| t.name == "acme").count(),
+        1,
+        "the issuer change must not have created a second 'acme'"
+    );
+
+    // The old composite constraint is dropped, not just shadowed by the new one.
+    let leftover = handle
+        .db
+        .pool
+        .get()
+        .await
+        .unwrap()
+        .query(
+            "SELECT conname FROM pg_constraint \
+             WHERE conrelid = 'tenant'::regclass AND contype = 'u' \
+               AND pg_get_constraintdef(oid) LIKE 'UNIQUE (tenant, provider)%'",
+            &[],
+        )
+        .await
+        .unwrap();
+    assert!(
+        leftover.is_empty(),
+        "the (tenant, provider) constraint should have been dropped"
+    );
+}
+
 /// `first_user_role` sets the role of the login that creates a tenant: with
 /// `write`, the creator is not made admin (e.g. a shared sandbox).
 #[tokio::test]

From 7552bee4ebada3b1b4074b0cfbe1955ab8a389a8 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Sun, 26 Jul 2026 18:08:34 -0700
Subject: [PATCH 25/55] [docs] Explain what changing the identity provider does
 to tenants

Add a section covering the two changes that move users between tenants: turning
authentication on for a deployment that ran without it, and pointing an
authenticated deployment at a different provider.

State how a tenant is identified, by name alone, and how a user is identified,
by issuer and subject together. From that, whether a tenant survives a provider
change follows per strategy: managed tenancy does, since the name is a claim the
operator controls; organization-wide tenancy does only if the issuer hostname is
unchanged; individual tenancy does not, since a new provider issues new subjects.

Call out that memberships never survive a provider change, even when the tenant
does, because they are keyed to the issuer. Every user comes back as a new
identity at the default role, so an owner from the new provider has to be
configured before anyone can restore the rest.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 .../enterprise/authentication/index.mdx       | 96 ++++++++++++++-----
 1 file changed, 74 insertions(+), 22 deletions(-)

diff --git a/docs.feldera.com/docs/get-started/enterprise/authentication/index.mdx b/docs.feldera.com/docs/get-started/enterprise/authentication/index.mdx
index 4353be7af59..75b546242c0 100644
--- a/docs.feldera.com/docs/get-started/enterprise/authentication/index.mdx
+++ b/docs.feldera.com/docs/get-started/enterprise/authentication/index.mdx
@@ -59,28 +59,6 @@ auth:
   enabled: false
 ```
 
-### Transitioning from no authentication to authentication
-
-A deployment that runs without authentication keeps all of its data under a
-single built-in tenant named `default`, whose id is the all-zero UUID
-`00000000-0000-0000-0000-000000000000`. When you enable authentication, each
-login resolves to its own tenant per the strategies above, not to the `default`
-tenant, so pipelines and API keys created while authentication was disabled are
-not visible to ordinary logins.
-
-To reach that data after enabling authentication, a platform
-[owner](/get-started/enterprise/authentication/roles) selects the default tenant
-explicitly with the `Feldera-Tenant` header:
-
-```bash
-curl -H "Authorization: Bearer $OWNER_TOKEN" \
-     -H "Feldera-Tenant: 00000000-0000-0000-0000-000000000000" \
-     https://<your-host>/v0/pipelines
-```
-
-Recreate the resources in a regular tenant as needed. Plan this migration before
-enabling authentication on a deployment that already holds data.
-
 ### Individual access
 
 Every user gets their individual tenant based on their `sub` claim.
@@ -180,6 +158,80 @@ authorization:
   authAudience: "feldera-api"
 ```
 
+## Changing your authentication setup
+
+Feldera supports a single identity provider at a time, so the two changes that
+move users between tenants are enabling authentication on a deployment that ran
+without it, and pointing an authenticated deployment at a different provider.
+Both need planning, because a tenant is where pipelines live.
+
+### How a tenant is identified
+
+A tenant is identified by its **name** alone. The name is derived from the token
+on each login, by whichever [tenant assignment strategy](#tenant-assignment-strategies)
+you configured. A tenant also records the issuer it was first seen under, but
+that is provenance only: it does not take part in identifying the tenant, so
+changing the issuer never creates a second tenant of the same name.
+
+A user is identified by the pair `(issuer, subject)`. That pair is what
+memberships and roles hang off, and unlike the tenant name it **does** include
+the issuer, because OIDC only guarantees `sub` to be unique within one issuer.
+
+The practical consequence is worth stating plainly: a tenant can survive a
+provider change, but the users in it cannot. They arrive as new identities and
+must be granted their roles again.
+
+### Enabling authentication on an existing deployment
+
+Without authentication, everything lives in one built-in tenant named `default`,
+whose id is the all-zero UUID `00000000-0000-0000-0000-000000000000`. Once
+authentication is on, each login resolves to a tenant named by your chosen
+strategy, never to `default`, so pipelines and API keys created beforehand are
+not visible to ordinary logins. The data is intact, just in a tenant nobody
+resolves to any more.
+
+A platform [owner](/get-started/enterprise/authentication/roles) can still reach
+it by naming that tenant explicitly:
+
+```bash
+curl -H "Authorization: Bearer $OWNER_TOKEN" \
+     -H "Feldera-Tenant: 00000000-0000-0000-0000-000000000000" \
+     https://<your-host>/v0/pipelines
+```
+
+Recreate the resources in a regular tenant from there. Plan this before enabling
+authentication on a deployment that already holds pipelines.
+
+### Changing the identity provider
+
+Whether a tenant survives depends on whether its **name** still comes out the
+same from the new provider's tokens:
+
+| Strategy | Tenant name comes from | Survives a provider change? |
+|---|---|---|
+| Managed tenancy | the `tenants` claim | Yes, if you configure the new provider to emit the same values |
+| Organization-wide | the issuer hostname | Only if the hostname is unchanged, e.g. a new authorization server on the same domain |
+| Individual tenancy | the `sub` claim | No, in practice: a new provider issues different subjects |
+
+So the mode that migrates cleanly is managed tenancy, because the tenant name is
+a value you control at the provider rather than something derived from it. If you
+expect to change providers, prefer it.
+
+Where the name does change, the old tenant keeps every pipeline and is no longer
+reachable by ordinary logins. Recover it the same way as above: an owner selects
+it with `Feldera-Tenant` (by name or UUID, and `GET /v0/tenants` lists both) and
+moves what is needed.
+
+:::warning Roles are not carried across a provider change
+Even when the tenant survives, its members do not. A membership is keyed to
+`(issuer, subject)`, so after the switch every user is a new identity with no
+membership, and each is admitted at `authorization.defaultRole`. Administrators
+and pre-provisioned members must be granted their roles again, and at least one
+identity from the new provider must be listed in `authorization.owners` so that
+someone can do the granting. See
+[Roles](/get-started/enterprise/authentication/roles).
+:::
+
 ## Configuration options
 
 ### Mapping Pipeline Manager Options to Helm Chart Values

From 5dbd71c9316e681fc7355f83f02876ca4ab908d5 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Sun, 26 Jul 2026 18:53:35 -0700
Subject: [PATCH 26/55] [pipeline-manager] Name the tenant's provider column
 for what it holds

`tenant.provider` becomes `tenant.initial_provider`: the OIDC issuer a tenant
was first provisioned under, kept for provenance. The name identifies a tenant
on its own, so the column takes no part in resolving one, and calling it
`provider` read like a live property of the tenant, which invites the coupling
that stranded pipelines whenever the configured issuer changed.

`app_user.provider` keeps its name. There the issuer is part of the identity,
because OIDC only guarantees `sub` to be unique within one issuer.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 crates/pipeline-manager/migrations/V35__rbac.sql  |  9 +++++++++
 crates/pipeline-manager/src/auth.rs               |  6 +++---
 .../pipeline-manager/src/db/operations/tenant.rs  | 14 +++++++-------
 .../pipeline-manager/src/db/storage_postgres.rs   |  2 +-
 crates/pipeline-manager/src/db/test.rs            |  6 +++---
 crates/pipeline-manager/src/db/types/user.rs      |  5 ++++-
 .../src/lib/components/admin/TenantList.svelte    | 15 +++++++--------
 .../src/lib/services/manager/types.gen.ts         |  7 ++++++-
 openapi.json                                      |  9 +++++----
 9 files changed, 45 insertions(+), 28 deletions(-)

diff --git a/crates/pipeline-manager/migrations/V35__rbac.sql b/crates/pipeline-manager/migrations/V35__rbac.sql
index 0ef13fe7036..2c14462a7e1 100644
--- a/crates/pipeline-manager/migrations/V35__rbac.sql
+++ b/crates/pipeline-manager/migrations/V35__rbac.sql
@@ -152,4 +152,13 @@ BEGIN
 END $$;
 
 ALTER TABLE tenant ADD CONSTRAINT unique_tenant_name UNIQUE (tenant);
+
+-- Now that the column keys nothing, name it for what it holds: the OIDC issuer
+-- the tenant was first provisioned under, kept for provenance. `provider` read
+-- like a live property of the tenant, which invited exactly the coupling this
+-- section removes.
+--
+-- `app_user.provider` keeps its name: there the issuer is part of the identity,
+-- because OIDC only guarantees `sub` to be unique within one issuer.
+ALTER TABLE tenant RENAME COLUMN provider TO initial_provider;
 -- END tenant identity
diff --git a/crates/pipeline-manager/src/auth.rs b/crates/pipeline-manager/src/auth.rs
index 0aacb8af77a..10773edbcdf 100644
--- a/crates/pipeline-manager/src/auth.rs
+++ b/crates/pipeline-manager/src/auth.rs
@@ -687,8 +687,8 @@ pub(crate) struct TenantRecord {
     /// Corresponds to the sub or subscriber from a claim
     pub tenant: String,
 
-    /// Corresponds to the identity provider from a claim
-    pub provider: String,
+    /// The OIDC issuer this tenant was first provisioned under.
+    pub initial_provider: String,
 }
 
 const DEFAULT_TENANT_ID: TenantId = TenantId(Uuid::nil());
@@ -698,7 +698,7 @@ impl TenantRecord {
         Self {
             id: DEFAULT_TENANT_ID,
             tenant: "default".to_string(),
-            provider: "default".to_string(),
+            initial_provider: "default".to_string(),
         }
     }
 }
diff --git a/crates/pipeline-manager/src/db/operations/tenant.rs b/crates/pipeline-manager/src/db/operations/tenant.rs
index 5d19d4baefb..67ce118db59 100644
--- a/crates/pipeline-manager/src/db/operations/tenant.rs
+++ b/crates/pipeline-manager/src/db/operations/tenant.rs
@@ -5,8 +5,8 @@ use crate::db::types::user::TenantInfo;
 use deadpool_postgres::Transaction;
 use uuid::Uuid;
 
-/// Retrieves tenant, which is uniquely identified by the tuple (name, provider).
-/// If the (name, provider) does not yet exist, creates it with the provided new identifier.
+/// Retrieves the tenant with this name, creating it with the provided new
+/// identifier if it does not exist yet.
 pub async fn get_or_create_tenant_id(
     txn: &Transaction<'_>,
     new_id: Uuid, // Used only if the tenant does not yet exist
@@ -41,7 +41,7 @@ pub async fn get_or_create_tenant_id_created(
     // tenant of the same name, stranding the pipelines on the first.
     let stmt_insert = txn
         .prepare_cached(
-            "INSERT INTO tenant (id, tenant, provider) VALUES ($1, $2, $3) \
+            "INSERT INTO tenant (id, tenant, initial_provider) VALUES ($1, $2, $3) \
              ON CONFLICT (tenant) DO NOTHING",
         )
         .await?;
@@ -94,8 +94,8 @@ pub async fn resolve_tenant_selector(
     get_tenant_id_by_name(txn, selector).await
 }
 
-/// Create a tenant, failing with a conflict if `(name, provider)` already
-/// exists. Distinct from the get-or-create login path: the owner-only explicit
+/// Create a tenant, failing with a conflict if the name is already taken.
+/// Distinct from the get-or-create login path: the owner-only explicit
 /// create endpoint should report a duplicate rather than silently returning the
 /// existing tenant.
 pub async fn create_tenant(
@@ -105,7 +105,7 @@ pub async fn create_tenant(
     provider: &str,
 ) -> Result<TenantId, DBError> {
     let stmt = txn
-        .prepare_cached("INSERT INTO tenant (id, tenant, provider) VALUES ($1, $2, $3)")
+        .prepare_cached("INSERT INTO tenant (id, tenant, initial_provider) VALUES ($1, $2, $3)")
         .await?;
     txn.execute(&stmt, &[&id, &name, &provider])
         .await
@@ -124,7 +124,7 @@ pub async fn list_tenants(txn: &Transaction<'_>) -> Result<Vec<TenantInfo>, DBEr
         .map(|row| TenantInfo {
             id: TenantId(row.get(0)),
             name: row.get(1),
-            provider: row.get(2),
+            initial_provider: row.get(2),
         })
         .collect())
 }
diff --git a/crates/pipeline-manager/src/db/storage_postgres.rs b/crates/pipeline-manager/src/db/storage_postgres.rs
index e160a3249c1..f8cc63d1813 100644
--- a/crates/pipeline-manager/src/db/storage_postgres.rs
+++ b/crates/pipeline-manager/src/db/storage_postgres.rs
@@ -1910,7 +1910,7 @@ impl StoragePostgres {
         self.get_or_create_tenant_id(
             default_tenant.id.0,
             default_tenant.tenant,
-            default_tenant.provider,
+            default_tenant.initial_provider,
         )
         .await?;
         Ok(())
diff --git a/crates/pipeline-manager/src/db/test.rs b/crates/pipeline-manager/src/db/test.rs
index f871e14d657..0d876bfb9a3 100644
--- a/crates/pipeline-manager/src/db/test.rs
+++ b/crates/pipeline-manager/src/db/test.rs
@@ -4644,7 +4644,7 @@ async fn create_tenants_if_not_exists(
         let rec = TenantRecord {
             id: tenant_id,
             tenant: Uuid::now_v7().to_string(),
-            provider: Uuid::now_v7().to_string(),
+            initial_provider: Uuid::now_v7().to_string(),
         };
         e.insert(rec.clone());
         handle
@@ -4655,7 +4655,7 @@ async fn create_tenants_if_not_exists(
             .unwrap()
             .execute(
                 "INSERT INTO tenant VALUES ($1, $2, $3)",
-                &[&rec.id.0, &rec.tenant, &rec.provider],
+                &[&rec.id.0, &rec.tenant, &rec.initial_provider],
             )
             .await?;
     }
@@ -5861,7 +5861,7 @@ impl Storage for Mutex<DbModel> {
             .map(|(id, t)| TenantInfo {
                 id: *id,
                 name: t.tenant.clone(),
-                provider: t.provider.clone(),
+                initial_provider: t.initial_provider.clone(),
             })
             .collect())
     }
diff --git a/crates/pipeline-manager/src/db/types/user.rs b/crates/pipeline-manager/src/db/types/user.rs
index 55acf20b758..d438386e8bd 100644
--- a/crates/pipeline-manager/src/db/types/user.rs
+++ b/crates/pipeline-manager/src/db/types/user.rs
@@ -44,5 +44,8 @@ pub struct TenantMember {
 pub struct TenantInfo {
     pub id: TenantId,
     pub name: String,
-    pub provider: String,
+    /// The OIDC issuer this tenant was first provisioned under. Provenance
+    /// only: a tenant is resolved by name, so this does not affect which tenant
+    /// a login reaches.
+    pub initial_provider: String,
 }
diff --git a/js-packages/web-console/src/lib/components/admin/TenantList.svelte b/js-packages/web-console/src/lib/components/admin/TenantList.svelte
index 4b65cb6b802..a4473b4fb67 100644
--- a/js-packages/web-console/src/lib/components/admin/TenantList.svelte
+++ b/js-packages/web-console/src/lib/components/admin/TenantList.svelte
@@ -14,9 +14,9 @@
 
   const tenants = asyncReadable<Tenant[]>([], getTenants, { reloadable: true })
 
-  // A new tenant is keyed to the platform's configured OIDC issuer (set at
-  // deploy time, e.g. via Helm), so logins from that issuer resolve into it.
-  // The issuer is not settable here; show it read-only.
+  // A login resolves its tenant by name, so the name a new tenant is given is
+  // the one the identity provider must assert for its users to land in it. The
+  // issuer is configured at deploy time, not here; show it read-only.
   const authConfig = asyncReadable<Record<string, { issuer?: string }> | undefined>(
     undefined,
     getAuthConfig
@@ -27,9 +27,8 @@
       '(configured at deploy time)'
   )
 
-  // Compare/select by tenant id (UUID). Names are unique only per provider, so
-  // the id is globally unique and the backend's Feldera-Tenant resolver accepts
-  // it unambiguously.
+  // Compare/select by tenant id (UUID): the id never changes, and the backend's
+  // Feldera-Tenant resolver accepts it unambiguously.
   const currentTenantId = $derived(page.data.feldera?.tenantId)
 
   let newName = $state('')
@@ -81,7 +80,7 @@
               <span class="text-xs opacity-70">(current)</span>
             {/if}
           </div>
-          <div class="text-sm opacity-70"><code>{tenant.provider}</code> · {tenant.id}</div>
+          <div class="text-sm opacity-70"><code>{tenant.initial_provider}</code> · {tenant.id}</div>
         </div>
         <button
           class="btn preset-filled-surface-50-950"
@@ -114,7 +113,7 @@
         value={configuredIssuer}
         readonly
         disabled
-        title="Statically configured at deploy time (Helm: FELDERA_AUTH_ISSUER). Tenants are keyed to this issuer so logins from it resolve into them; it cannot be changed here."
+        title="Statically configured at deploy time (Helm: FELDERA_AUTH_ISSUER). Recorded on a new tenant as the issuer it was provisioned under; it cannot be changed here."
       />
     </label>
     <button class="btn preset-filled-surface-50-950" disabled={creating}>Create</button>
diff --git a/js-packages/web-console/src/lib/services/manager/types.gen.ts b/js-packages/web-console/src/lib/services/manager/types.gen.ts
index 386b079be63..177e23f2f26 100644
--- a/js-packages/web-console/src/lib/services/manager/types.gen.ts
+++ b/js-packages/web-console/src/lib/services/manager/types.gen.ts
@@ -5772,8 +5772,13 @@ export type TenantId = string
  */
 export type TenantInfo = {
   id: TenantId
+  /**
+   * The OIDC issuer this tenant was first provisioned under. Provenance
+   * only: a tenant is resolved by name, so this does not affect which tenant
+   * a login reaches.
+   */
+  initial_provider: string
   name: string
-  provider: string
 }
 
 /**
diff --git a/openapi.json b/openapi.json
index 2d643a91632..578f1672698 100644
--- a/openapi.json
+++ b/openapi.json
@@ -15134,16 +15134,17 @@
         "required": [
           "id",
           "name",
-          "provider"
+          "initial_provider"
         ],
         "properties": {
           "id": {
             "$ref": "#/components/schemas/TenantId"
           },
-          "name": {
-            "type": "string"
+          "initial_provider": {
+            "type": "string",
+            "description": "The OIDC issuer this tenant was first provisioned under. Provenance\nonly: a tenant is resolved by name, so this does not affect which tenant\na login reaches."
           },
-          "provider": {
+          "name": {
             "type": "string"
           }
         }

From 827fa1e5ad08e79e129abce1ea4f74b0fcb8a157 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Sun, 26 Jul 2026 18:54:13 -0700
Subject: [PATCH 27/55] [pipeline-manager] Let an owner rename or delete a
 tenant

`PATCH /v0/tenants/{tenant_id}` changes a tenant's name and
`DELETE /v0/tenants/{tenant_id}` removes one. Both are owner-only, and both are
offered by the web console's admin page, the `fda tenant` commands and the
Python SDK.

A login resolves its tenant by name, so a rename is what reunites users with a
tenant they can no longer reach: enabling authentication strands everything in
`default`, and a provider change strands a tenant whose name the new tokens no
longer produce. Both were recoverable only by an owner copying resources out.

The name that recovery needs is normally taken already, by the tenant the first
login created, and every request re-creates that name, so freeing it and
claiming it as two calls always loses the race. `displace_existing` does it in
one transaction: the tenant holding the name takes `<name> (<id>)` instead, as
the V35 migration does for names shared by two tenants, and keeps everything it
had. Without the flag a taken name is a conflict (409).

Nothing else moves. Pipelines, API keys, members and trusts reference the tenant
by id, so a rename touches one column.

Deleting is guarded by emptiness: no pipelines, API keys or OIDC trust
relationships, or the request is refused. Every tenant-scoped table cascades, so
the guard is what keeps a mistyped identifier from taking a live tenant's
pipelines with it. Memberships do not count, since a login re-creates its own.

An unknown tenant id now answers 404 instead of 401, which is what the id of a
tenant that does not exist means.

The proptest model gains rename and delete actions, over a small pool of names
so that renames collide often enough to exercise the conflict and the takeover.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 crates/fda/src/cli.rs                         |  35 ++++
 crates/fda/src/main.rs                        |  91 ++++++++
 .../src/api/endpoints/tenant.rs               | 133 +++++++++++-
 crates/pipeline-manager/src/api/main.rs       |   8 +-
 crates/pipeline-manager/src/api/rbac.rs       |   2 +
 crates/pipeline-manager/src/db/error.rs       |  22 +-
 .../src/db/operations/tenant.rs               | 103 ++++++++-
 crates/pipeline-manager/src/db/storage.rs     |  20 +-
 .../src/db/storage_postgres.rs                |  22 ++
 crates/pipeline-manager/src/db/test.rs        | 197 ++++++++++++++++++
 docs.feldera.com/docs/changelog.md            |  18 ++
 .../enterprise/authentication/index.mdx       |  72 +++++--
 .../lib/components/admin/TenantList.svelte    | 181 ++++++++++++++--
 .../src/lib/services/manager/index.ts         |  14 ++
 .../src/lib/services/manager/sdk.gen.ts       |  80 ++++++-
 .../src/lib/services/manager/types.gen.ts     | 143 ++++++++++++-
 .../src/lib/services/pipelineManager.ts       |  27 +++
 openapi.json                                  | 195 ++++++++++++++++-
 python/feldera/rest/feldera_client.py         |  51 +++++
 19 files changed, 1361 insertions(+), 53 deletions(-)

diff --git a/crates/fda/src/cli.rs b/crates/fda/src/cli.rs
index 26937159410..83a12a90cb6 100644
--- a/crates/fda/src/cli.rs
+++ b/crates/fda/src/cli.rs
@@ -2,6 +2,7 @@ use clap::{Args, Parser, Subcommand, ValueEnum, ValueHint};
 use clap_complete::engine::{ArgValueCompleter, CompletionCandidate};
 use std::fmt::Display;
 use std::path::PathBuf;
+use uuid::Uuid;
 
 use crate::make_client;
 use feldera_rest_api::types::{
@@ -248,6 +249,11 @@ pub enum Commands {
         #[command(subcommand)]
         action: OidcTrustActions,
     },
+    /// Manage tenants across the installation (platform owner only).
+    Tenant {
+        #[command(subcommand)]
+        action: TenantActions,
+    },
     /// Cluster information and status.
     Cluster {
         #[command(subcommand)]
@@ -337,6 +343,35 @@ pub enum TrustRole {
     Owner,
 }
 
+#[derive(Subcommand)]
+pub enum TenantActions {
+    /// List every tenant in the installation.
+    List,
+    /// Rename a tenant.
+    ///
+    /// A login resolves its tenant by name, so the new name decides which users
+    /// arrive in this tenant. Renaming a tenant to a name its provider no longer
+    /// asserts sends those users to a new, empty tenant on their next request.
+    Rename {
+        /// Identifier of the tenant to rename, as shown by `fda tenant list`.
+        tenant_id: Uuid,
+        /// The new name.
+        name: String,
+        /// Take the name from the tenant that currently holds it, which is
+        /// renamed to `<name> (<id>)` and keeps everything it had. Needed to
+        /// recover a tenant no login reaches, because every request re-creates
+        /// the name its token resolves.
+        #[arg(long)]
+        displace_existing: bool,
+    },
+    /// Delete a tenant that holds no pipelines, API keys or OIDC trusts.
+    #[clap(aliases = &["del"])]
+    Delete {
+        /// Identifier of the tenant to delete, as shown by `fda tenant list`.
+        tenant_id: Uuid,
+    },
+}
+
 #[derive(Subcommand)]
 pub enum ClusterAction {
     /// Retrieves all cluster events (status only) and prints them.
diff --git a/crates/fda/src/main.rs b/crates/fda/src/main.rs
index 6ef11efba7c..54830914022 100644
--- a/crates/fda/src/main.rs
+++ b/crates/fda/src/main.rs
@@ -556,6 +556,96 @@ async fn oidc_trust_commands(format: OutputFormat, action: OidcTrustActions, cli
     }
 }
 
+async fn tenant_commands(format: OutputFormat, action: TenantActions, client: Client) {
+    match action {
+        TenantActions::List => {
+            debug!("Listing tenants");
+            let response = client
+                .list_tenants()
+                .send()
+                .await
+                .map_err(handle_errors_fatal(
+                    client.baseurl().clone(),
+                    "Failed to list tenants",
+                    1,
+                ))
+                .unwrap();
+            match format {
+                OutputFormat::Text => {
+                    let mut rows = vec![[
+                        "name".to_string(),
+                        "id".to_string(),
+                        "initial provider".to_string(),
+                    ]];
+                    for tenant in response.iter() {
+                        rows.push([
+                            tenant.name.clone(),
+                            tenant.id.0.to_string(),
+                            tenant.initial_provider.clone(),
+                        ]);
+                    }
+                    println!(
+                        "{}",
+                        Builder::from_iter(rows).build().with(Style::rounded())
+                    );
+                }
+                OutputFormat::Json => {
+                    println!(
+                        "{}",
+                        serde_json::to_string_pretty(&response.into_inner())
+                            .expect("Failed to serialize tenant list")
+                    );
+                }
+                _ => {
+                    eprintln!("Unsupported output format: {}", format);
+                    std::process::exit(1);
+                }
+            }
+        }
+        TenantActions::Rename {
+            tenant_id,
+            name,
+            displace_existing,
+        } => {
+            debug!("Renaming tenant {tenant_id} to {name}");
+            let response = client
+                .patch_tenant()
+                .tenant_id(tenant_id)
+                .body_map(|body| body.name(name.clone()).displace_existing(displace_existing))
+                .send()
+                .await
+                .map_err(handle_errors_fatal(
+                    client.baseurl().clone(),
+                    "Failed to rename tenant",
+                    1,
+                ))
+                .unwrap();
+            match &response.displaced {
+                Some(displaced) => println!(
+                    "Renamed tenant {tenant_id} to '{name}'. The tenant that held the name is now '{}' ({}).",
+                    displaced.name, displaced.id.0
+                ),
+                None => println!("Renamed tenant {tenant_id} to '{name}'."),
+            }
+        }
+        TenantActions::Delete { tenant_id } => {
+            debug!("Deleting tenant {tenant_id}");
+            client
+                .delete_tenant()
+                .tenant_id(tenant_id)
+                .send()
+                .await
+                .map_err(handle_errors_fatal(
+                    client.baseurl().clone(),
+                    "Failed to delete tenant",
+                    1,
+                ))
+                .unwrap();
+            println!("Tenant {tenant_id} deleted.");
+        }
+    }
+}
+
 async fn pipelines(format: OutputFormat, client: Client) {
     debug!("Listing pipelines");
     let response = client
@@ -3404,6 +3494,7 @@ fn main() {
                 Commands::OidcTrust { action } => {
                     oidc_trust_commands(cli.format, action, client()).await
                 }
+                Commands::Tenant { action } => tenant_commands(cli.format, action, client()).await,
                 Commands::Pipelines => pipelines(cli.format, client()).await,
                 Commands::Pipeline(action) => pipeline(cli.format, action, client()).await,
                 Commands::ValidateProgram {
diff --git a/crates/pipeline-manager/src/api/endpoints/tenant.rs b/crates/pipeline-manager/src/api/endpoints/tenant.rs
index e1550d1f20d..c67b65e2600 100644
--- a/crates/pipeline-manager/src/api/endpoints/tenant.rs
+++ b/crates/pipeline-manager/src/api/endpoints/tenant.rs
@@ -12,12 +12,12 @@ use crate::db::error::DBError;
 use crate::db::storage::Storage;
 use crate::db::types::role::Role;
 use crate::db::types::tenant::TenantId;
-use crate::db::types::user::UserId;
+use crate::db::types::user::{TenantInfo, UserId};
 use crate::error::ManagerError;
 use actix_web::{
     delete, get,
     http::header::{CacheControl, CacheDirective},
-    post, put,
+    patch, post, put,
     web::{self, Data as WebData, ReqData},
     HttpRequest, HttpResponse,
 };
@@ -88,6 +88,34 @@ pub(crate) struct NewTenantRequest {
     pub name: String,
 }
 
+/// Request to rename a tenant.
+#[derive(Debug, Deserialize, ToSchema)]
+pub(crate) struct RenameTenantRequest {
+    /// The tenant's new name.
+    #[schema(example = "acme")]
+    pub name: String,
+    /// Take the name from the tenant that currently holds it, instead of
+    /// failing with a conflict. That tenant is renamed to `<name> (<id>)` and
+    /// keeps everything it had; nothing is merged or deleted.
+    #[serde(default)]
+    pub displace_existing: bool,
+}
+
+/// Response to a successful tenant rename.
+#[derive(Debug, Serialize, ToSchema)]
+pub(crate) struct RenameTenantResponse {
+    /// The tenant that gave up the name, when `displace_existing` was set and
+    /// another tenant held it. `null` when the name was free.
+    pub displaced: Option<TenantInfo>,
+}
+
+fn parse_tenant_id(req: &HttpRequest) -> Result<TenantId, ManagerError> {
+    let raw = parse_url_parameter(req, "tenant_id")?;
+    let uuid = Uuid::parse_str(&raw)
+        .map_err(|_| ManagerError::from(DBError::UnknownTenantName { name: raw.clone() }))?;
+    Ok(TenantId(uuid))
+}
+
 fn parse_user_id(req: &HttpRequest) -> Result<UserId, ManagerError> {
     let raw = parse_url_parameter(req, "user_id")?;
     let uuid = Uuid::parse_str(&raw).map_err(|_| {
@@ -267,7 +295,99 @@ pub(crate) struct NewTenantResponse {
     pub name: String,
 }
 
-/// List tenants
+/// Rename Tenant
+///
+/// Change a tenant's name. Only the name changes: pipelines, API keys, members
+/// and OIDC trust relationships all reference the tenant by its identifier and
+/// are unaffected.
+///
+/// A login resolves its tenant by name, so renaming decides which tenant those
+/// users reach. Two consequences follow. Renaming a tenant away from a name the
+/// identity provider still asserts sends its users to a new, empty tenant on
+/// their next request, which re-creates the name. And a tenant that no login
+/// reaches, such as `default` after authentication is switched on, is recovered
+/// by giving it the name logins do resolve.
+///
+/// Recovery normally wants a name that is already taken, by the tenant the
+/// first login created. Set `displace_existing` to take it: that tenant is
+/// renamed to `<name> (<id>)` in the same transaction and keeps everything it
+/// had. One step is what makes recovery possible at all, since freeing the name
+/// and claiming it as two calls loses to the next request re-creating it.
+#[utoipa::path(
+    context_path = "/v0",
+    security(("JSON web token (JWT) or API key" = [])),
+    params(("tenant_id" = Uuid, Path, description = "Tenant identifier")),
+    request_body = RenameTenantRequest,
+    responses(
+        (status = OK, description = "Tenant renamed", body = RenameTenantResponse),
+        (status = FORBIDDEN, description = "Caller is not a platform owner", body = ErrorResponse),
+        (status = NOT_FOUND, description = "No tenant with that identifier", body = ErrorResponse),
+        (status = CONFLICT, description = "A tenant with that name already exists, and `displace_existing` was not set", body = ErrorResponse),
+        (status = INTERNAL_SERVER_ERROR, body = ErrorResponse)
+    ),
+    tag = "Platform"
+)]
+#[patch("/tenants/{tenant_id}")]
+pub(crate) async fn patch_tenant(
+    state: WebData<ServerState>,
+    req: HttpRequest,
+    body: web::Json<RenameTenantRequest>,
+) -> Result<HttpResponse, ManagerError> {
+    let tenant_id = parse_tenant_id(&req)?;
+    let body = body.into_inner();
+    let displaced = state
+        .db
+        .lock()
+        .await
+        .rename_tenant(tenant_id, &body.name, body.displace_existing)
+        .await?;
+    match &displaced {
+        Some(t) => info!(
+            "Renamed tenant {tenant_id} to '{}', displacing tenant {} to '{}'",
+            body.name, t.id, t.name
+        ),
+        None => info!("Renamed tenant {tenant_id} to '{}'", body.name),
+    }
+    Ok(HttpResponse::Ok()
+        .insert_header(CacheControl(vec![CacheDirective::NoCache]))
+        .json(&RenameTenantResponse { displaced }))
+}
+
+/// Delete Tenant
+///
+/// Delete a tenant that holds nothing. Its members lose the membership, and a
+/// login that still resolves this tenant's name simply re-creates it, empty.
+///
+/// The tenant must hold no pipelines, API keys or OIDC trust relationships;
+/// otherwise the request fails with a conflict. Everything tenant-scoped
+/// cascades on this delete, so the emptiness rule is what keeps a mistyped
+/// identifier from taking a live tenant's pipelines with it. Delete those
+/// resources first if you mean to.
+#[utoipa::path(
+    context_path = "/v0",
+    security(("JSON web token (JWT) or API key" = [])),
+    params(("tenant_id" = Uuid, Path, description = "Tenant identifier")),
+    responses(
+        (status = OK, description = "Tenant deleted"),
+        (status = FORBIDDEN, description = "Caller is not a platform owner", body = ErrorResponse),
+        (status = NOT_FOUND, description = "No tenant with that identifier", body = ErrorResponse),
+        (status = CONFLICT, description = "The tenant still holds pipelines, API keys or OIDC trust relationships", body = ErrorResponse),
+        (status = INTERNAL_SERVER_ERROR, body = ErrorResponse)
+    ),
+    tag = "Platform"
+)]
+#[delete("/tenants/{tenant_id}")]
+pub(crate) async fn delete_tenant(
+    state: WebData<ServerState>,
+    req: HttpRequest,
+) -> Result<HttpResponse, ManagerError> {
+    let tenant_id = parse_tenant_id(&req)?;
+    state.db.lock().await.delete_tenant(tenant_id).await?;
+    info!("Deleted tenant {tenant_id}");
+    Ok(HttpResponse::Ok().finish())
+}
+
+/// List Tenants
 ///
 /// List all tenants in the installation.
 #[utoipa::path(
@@ -293,10 +413,9 @@ pub(crate) async fn list_tenants(
 /// Create Tenant
 ///
 /// Explicitly create a tenant, rather than relying on first login.
-/// The tenant is keyed to the platform's configured OIDC issuer (statically set
-/// at deploy time, e.g. via Helm), so that logins from that issuer resolve into
-/// it; the issuer is not caller-settable. Fails with a conflict if a tenant with
-/// the same name already exists for that issuer.
+/// A login resolves its tenant by name, so a user whose identity provider
+/// asserts this name lands in the tenant created here. Fails with a conflict if
+/// the name is already taken.
 #[utoipa::path(
     context_path = "/v0",
     security(("JSON web token (JWT) or API key" = [])),
diff --git a/crates/pipeline-manager/src/api/main.rs b/crates/pipeline-manager/src/api/main.rs
index 65e18945a7c..ec76da810ae 100644
--- a/crates/pipeline-manager/src/api/main.rs
+++ b/crates/pipeline-manager/src/api/main.rs
@@ -269,7 +269,9 @@ It contains the following fields:
         endpoints::tenant::put_tenant_user,
         endpoints::tenant::delete_tenant_user,
         endpoints::tenant::list_tenants,
-        endpoints::tenant::create_tenant
+        endpoints::tenant::create_tenant,
+        endpoints::tenant::patch_tenant,
+        endpoints::tenant::delete_tenant
     ),
     components(schemas(
         // Authentication
@@ -357,6 +359,8 @@ It contains the following fields:
         crate::api::endpoints::tenant::AddMemberRequest,
         crate::api::endpoints::tenant::AddMemberResponse,
         crate::api::endpoints::tenant::NewTenantRequest,
+        crate::api::endpoints::tenant::RenameTenantRequest,
+        crate::api::endpoints::tenant::RenameTenantResponse,
         crate::api::endpoints::tenant::NewTenantResponse,
 
         // API key
@@ -774,6 +778,8 @@ fn api_scope() -> Scope {
         .service(endpoints::tenant::delete_tenant_user)
         .service(endpoints::tenant::list_tenants)
         .service(endpoints::tenant::create_tenant)
+        .service(endpoints::tenant::patch_tenant)
+        .service(endpoints::tenant::delete_tenant)
 }
 
 struct SecurityAddon;
diff --git a/crates/pipeline-manager/src/api/rbac.rs b/crates/pipeline-manager/src/api/rbac.rs
index bb89ad55553..bdffff45c2f 100644
--- a/crates/pipeline-manager/src/api/rbac.rs
+++ b/crates/pipeline-manager/src/api/rbac.rs
@@ -101,6 +101,8 @@ static ROUTE_MIN_ROLE: &[(&str, &str, Option<Role>)] = &[
     ("DELETE", "/v0/tenant/users/{user_id}", Some(Role::Admin)), // delete_tenant_user
     ("GET", "/v0/tenants", Some(Role::Owner)), // list_tenants
     ("POST", "/v0/tenants", Some(Role::Owner)), // create_tenant
+    ("PATCH", "/v0/tenants/{tenant_id}", Some(Role::Owner)), // patch_tenant
+    ("DELETE", "/v0/tenants/{tenant_id}", Some(Role::Owner)), // delete_tenant
 ];
 
 /// [`ROUTE_MIN_ROLE`] indexed by `(method, path)`, built once on first use. The
diff --git a/crates/pipeline-manager/src/db/error.rs b/crates/pipeline-manager/src/db/error.rs
index 2c68028f938..04c4560f9b5 100644
--- a/crates/pipeline-manager/src/db/error.rs
+++ b/crates/pipeline-manager/src/db/error.rs
@@ -146,6 +146,12 @@ pub enum DBError {
     UnknownTenantName {
         name: String,
     },
+    TenantNotEmpty {
+        tenant_id: TenantId,
+        pipelines: i64,
+        api_keys: i64,
+        oidc_trusts: i64,
+    },
     // API key-related errors
     UnknownApiKey {
         name: String,
@@ -625,6 +631,18 @@ impl Display for DBError {
             DBError::UnknownTenantName { name } => {
                 write!(f, "Unknown tenant '{name}'")
             }
+            DBError::TenantNotEmpty {
+                tenant_id,
+                pipelines,
+                api_keys,
+                oidc_trusts,
+            } => {
+                write!(
+                    f,
+                    "Tenant '{tenant_id}' still holds {pipelines} pipeline(s), {api_keys} API key(s) \
+                     and {oidc_trusts} OIDC trust relationship(s); delete those first"
+                )
+            }
             DBError::UnknownApiKey { name } => {
                 write!(f, "Unknown API key '{name}'")
             }
@@ -986,6 +1004,7 @@ impl DetailedError for DBError {
             Self::TooLongDescription { .. } => Cow::from("TooLongDescription"),
             Self::UnknownTenant { .. } => Cow::from("UnknownTenant"),
             Self::UnknownTenantName { .. } => Cow::from("UnknownTenantName"),
+            Self::TenantNotEmpty { .. } => Cow::from("TenantNotEmpty"),
             Self::UnknownApiKey { .. } => Cow::from("UnknownApiKey"),
             Self::InvalidApiKey => Cow::from("InvalidApiKey"),
             Self::InsufficientPermissions { .. } => Cow::from("InsufficientPermissions"),
@@ -1111,8 +1130,9 @@ impl ResponseError for DBError {
             Self::InvalidTag { .. } => StatusCode::BAD_REQUEST,
             Self::TooManyTags { .. } => StatusCode::BAD_REQUEST,
             Self::TooLongDescription { .. } => StatusCode::BAD_REQUEST,
-            Self::UnknownTenant { .. } => StatusCode::UNAUTHORIZED, // TODO: should we report not found instead?
+            Self::UnknownTenant { .. } => StatusCode::NOT_FOUND,
             Self::UnknownTenantName { .. } => StatusCode::NOT_FOUND,
+            Self::TenantNotEmpty { .. } => StatusCode::CONFLICT,
             Self::UnknownApiKey { .. } => StatusCode::NOT_FOUND,
             Self::InvalidApiKey => StatusCode::UNAUTHORIZED,
             Self::InsufficientPermissions { .. } => StatusCode::FORBIDDEN,
diff --git a/crates/pipeline-manager/src/db/operations/tenant.rs b/crates/pipeline-manager/src/db/operations/tenant.rs
index 67ce118db59..4ee5a5d6a19 100644
--- a/crates/pipeline-manager/src/db/operations/tenant.rs
+++ b/crates/pipeline-manager/src/db/operations/tenant.rs
@@ -113,10 +113,111 @@ pub async fn create_tenant(
     Ok(TenantId(id))
 }
 
+/// Renames a tenant, failing with a conflict if the name is already taken.
+///
+/// Only the name changes: every other table references a tenant by its id, so
+/// no membership, key, pipeline or trust is affected. The name is what a login
+/// resolves, though, so renaming changes which tenant those users land in.
+///
+/// With `displace_existing`, the tenant that currently holds `new_name` gives it
+/// up and takes `<name> (<id>)` instead, as the V35 migration does for names
+/// shared by two tenants; the displaced tenant is returned. This has to happen
+/// in one transaction: a login re-creates the name it resolves on its very next
+/// request, so freeing the name and claiming it as two calls can never win the
+/// race. Nothing is merged or deleted, and the displaced tenant keeps
+/// everything it had.
+pub async fn rename_tenant(
+    txn: &Transaction<'_>,
+    tenant_id: TenantId,
+    new_name: &str,
+    displace_existing: bool,
+) -> Result<Option<TenantInfo>, DBError> {
+    let displaced = if displace_existing {
+        displace_name_holder(txn, tenant_id, new_name).await?
+    } else {
+        None
+    };
+    let stmt = txn
+        .prepare_cached("UPDATE tenant SET tenant = $2 WHERE id = $1")
+        .await?;
+    let updated = txn
+        .execute(&stmt, &[&tenant_id.0, &new_name])
+        .await
+        .map_err(maybe_unique_violation)?;
+    if updated > 0 {
+        Ok(displaced)
+    } else {
+        Err(DBError::UnknownTenant { tenant_id })
+    }
+}
+
+/// Renames whichever tenant holds `name` to `<name> (<id>)`, so that the caller
+/// can take the name. Returns the displaced tenant, or `None` when the name is
+/// free or already belongs to `keep`.
+async fn displace_name_holder(
+    txn: &Transaction<'_>,
+    keep: TenantId,
+    name: &str,
+) -> Result<Option<TenantInfo>, DBError> {
+    let stmt = txn
+        .prepare_cached(
+            "UPDATE tenant SET tenant = tenant || ' (' || id || ')' \
+             WHERE tenant = $1 AND id <> $2 \
+             RETURNING id, tenant, initial_provider",
+        )
+        .await?;
+    let row = txn
+        .query_opt(&stmt, &[&name, &keep.0])
+        .await
+        .map_err(maybe_unique_violation)?;
+    Ok(row.map(|row| TenantInfo {
+        id: TenantId(row.get(0)),
+        name: row.get(1),
+        initial_provider: row.get(2),
+    }))
+}
+
+/// Deletes a tenant that holds nothing, failing otherwise.
+///
+/// Every tenant-scoped table cascades on this delete, so an unguarded delete
+/// would take pipelines with it, silently and with no undo. The guard is
+/// emptiness: no pipelines, API keys or OIDC trust relationships. Memberships
+/// are not counted, since a login re-creates its own on the next request, and
+/// they are the only thing a leftover tenant usually holds.
+pub async fn delete_tenant(txn: &Transaction<'_>, tenant_id: TenantId) -> Result<(), DBError> {
+    let stmt = txn
+        .prepare_cached(
+            "SELECT (SELECT count(*) FROM pipeline WHERE tenant_id = $1), \
+                    (SELECT count(*) FROM api_key WHERE tenant_id = $1), \
+                    (SELECT count(*) FROM oidc_trust_relationship WHERE tenant_id = $1)",
+        )
+        .await?;
+    let row = txn.query_one(&stmt, &[&tenant_id.0]).await?;
+    let (pipelines, api_keys, oidc_trusts): (i64, i64, i64) = (row.get(0), row.get(1), row.get(2));
+    if pipelines > 0 || api_keys > 0 || oidc_trusts > 0 {
+        return Err(DBError::TenantNotEmpty {
+            tenant_id,
+            pipelines,
+            api_keys,
+            oidc_trusts,
+        });
+    }
+
+    let stmt = txn
+        .prepare_cached("DELETE FROM tenant WHERE id = $1")
+        .await?;
+    let deleted = txn.execute(&stmt, &[&tenant_id.0]).await?;
+    if deleted > 0 {
+        Ok(())
+    } else {
+        Err(DBError::UnknownTenant { tenant_id })
+    }
+}
+
 /// Lists all tenants in the installation (platform-wide, owner-only).
 pub async fn list_tenants(txn: &Transaction<'_>) -> Result<Vec<TenantInfo>, DBError> {
     let stmt = txn
-        .prepare_cached("SELECT id, tenant, provider FROM tenant ORDER BY tenant")
+        .prepare_cached("SELECT id, tenant, initial_provider FROM tenant ORDER BY tenant")
         .await?;
     let rows = txn.query(&stmt, &[]).await?;
     Ok(rows
diff --git a/crates/pipeline-manager/src/db/storage.rs b/crates/pipeline-manager/src/db/storage.rs
index 704abb44aee..e933907b5ea 100644
--- a/crates/pipeline-manager/src/db/storage.rs
+++ b/crates/pipeline-manager/src/db/storage.rs
@@ -100,8 +100,8 @@ pub(crate) trait Storage {
     /// [`crate::db::operations::tenant::resolve_tenant_selector`].
     async fn resolve_tenant_selector(&self, selector: &str) -> Result<TenantId, DBError>;
 
-    /// Creates a tenant, failing with a conflict (HTTP 409) if `(name, provider)`
-    /// already exists.
+    /// Creates a tenant, failing with a conflict (HTTP 409) if the name is
+    /// already taken.
     async fn create_tenant(
         &self,
         id: Uuid,
@@ -109,6 +109,22 @@ pub(crate) trait Storage {
         provider: &str,
     ) -> Result<TenantId, DBError>;
 
+    /// Renames a tenant, failing with a conflict (HTTP 409) if the name is
+    /// already taken, unless `displace_existing` lets it take the name from the
+    /// tenant holding it. Returns the displaced tenant, if any.
+    /// See [`crate::db::operations::tenant::rename_tenant`].
+    async fn rename_tenant(
+        &self,
+        tenant_id: TenantId,
+        new_name: &str,
+        displace_existing: bool,
+    ) -> Result<Option<TenantInfo>, DBError>;
+
+    /// Deletes a tenant, failing with a conflict (HTTP 409) unless it holds no
+    /// pipelines, API keys or OIDC trust relationships.
+    /// See [`crate::db::operations::tenant::delete_tenant`].
+    async fn delete_tenant(&self, tenant_id: TenantId) -> Result<(), DBError>;
+
     /// Lists all tenants in the installation.
     async fn list_tenants(&self) -> Result<Vec<TenantInfo>, DBError>;
 
diff --git a/crates/pipeline-manager/src/db/storage_postgres.rs b/crates/pipeline-manager/src/db/storage_postgres.rs
index f8cc63d1813..57a725462fd 100644
--- a/crates/pipeline-manager/src/db/storage_postgres.rs
+++ b/crates/pipeline-manager/src/db/storage_postgres.rs
@@ -138,6 +138,28 @@ impl Storage for StoragePostgres {
         Ok(result)
     }
 
+    async fn delete_tenant(&self, tenant_id: TenantId) -> Result<(), DBError> {
+        let mut client = self.pool.get().await?;
+        let txn = client.transaction().await?;
+        operations::tenant::delete_tenant(&txn, tenant_id).await?;
+        txn.commit().await?;
+        Ok(())
+    }
+
+    async fn rename_tenant(
+        &self,
+        tenant_id: TenantId,
+        new_name: &str,
+        displace_existing: bool,
+    ) -> Result<Option<TenantInfo>, DBError> {
+        let mut client = self.pool.get().await?;
+        let txn = client.transaction().await?;
+        let displaced =
+            operations::tenant::rename_tenant(&txn, tenant_id, new_name, displace_existing).await?;
+        txn.commit().await?;
+        Ok(displaced)
+    }
+
     async fn list_tenants(&self) -> Result<Vec<TenantInfo>, DBError> {
         let mut client = self.pool.get().await?;
         let txn = client.transaction().await?;
diff --git a/crates/pipeline-manager/src/db/test.rs b/crates/pipeline-manager/src/db/test.rs
index 0d876bfb9a3..27511eee8e5 100644
--- a/crates/pipeline-manager/src/db/test.rs
+++ b/crates/pipeline-manager/src/db/test.rs
@@ -308,6 +308,12 @@ fn limited_oidc_trust_name() -> impl Strategy<Value = String> {
     })
 }
 
+/// Generates one of a few tenant names, so that renames collide often enough
+/// to exercise the unique-name conflict.
+fn limited_tenant_name() -> impl Strategy<Value = String> {
+    any::<u8>().prop_map(|val| format!("tenant-{}", val % 3))
+}
+
 /// Generates one of a few issuers, so that trusts collide on issuer often
 /// enough to exercise matching and the trusted-issuer gate.
 fn limited_issuer() -> impl Strategy<Value = String> {
@@ -1028,6 +1034,118 @@ async fn tenant_survives_a_changed_issuer() {
     );
 }
 
+/// A tenant no login reaches is recovered by taking the name logins do resolve,
+/// even though every request re-creates that name.
+#[tokio::test]
+async fn renaming_takes_a_name_that_logins_keep_recreating() {
+    let handle = test_setup().await;
+    let provider = "https://acme.idp.example".to_string();
+    let asserted = "acme.idp.example".to_string();
+
+    // Authentication goes on: the first login creates a tenant of its own, and
+    // everything from before is left behind in `default`.
+    let stranded = TenantRecord::default().id;
+    let fresh = handle
+        .db
+        .get_or_create_tenant_id(Uuid::now_v7(), asserted.clone(), provider.clone())
+        .await
+        .unwrap();
+    assert_ne!(stranded, fresh);
+
+    // Freeing the name first cannot work: the next request re-creates it. So
+    // the plain rename conflicts, and only taking the name succeeds.
+    assert!(matches!(
+        handle
+            .db
+            .rename_tenant(stranded, &asserted, false)
+            .await
+            .unwrap_err(),
+        DBError::DuplicateName
+    ));
+    let displaced = handle
+        .db
+        .rename_tenant(stranded, &asserted, true)
+        .await
+        .unwrap()
+        .expect("the tenant holding the name should have been displaced");
+    assert_eq!(displaced.id, fresh);
+    assert_eq!(displaced.name, format!("{asserted} ({fresh})"));
+
+    // The next login lands on the recovered tenant, with its pipelines.
+    let after = handle
+        .db
+        .get_or_create_tenant_id(Uuid::now_v7(), asserted.clone(), provider)
+        .await
+        .unwrap();
+    assert_eq!(after, stranded);
+}
+
+/// A tenant is deleted only once it holds nothing, so a mistyped identifier
+/// cannot cascade away a live tenant's resources.
+#[tokio::test]
+async fn deleting_a_tenant_requires_it_to_be_empty() {
+    let handle = test_setup().await;
+    let tenant = handle
+        .db
+        .get_or_create_tenant_id(
+            Uuid::now_v7(),
+            "leftover".to_string(),
+            "https://idp.example".to_string(),
+        )
+        .await
+        .unwrap();
+
+    // A member alone does not block: a login re-creates its own membership.
+    let user = handle
+        .db
+        .get_or_create_user(
+            Uuid::now_v7(),
+            "https://idp.example",
+            "someone",
+            Some("someone@idp.example"),
+        )
+        .await
+        .unwrap();
+    handle
+        .db
+        .upsert_member_role(tenant, user, Role::Write)
+        .await
+        .unwrap();
+
+    // An API key does.
+    handle
+        .db
+        .store_api_key_hash(
+            tenant,
+            Uuid::now_v7(),
+            "key",
+            &generate_api_key(),
+            MintableKeyRole::Write,
+        )
+        .await
+        .unwrap();
+    assert!(matches!(
+        handle.db.delete_tenant(tenant).await.unwrap_err(),
+        DBError::TenantNotEmpty { api_keys: 1, .. }
+    ));
+
+    handle.db.delete_api_key(tenant, "key").await.unwrap();
+    handle.db.delete_tenant(tenant).await.unwrap();
+    assert!(!handle
+        .db
+        .list_tenants()
+        .await
+        .unwrap()
+        .iter()
+        .any(|t| t.id == tenant));
+
+    // Deleting it again reports the tenant as unknown.
+    assert!(matches!(
+        handle.db.delete_tenant(tenant).await.unwrap_err(),
+        DBError::UnknownTenant { .. }
+    ));
+}
+
 /// `first_user_role` sets the role of the login that creates a tenant: with
 /// `write`, the creator is not made admin (e.g. a shared sandbox).
 #[tokio::test]
@@ -3871,6 +3989,21 @@ async fn check_rbac_action(
                 .await;
             check_responses(i, model_response, impl_response);
         }
+        RbacAction::RenameTenant(tenant_id, new_name, displace_existing) => {
+            let model_response = model
+                .rename_tenant(tenant_id, &new_name, displace_existing)
+                .await;
+            let impl_response = handle
+                .db
+                .rename_tenant(tenant_id, &new_name, displace_existing)
+                .await;
+            check_responses(i, model_response, impl_response);
+        }
+        RbacAction::DeleteTenant(tenant_id) => {
+            let model_response = model.delete_tenant(tenant_id).await;
+            let impl_response = handle.db.delete_tenant(tenant_id).await;
+            check_responses(i, model_response, impl_response);
+        }
         RbacAction::ListTenants => {
             let mut model_response = model.list_tenants().await.unwrap();
             let mut impl_response = handle.db.list_tenants().await.unwrap();
@@ -3985,6 +4118,12 @@ enum RbacAction {
         #[proptest(strategy = "limited_claim_value()")] String,
         #[proptest(strategy = "prop::collection::vec(limited_claim_value(), 0..3)")] Vec<String>,
     ),
+    RenameTenant(
+        TenantId,
+        #[proptest(strategy = "limited_tenant_name()")] String,
+        bool,
+    ),
+    DeleteTenant(TenantId),
     // Users and tenant memberships
     ListTenants,
     GetOrCreateUser(
@@ -5854,6 +5993,64 @@ impl Storage for Mutex<DbModel> {
             })
     }
 
+    async fn delete_tenant(&self, tenant_id: TenantId) -> DBResult<()> {
+        let mut s = self.lock().await;
+        if !s.tenants.contains_key(&tenant_id) {
+            return Err(DBError::UnknownTenant { tenant_id });
+        }
+        let pipelines = s.pipelines.keys().filter(|(t, _)| *t == tenant_id).count() as i64;
+        let api_keys = s.api_keys.keys().filter(|(t, _)| *t == tenant_id).count() as i64;
+        let oidc_trusts = s
+            .oidc_trusts
+            .keys()
+            .filter(|(scope, _)| *scope == Some(tenant_id))
+            .count() as i64;
+        if pipelines > 0 || api_keys > 0 || oidc_trusts > 0 {
+            return Err(DBError::TenantNotEmpty {
+                tenant_id,
+                pipelines,
+                api_keys,
+                oidc_trusts,
+            });
+        }
+        s.tenants.remove(&tenant_id);
+        s.memberships.retain(|(t, _), _| *t != tenant_id);
+        s.pipeline_events.retain(|(t, _), _| *t != tenant_id);
+        Ok(())
+    }
+
+    async fn rename_tenant(
+        &self,
+        tenant_id: TenantId,
+        new_name: &str,
+        displace_existing: bool,
+    ) -> DBResult<Option<TenantInfo>> {
+        let mut s = self.lock().await;
+        if !s.tenants.contains_key(&tenant_id) {
+            return Err(DBError::UnknownTenant { tenant_id });
+        }
+        let holder = s
+            .tenants
+            .iter()
+            .find(|(id, t)| **id != tenant_id && t.tenant == new_name)
+            .map(|(id, _)| *id);
+        let displaced = match holder {
+            Some(_) if !displace_existing => return Err(DBError::DuplicateName),
+            Some(id) => {
+                let holder = s.tenants.get_mut(&id).unwrap();
+                holder.tenant = format!("{} ({})", holder.tenant, id);
+                Some(TenantInfo {
+                    id,
+                    name: holder.tenant.clone(),
+                    initial_provider: holder.initial_provider.clone(),
+                })
+            }
+            None => None,
+        };
+        s.tenants.get_mut(&tenant_id).unwrap().tenant = new_name.to_string();
+        Ok(displaced)
+    }
+
     async fn list_tenants(&self) -> DBResult<Vec<TenantInfo>> {
         let s = self.lock().await;
         Ok(s.tenants
diff --git a/docs.feldera.com/docs/changelog.md b/docs.feldera.com/docs/changelog.md
index ab0a8c7ae5f..9a5c9b3ef06 100644
--- a/docs.feldera.com/docs/changelog.md
+++ b/docs.feldera.com/docs/changelog.md
@@ -38,6 +38,24 @@ import TabItem from '@theme/TabItem';
           already logged in (an owner or admin adjusts those individually). Tighten
           `defaultRole` back to `read` once explicit roles are provisioned.
 
+        - A tenant is now identified by its name alone. Before, a tenant was keyed by
+          `(name, OIDC issuer)`, so changing `auth.issuer` created a second, empty
+          tenant of the same name and stranded the pipelines on the first one, which
+          no login could reach. Logins now resolve the existing tenant across an
+          issuer change. A deployment whose issuer already changed holds two tenants
+          of the same name: the upgrade keeps the name on the one its users reach
+          today and appends the id to the other's name, merging and deleting nothing.
+          `GET /v0/tenants` lists both.
+
+        - Owners can rename a tenant, through `PATCH /v0/tenants/{tenant_id}` or the
+          web console's admin page. A rename changes only the name, which is what a
+          login resolves, so it is how an owner reunites users with a tenant they can
+          no longer reach: the `default` tenant after authentication is switched on,
+          or a tenant left behind by an identity-provider change. Pass
+          `displace_existing` to take a name the first login already created a tenant
+          under; that tenant becomes `<name> (<id>)` and keeps everything it had. See
+          [Changing your authentication setup](/get-started/enterprise/authentication#changing-your-authentication-setup).
+
         - Breaking change (API keys): the `scopes` array on API-key responses
           (`GET /v0/api_keys`, `GET /v0/api_keys/{api_key_name}`) is replaced by a single
           `role` string, one of `read` or `write` (lower-case). Clients that read the
diff --git a/docs.feldera.com/docs/get-started/enterprise/authentication/index.mdx b/docs.feldera.com/docs/get-started/enterprise/authentication/index.mdx
index 75b546242c0..3d5c9ab153f 100644
--- a/docs.feldera.com/docs/get-started/enterprise/authentication/index.mdx
+++ b/docs.feldera.com/docs/get-started/enterprise/authentication/index.mdx
@@ -169,26 +169,23 @@ Both need planning, because a tenant is where pipelines live.
 
 A tenant is identified by its **name** alone. The name is derived from the token
 on each login, by whichever [tenant assignment strategy](#tenant-assignment-strategies)
-you configured. A tenant also records the issuer it was first seen under, but
-that is provenance only: it does not take part in identifying the tenant, so
-changing the issuer never creates a second tenant of the same name.
+you configured.
 
 A user is identified by the pair `(issuer, subject)`. That pair is what
 memberships and roles hang off, and unlike the tenant name it **does** include
 the issuer, because OIDC only guarantees `sub` to be unique within one issuer.
 
-The practical consequence is worth stating plainly: a tenant can survive a
-provider change, but the users in it cannot. They arrive as new identities and
-must be granted their roles again.
+The consequence is that a tenant can survive a provider change, but the users in
+it cannot. They arrive as new identities and must be granted their roles again.
 
 ### Enabling authentication on an existing deployment
 
 Without authentication, everything lives in one built-in tenant named `default`,
 whose id is the all-zero UUID `00000000-0000-0000-0000-000000000000`. Once
 authentication is on, each login resolves to a tenant named by your chosen
-strategy, never to `default`, so pipelines and API keys created beforehand are
-not visible to ordinary logins. The data is intact, just in a tenant nobody
-resolves to any more.
+strategy, which is no longer `default`, so pipelines and API keys created while
+authentication was disabled are no longer visible to ordinary logins. The data
+is intact, just in a tenant nobody resolves to any more.
 
 A platform [owner](/get-started/enterprise/authentication/roles) can still reach
 it by naming that tenant explicitly:
@@ -199,8 +196,45 @@ curl -H "Authorization: Bearer $OWNER_TOKEN" \
      https://<your-host>/v0/pipelines
 ```
 
-Recreate the resources in a regular tenant from there. Plan this before enabling
-authentication on a deployment that already holds pipelines.
+You have two ways to go on from there:
+
+- Recreate the resources in the tenant your logins now reach, then stop and
+  delete the pipelines left behind in `default`. Deleting them matters: a
+  pipeline nobody can see still holds its Kubernetes pods and volumes, running
+  and unaccounted for.
+- Put `default` in that tenant's place, by giving it the new tenant name your
+  logins resolve.
+
+To rename the `default` tenant, `00000000-0000-0000-0000-000000000000`, to
+`acme.us-west1.idp.com`:
+
+```bash
+curl -X PATCH -H "Authorization: Bearer $OWNER_TOKEN" \
+     -H "Content-Type: application/json" \
+     -d '{"name": "acme.us-west1.idp.com", "displace_existing": true}' \
+     https://<your-host>/v0/tenants/00000000-0000-0000-0000-000000000000
+```
+
+`displace_existing` is what makes this work. The first login after the switch
+created a tenant under `acme.us-west1.idp.com` already, and every request
+re-creates that name, so a plain rename, with `displace_existing: false`,
+conflicts. With `displace_existing`, the freshly created `acme.us-west1.idp.com`
+is renamed to `acme.us-west1.idp.com (<its id>)`, reported in the response under
+`displaced`, and `default` takes the name. From the next request on,
+`acme.us-west1.idp.com` resolves to the original `default` tenant, with your
+pipelines. The displaced tenant is empty, having been created after the switch,
+so delete it:
+
+```bash
+curl -X DELETE -H "Authorization: Bearer $OWNER_TOKEN" \
+     https://<your-host>/v0/tenants/<displaced id>
+```
+
+The web console does the same: rename `default`, and when the name collides it
+offers to take it, then delete the tenant it displaced.
+
+Plan this before enabling authentication on a deployment that already holds
+pipelines.
 
 ### Changing the identity provider
 
@@ -215,12 +249,24 @@ same from the new provider's tokens:
 
 So the mode that migrates cleanly is managed tenancy, because the tenant name is
 a value you control at the provider rather than something derived from it. If you
-expect to change providers, prefer it.
+expect to change providers regularly, prefer it.
 
 Where the name does change, the old tenant keeps every pipeline and is no longer
 reachable by ordinary logins. Recover it the same way as above: an owner selects
 it with `Feldera-Tenant` (by name or UUID, and `GET /v0/tenants` lists both) and
-moves what is needed.
+moves what is needed, or gives it the name the new provider produces, with
+`displace_existing`, so the logins land back on it.
+
+Whichever way you go, do not leave pipelines behind in a tenant nobody reaches.
+They keep their Kubernetes pods and volumes running, and nobody is watching
+them. Stop and delete the pipelines, then delete the empty tenant with
+`DELETE /v0/tenants/{tenant_id}`.
+
+The destructive rename is the opposite one: taking a name away from the tenant
+whose users still arrive under it. Rename `acme.us-west1.idp.com` to `tmp` while
+the provider keeps asserting `acme.us-west1.idp.com`, and the next request from
+those users re-creates that name as an empty tenant, which is where they then
+work. Rename a tenant only to a name you want its users to arrive under.
 
 :::warning Roles are not carried across a provider change
 Even when the tenant survives, its members do not. A membership is keyed to
diff --git a/js-packages/web-console/src/lib/components/admin/TenantList.svelte b/js-packages/web-console/src/lib/components/admin/TenantList.svelte
index a4473b4fb67..78b320cca61 100644
--- a/js-packages/web-console/src/lib/components/admin/TenantList.svelte
+++ b/js-packages/web-console/src/lib/components/admin/TenantList.svelte
@@ -7,8 +7,10 @@
   import { setSelectedTenant } from '$lib/services/auth'
   import {
     createTenant,
+    deleteTenant,
     getAuthConfig,
     getTenants,
+    renameTenant,
     type Tenant
   } from '$lib/services/pipelineManager'
 
@@ -16,7 +18,8 @@
 
   // A login resolves its tenant by name, so the name a new tenant is given is
   // the one the identity provider must assert for its users to land in it. The
-  // issuer is configured at deploy time, not here; show it read-only.
+  // issuer only gets recorded as provenance, so it lives in a hover rather than
+  // a field of its own.
   const authConfig = asyncReadable<Record<string, { issuer?: string }> | undefined>(
     undefined,
     getAuthConfig
@@ -27,13 +30,14 @@
       '(configured at deploy time)'
   )
 
-  // Compare/select by tenant id (UUID): the id never changes, and the backend's
-  // Feldera-Tenant resolver accepts it unambiguously.
+  // Compare/select by tenant id (UUID): a name can be reassigned by a rename,
+  // the id never changes, and the backend's Feldera-Tenant resolver accepts it.
   const currentTenantId = $derived(page.data.feldera?.tenantId)
 
   let newName = $state('')
   let creating = $state(false)
   let errorMessage = $state('')
+  let noticeMessage = $state('')
 
   const create = async () => {
     if (!newName.trim()) {
@@ -53,6 +57,88 @@
     }
   }
 
+  let renamingId = $state('')
+  let renamedName = $state('')
+  let renaming = $state(false)
+
+  const startRename = (tenant: Tenant) => {
+    errorMessage = ''
+    noticeMessage = ''
+    nameToTakeOver = ''
+    renamingId = tenant.id
+    renamedName = tenant.name
+  }
+
+  const cancelRename = () => {
+    renamingId = ''
+    renamedName = ''
+    nameToTakeOver = ''
+  }
+
+  // Set when a rename conflicts, to offer taking the name from the tenant that
+  // holds it. Every request re-creates the name its token resolves, so a
+  // conflict is the normal case when recovering a tenant no login reaches.
+  let nameToTakeOver = $state('')
+
+  const submitRename = async (displaceExisting = false) => {
+    const name = renamedName.trim()
+    if (!name) {
+      errorMessage = 'Specify a tenant name'
+      return
+    }
+    errorMessage = ''
+    noticeMessage = ''
+    nameToTakeOver = ''
+    renaming = true
+    try {
+      const { displaced } = await renameTenant(renamingId, name, displaceExisting)
+      cancelRename()
+      if (displaced) {
+        noticeMessage = `Took the name '${name}'. The tenant that held it is now '${displaced.name}' and keeps everything it had.`
+      }
+      tenants.reload?.()
+      // The tenant indicator and any loader that resolved the old name still
+      // hold it, so re-fetch once the rename lands.
+      clearConfigCaches()
+      await invalidateAll()
+    } catch (e) {
+      const message = e instanceof Error ? e.message : String(e)
+      if (/already exists|DuplicateName/i.test(message) && !displaceExisting) {
+        nameToTakeOver = name
+      } else {
+        errorMessage = message
+      }
+    } finally {
+      renaming = false
+    }
+  }
+
+  // Deletion is refused unless the tenant is empty, so the confirmation is
+  // about intent, not about losing data.
+  let tenantToDelete = $state('')
+  let deleting = $state(false)
+
+  const confirmDelete = async (tenant: Tenant) => {
+    errorMessage = ''
+    noticeMessage = ''
+    if (tenantToDelete !== tenant.id) {
+      tenantToDelete = tenant.id
+      return
+    }
+    deleting = true
+    try {
+      await deleteTenant(tenant.id)
+      tenantToDelete = ''
+      noticeMessage = `Deleted tenant '${tenant.name}'.`
+      tenants.reload?.()
+    } catch (e) {
+      tenantToDelete = ''
+      errorMessage = e instanceof Error ? e.message : String(e)
+    } finally {
+      deleting = false
+    }
+  }
+
   // Switch the active tenant via the `Feldera-Tenant` header. Clearing the
   // cached config/session forces the next load to re-fetch /config/session
   // under the new header (the warm cache would otherwise keep reporting the
@@ -70,18 +156,69 @@
   {#if errorMessage}
     <div class="rounded preset-outlined-error-600-400 p-2 text-sm">{errorMessage}</div>
   {/if}
+  {#if noticeMessage}
+    <div class="rounded preset-outlined-success-600-400 p-2 text-sm">{noticeMessage}</div>
+  {/if}
   <div class="scrollbar flex flex-col gap-2 overflow-auto">
     {#each $tenants as tenant (tenant.id)}
       <div class="flex flex-nowrap items-center gap-2 border-b border-surface-100-900 py-2">
         <div class="w-full">
-          <div class="font-medium">
-            {tenant.name}
-            {#if tenant.id === currentTenantId}
-              <span class="text-xs opacity-70">(current)</span>
+          {#if renamingId === tenant.id}
+            <form
+              class="flex items-center gap-2"
+              onsubmit={(e) => {
+                e.preventDefault()
+                submitRename()
+              }}
+            >
+              <!-- svelte-ignore a11y_autofocus -->
+              <input class="input w-72" bind:value={renamedName} autofocus />
+              <button class="btn preset-filled-surface-50-950" disabled={renaming}>Save</button>
+              <button
+                type="button"
+                class="btn preset-tonal-surface"
+                disabled={renaming}
+                onclick={cancelRename}
+              >
+                Cancel
+              </button>
+            </form>
+            {#if nameToTakeOver}
+              <div class="mt-2 rounded preset-outlined-warning-600-400 p-2 text-sm">
+                Another tenant is named <code>{nameToTakeOver}</code>. Taking the name renames that
+                tenant to <code>{nameToTakeOver} (its id)</code>; it keeps its pipelines, keys and
+                members. Logins that resolve <code>{nameToTakeOver}</code> then land here.
+                <button
+                  class="ml-2 btn preset-filled-surface-50-950"
+                  disabled={renaming}
+                  onclick={() => submitRename(true)}
+                >
+                  Take the name
+                </button>
+              </div>
             {/if}
+          {:else}
+            <div class="font-medium">
+              {tenant.name}
+              {#if tenant.id === currentTenantId}
+                <span class="text-xs opacity-70">(current)</span>
+              {/if}
+            </div>
+          {/if}
+          <!-- The issuer is provenance, not something a login resolves, so it
+               stays out of the row and is available on hover. -->
+          <div class="text-sm opacity-70" title="First provisioned under {tenant.initial_provider}">
+            {tenant.id}
           </div>
-          <div class="text-sm opacity-70"><code>{tenant.initial_provider}</code> · {tenant.id}</div>
         </div>
+        <button
+          class="btn preset-tonal-surface"
+          disabled={renamingId === tenant.id}
+          onclick={() => startRename(tenant)}
+          title="A login resolves its tenant by name: renaming changes which users land in this tenant."
+        >
+          Rename
+        </button>
         <button
           class="btn preset-filled-surface-50-950"
           disabled={tenant.id === currentTenantId}
@@ -89,6 +226,16 @@
         >
           Act as this tenant
         </button>
+        <button
+          class="btn {tenantToDelete === tenant.id
+            ? 'preset-filled-error-500'
+            : 'preset-tonal-surface'}"
+          disabled={deleting || tenant.id === currentTenantId}
+          onclick={() => confirmDelete(tenant)}
+          title="Only an empty tenant can be deleted: no pipelines, API keys or OIDC trust relationships."
+        >
+          {tenantToDelete === tenant.id ? 'Confirm delete' : 'Delete'}
+        </button>
       </div>
     {:else}
       <div class="opacity-70">No tenants found</div>
@@ -106,16 +253,12 @@
       <span>New tenant name</span>
       <input class="input w-full" placeholder="acme-prod" bind:value={newName} />
     </label>
-    <label class="label w-72">
-      <span>OIDC issuer</span>
-      <input
-        class="input w-full opacity-60"
-        value={configuredIssuer}
-        readonly
-        disabled
-        title="Statically configured at deploy time (Helm: FELDERA_AUTH_ISSUER). Recorded on a new tenant as the issuer it was provisioned under; it cannot be changed here."
-      />
-    </label>
-    <button class="btn preset-filled-surface-50-950" disabled={creating}>Create</button>
+    <button
+      class="btn preset-filled-surface-50-950"
+      disabled={creating}
+      title="Records {configuredIssuer} as the issuer the tenant was provisioned under. A login reaches the tenant by name, whatever the issuer."
+    >
+      Create
+    </button>
   </form>
 </div>
diff --git a/js-packages/web-console/src/lib/services/manager/index.ts b/js-packages/web-console/src/lib/services/manager/index.ts
index f5fa4356457..902f5586788 100644
--- a/js-packages/web-console/src/lib/services/manager/index.ts
+++ b/js-packages/web-console/src/lib/services/manager/index.ts
@@ -11,6 +11,7 @@ export {
   deleteApiKey,
   deleteOidcTrust,
   deletePipeline,
+  deleteTenant,
   deleteTenantUser,
   getApiKey,
   getCheckpointStatus,
@@ -51,6 +52,7 @@ export {
   listTenantUsers,
   type Options,
   patchPipeline,
+  patchTenant,
   pipelineAdhocSql,
   postApiKey,
   postOidcTrust,
@@ -181,6 +183,10 @@ export type {
   DeletePipelineError,
   DeletePipelineErrors,
   DeletePipelineResponses,
+  DeleteTenantData,
+  DeleteTenantError,
+  DeleteTenantErrors,
+  DeleteTenantResponses,
   DeleteTenantUserData,
   DeleteTenantUserError,
   DeleteTenantUserErrors,
@@ -367,6 +373,7 @@ export type {
   IcebergCatalogType,
   IcebergIngestMode,
   IcebergReaderConfig,
+  IcebergTransactionMode,
   InputEndpointConfig,
   InputEndpointMetrics,
   InputEndpointStatus,
@@ -454,6 +461,11 @@ export type {
   PatchPipelineErrors,
   PatchPipelineResponse,
   PatchPipelineResponses,
+  PatchTenantData,
+  PatchTenantError,
+  PatchTenantErrors,
+  PatchTenantResponse,
+  PatchTenantResponses,
   PermanentSuspendError,
   PipelineAdhocSqlData,
   PipelineAdhocSqlError,
@@ -581,6 +593,8 @@ export type {
   Rel,
   Relation,
   RemoteCheckpoint,
+  RenameTenantRequest,
+  RenameTenantResponse,
   ReplayPolicy,
   ResourceConfig,
   ResourcesDesiredStatus,
diff --git a/js-packages/web-console/src/lib/services/manager/sdk.gen.ts b/js-packages/web-console/src/lib/services/manager/sdk.gen.ts
index 2dffac80c40..b2ae2b34c01 100644
--- a/js-packages/web-console/src/lib/services/manager/sdk.gen.ts
+++ b/js-packages/web-console/src/lib/services/manager/sdk.gen.ts
@@ -33,6 +33,9 @@ import type {
   DeletePipelineData,
   DeletePipelineErrors,
   DeletePipelineResponses,
+  DeleteTenantData,
+  DeleteTenantErrors,
+  DeleteTenantResponses,
   DeleteTenantUserData,
   DeleteTenantUserErrors,
   DeleteTenantUserResponses,
@@ -149,6 +152,9 @@ import type {
   PatchPipelineData,
   PatchPipelineErrors,
   PatchPipelineResponses,
+  PatchTenantData,
+  PatchTenantErrors,
+  PatchTenantResponses,
   PipelineAdhocSqlData,
   PipelineAdhocSqlErrors,
   PipelineAdhocSqlResponses,
@@ -1967,7 +1973,7 @@ export const putTenantUser = <ThrowOnError extends boolean = true>(
   )
 
 /**
- * List tenants
+ * List Tenants
  *
  * Required role: `owner`.
  *
@@ -1989,10 +1995,9 @@ export const listTenants = <ThrowOnError extends boolean = true>(
  * Required role: `owner`.
  *
  * Explicitly create a tenant, rather than relying on first login.
- * The tenant is keyed to the platform's configured OIDC issuer (statically set
- * at deploy time, e.g. via Helm), so that logins from that issuer resolve into
- * it; the issuer is not caller-settable. Fails with a conflict if a tenant with
- * the same name already exists for that issuer.
+ * A login resolves its tenant by name, so a user whose identity provider
+ * asserts this name lands in the tenant created here. Fails with a conflict if
+ * the name is already taken.
  */
 export const createTenant = <ThrowOnError extends boolean = true>(
   options: Options<CreateTenantData, ThrowOnError>
@@ -2008,6 +2013,71 @@ export const createTenant = <ThrowOnError extends boolean = true>(
     }
   })
 
+/**
+ * Delete Tenant
+ *
+ * Required role: `owner`.
+ *
+ * Delete a tenant that holds nothing. Its members lose the membership, and a
+ * login that still resolves this tenant's name simply re-creates it, empty.
+ *
+ * The tenant must hold no pipelines, API keys or OIDC trust relationships;
+ * otherwise the request fails with a conflict. Everything tenant-scoped
+ * cascades on this delete, so the emptiness rule is what keeps a mistyped
+ * identifier from taking a live tenant's pipelines with it. Delete those
+ * resources first if you mean to.
+ */
+export const deleteTenant = <ThrowOnError extends boolean = true>(
+  options: Options<DeleteTenantData, ThrowOnError>
+) =>
+  (options.client ?? client).delete<
+    DeleteTenantResponses,
+    DeleteTenantErrors,
+    ThrowOnError,
+    'data'
+  >({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v0/tenants/{tenant_id}',
+    ...options
+  })
+
+/**
+ * Rename Tenant
+ *
+ * Required role: `owner`.
+ *
+ * Change a tenant's name. Only the name changes: pipelines, API keys, members
+ * and OIDC trust relationships all reference the tenant by its identifier and
+ * are unaffected.
+ *
+ * A login resolves its tenant by name, so renaming decides which tenant those
+ * users reach. Two consequences follow. Renaming a tenant away from a name the
+ * identity provider still asserts sends its users to a new, empty tenant on
+ * their next request, which re-creates the name. And a tenant that no login
+ * reaches, such as `default` after authentication is switched on, is recovered
+ * by giving it the name logins do resolve.
+ *
+ * Recovery normally wants a name that is already taken, by the tenant the
+ * first login created. Set `displace_existing` to take it: that tenant is
+ * renamed to `<name> (<id>)` in the same transaction and keeps everything it
+ * had. One step is what makes recovery possible at all, since freeing the name
+ * and claiming it as two calls loses to the next request re-creating it.
+ */
+export const patchTenant = <ThrowOnError extends boolean = true>(
+  options: Options<PatchTenantData, ThrowOnError>
+) =>
+  (options.client ?? client).patch<PatchTenantResponses, PatchTenantErrors, ThrowOnError, 'data'>({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v0/tenants/{tenant_id}',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers
+    }
+  })
+
 /**
  * Validate Program
  *
diff --git a/js-packages/web-console/src/lib/services/manager/types.gen.ts b/js-packages/web-console/src/lib/services/manager/types.gen.ts
index 177e23f2f26..66cd94e515f 100644
--- a/js-packages/web-console/src/lib/services/manager/types.gen.ts
+++ b/js-packages/web-console/src/lib/services/manager/types.gen.ts
@@ -71,8 +71,8 @@ export type AdhocQueryArgs = {
 /**
  * API key descriptor.
  *
- * A key carries a single [`Role`], capped at `write`: `admin` and `owner` are
- * never issuable as static keys (see [`crate::db::types::role::MintableKeyRole`]).
+ * A key carries a single role, `read` or `write`. `admin` and `owner` are
+ * never issuable as API keys.
  */
 export type ApiKeyDescr = {
   id: ApiKeyId
@@ -2485,6 +2485,17 @@ export type IcebergReaderConfig = GlueCatalogConfig &
      * is used.
      */
     datetime?: string | null
+    /**
+     * Maximum number of retries for reading the table snapshot.
+     *
+     * When reading the snapshot fails partway through, for example because an
+     * object-store read times out or is throttled, the connector retries the
+     * entire read with exponential backoff. This is in addition to the
+     * lower-level retries performed by the object-store client.
+     *
+     * Defaults to unlimited retries. Set to 0 to disable retries.
+     */
+    max_retries?: number | null
     /**
      * Location of the table metadata JSON file.
      *
@@ -2493,6 +2504,12 @@ export type IcebergReaderConfig = GlueCatalogConfig &
      */
     metadata_location?: string | null
     mode: IcebergIngestMode
+    /**
+     * The number of parallel parsing tasks the connector uses to process data read from the
+     * table. Increasing this value can enhance performance by allowing more concurrent processing.
+     * Recommended range: 1-10. The default is 4.
+     */
+    num_parsers?: number
     /**
      * Optional row filter.
      *
@@ -2552,15 +2569,19 @@ export type IcebergReaderConfig = GlueCatalogConfig &
      * queries using partitioning, Z-ordering, or liquid clustering.
      */
     timestamp_column?: string | null
+    transaction_mode?: IcebergTransactionMode
     [key: string]:
       | string
       | IcebergCatalogType
       | null
       | string
       | null
+      | number
+      | null
       | string
       | null
       | IcebergIngestMode
+      | number
       | string
       | null
       | number
@@ -2569,9 +2590,28 @@ export type IcebergReaderConfig = GlueCatalogConfig &
       | null
       | string
       | null
+      | IcebergTransactionMode
       | undefined
   }
 
+/**
+ * Iceberg table transaction mode.
+ *
+ * Determines how the connector breaks up its input into Feldera transactions.
+ *
+ * * `none` - the connector does not break up its input into transactions.
+ * * `snapshot` - ingest the initial snapshot of the table in one or several transactions.
+ *
+ * # How the table snapshot is ingested using transactions
+ *
+ * When `transaction_mode` is set to `snapshot`, the connector ingests the snapshot in one
+ * or several transactions, depending on `timestamp_column`. If `timestamp_column` is not set,
+ * the whole snapshot is ingested in a single Feldera transaction. If `timestamp_column` is set,
+ * the connector ingests the snapshot in a series of timestamp ranges of width equal to the
+ * `LATENESS` attribute of the column, each range in a separate transaction.
+ */
+export type IcebergTransactionMode = 'none' | 'snapshot'
+
 /**
  * Describes an input connector configuration
  */
@@ -4693,6 +4733,29 @@ export type RemoteCheckpoint = {
   uuid: string
 }
 
+/**
+ * Request to rename a tenant.
+ */
+export type RenameTenantRequest = {
+  /**
+   * Take the name from the tenant that currently holds it, instead of
+   * failing with a conflict. That tenant is renamed to `<name> (<id>)` and
+   * keeps everything it had; nothing is merged or deleted.
+   */
+  displace_existing?: boolean
+  /**
+   * The tenant's new name.
+   */
+  name: string
+}
+
+/**
+ * Response to a successful tenant rename.
+ */
+export type RenameTenantResponse = {
+  displaced?: TenantInfo | null
+}
+
 export type ReplayPolicy = 'Instant' | 'Original'
 
 export type ResourceConfig = {
@@ -8564,6 +8627,82 @@ export type CreateTenantResponses = {
 
 export type CreateTenantResponse = CreateTenantResponses[keyof CreateTenantResponses]
 
+export type DeleteTenantData = {
+  body?: never
+  path: {
+    /**
+     * Tenant identifier
+     */
+    tenant_id: string
+  }
+  query?: never
+  url: '/v0/tenants/{tenant_id}'
+}
+
+export type DeleteTenantErrors = {
+  /**
+   * Caller is not a platform owner
+   */
+  403: ErrorResponse
+  /**
+   * No tenant with that identifier
+   */
+  404: ErrorResponse
+  /**
+   * The tenant still holds pipelines, API keys or OIDC trust relationships
+   */
+  409: ErrorResponse
+  500: ErrorResponse
+}
+
+export type DeleteTenantError = DeleteTenantErrors[keyof DeleteTenantErrors]
+
+export type DeleteTenantResponses = {
+  /**
+   * Tenant deleted
+   */
+  200: unknown
+}
+
+export type PatchTenantData = {
+  body: RenameTenantRequest
+  path: {
+    /**
+     * Tenant identifier
+     */
+    tenant_id: string
+  }
+  query?: never
+  url: '/v0/tenants/{tenant_id}'
+}
+
+export type PatchTenantErrors = {
+  /**
+   * Caller is not a platform owner
+   */
+  403: ErrorResponse
+  /**
+   * No tenant with that identifier
+   */
+  404: ErrorResponse
+  /**
+   * A tenant with that name already exists, and `displace_existing` was not set
+   */
+  409: ErrorResponse
+  500: ErrorResponse
+}
+
+export type PatchTenantError = PatchTenantErrors[keyof PatchTenantErrors]
+
+export type PatchTenantResponses = {
+  /**
+   * Tenant renamed
+   */
+  200: RenameTenantResponse
+}
+
+export type PatchTenantResponse = PatchTenantResponses[keyof PatchTenantResponses]
+
 export type PostValidateProgramData = {
   /**
    * The SQL program to validate, an optional runtime version, and whether to return the IR
diff --git a/js-packages/web-console/src/lib/services/pipelineManager.ts b/js-packages/web-console/src/lib/services/pipelineManager.ts
index ae33fd6f55c..6aa84add7ef 100644
--- a/js-packages/web-console/src/lib/services/pipelineManager.ts
+++ b/js-packages/web-console/src/lib/services/pipelineManager.ts
@@ -4,6 +4,7 @@ import {
   type CombinedStatus as _CombinedStatus,
   checkpointPipeline as _checkpointPipeline,
   createTenant as _createTenant,
+  deleteTenant as _deleteTenant,
   deleteApiKey as _deleteApiKey,
   deleteOidcTrust as _deleteOidcTrust,
   deletePipeline as _deletePipeline,
@@ -26,6 +27,7 @@ import {
   listTenantUsers as _listTenantUsers,
   type ProgramStatus as _ProgramStatus,
   patchPipeline as _patchPipeline,
+  patchTenant as _patchTenant,
   postApiKey as _postApiKey,
   postOidcTrust as _postOidcTrust,
   postPipeline as _postPipeline,
@@ -710,6 +712,31 @@ export const getTenants = (options?: FetchOptions) =>
 export const createTenant = (name: string, options?: FetchOptions) =>
   mapResponse(_createTenant({ body: { name }, ...options }), (v) => v)
 
+// Renaming changes only the name. A login resolves its tenant by name, so the
+// new name is what the identity provider must assert for those users to land here.
+// `displaceExisting` takes the name from the tenant that holds it, which is how a
+// tenant no login reaches is recovered: the name it needs is the one the first
+// login already created a tenant under.
+export const renameTenant = (
+  tenantId: string,
+  name: string,
+  displaceExisting = false,
+  options?: FetchOptions
+) =>
+  mapResponse(
+    _patchTenant({
+      path: { tenant_id: tenantId },
+      body: { name, displace_existing: displaceExisting },
+      ...options
+    }),
+    (v) => v
+  )
+
+// Refused unless the tenant holds no pipelines, API keys or OIDC trusts, since
+// everything tenant-scoped cascades on the delete.
+export const deleteTenant = (tenantId: string, options?: FetchOptions) =>
+  mapResponse(_deleteTenant({ path: { tenant_id: tenantId }, ...options }), (v) => v)
+
 export const dismissDeploymentError = (pipeline_name: string) =>
   mapResponse(postPipelineDismissError({ path: { pipeline_name } }), (v) => v)
 
diff --git a/openapi.json b/openapi.json
index 578f1672698..09b55f06870 100644
--- a/openapi.json
+++ b/openapi.json
@@ -7623,7 +7623,7 @@
         "tags": [
           "Platform"
         ],
-        "summary": "List tenants",
+        "summary": "List Tenants",
         "description": "Required role: `owner`.\n\nList all tenants in the installation.",
         "operationId": "list_tenants",
         "responses": {
@@ -7672,7 +7672,7 @@
           "Platform"
         ],
         "summary": "Create Tenant",
-        "description": "Required role: `owner`.\n\nExplicitly create a tenant, rather than relying on first login.\nThe tenant is keyed to the platform's configured OIDC issuer (statically set\nat deploy time, e.g. via Helm), so that logins from that issuer resolve into\nit; the issuer is not caller-settable. Fails with a conflict if a tenant with\nthe same name already exists for that issuer.",
+        "description": "Required role: `owner`.\n\nExplicitly create a tenant, rather than relying on first login.\nA login resolves its tenant by name, so a user whose identity provider\nasserts this name lands in the tenant created here. Fails with a conflict if\nthe name is already taken.",
         "operationId": "create_tenant",
         "requestBody": {
           "content": {
@@ -7733,6 +7733,165 @@
         ]
       }
     },
+    "/v0/tenants/{tenant_id}": {
+      "delete": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Delete Tenant",
+        "description": "Required role: `owner`.\n\nDelete a tenant that holds nothing. Its members lose the membership, and a\nlogin that still resolves this tenant's name simply re-creates it, empty.\n\nThe tenant must hold no pipelines, API keys or OIDC trust relationships;\notherwise the request fails with a conflict. Everything tenant-scoped\ncascades on this delete, so the emptiness rule is what keeps a mistyped\nidentifier from taking a live tenant's pipelines with it. Delete those\nresources first if you mean to.",
+        "operationId": "delete_tenant",
+        "parameters": [
+          {
+            "name": "tenant_id",
+            "in": "path",
+            "description": "Tenant identifier",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Tenant deleted"
+          },
+          "403": {
+            "description": "Caller is not a platform owner",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "No tenant with that identifier",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
+          "409": {
+            "description": "The tenant still holds pipelines, API keys or OIDC trust relationships",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "JSON web token (JWT) or API key": []
+          }
+        ]
+      },
+      "patch": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Rename Tenant",
+        "description": "Required role: `owner`.\n\nChange a tenant's name. Only the name changes: pipelines, API keys, members\nand OIDC trust relationships all reference the tenant by its identifier and\nare unaffected.\n\nA login resolves its tenant by name, so renaming decides which tenant those\nusers reach. Two consequences follow. Renaming a tenant away from a name the\nidentity provider still asserts sends its users to a new, empty tenant on\ntheir next request, which re-creates the name. And a tenant that no login\nreaches, such as `default` after authentication is switched on, is recovered\nby giving it the name logins do resolve.\n\nRecovery normally wants a name that is already taken, by the tenant the\nfirst login created. Set `displace_existing` to take it: that tenant is\nrenamed to `<name> (<id>)` in the same transaction and keeps everything it\nhad. One step is what makes recovery possible at all, since freeing the name\nand claiming it as two calls loses to the next request re-creating it.",
+        "operationId": "patch_tenant",
+        "parameters": [
+          {
+            "name": "tenant_id",
+            "in": "path",
+            "description": "Tenant identifier",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RenameTenantRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "description": "Tenant renamed",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RenameTenantResponse"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Caller is not a platform owner",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "No tenant with that identifier",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
+          "409": {
+            "description": "A tenant with that name already exists, and `displace_existing` was not set",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "JSON web token (JWT) or API key": []
+          }
+        ]
+      }
+    },
     "/v0/validate_program": {
       "post": {
         "tags": [
@@ -13843,6 +14002,38 @@
           }
         }
       },
+      "RenameTenantRequest": {
+        "type": "object",
+        "description": "Request to rename a tenant.",
+        "required": [
+          "name"
+        ],
+        "properties": {
+          "displace_existing": {
+            "type": "boolean",
+            "description": "Take the name from the tenant that currently holds it, instead of\nfailing with a conflict. That tenant is renamed to `<name> (<id>)` and\nkeeps everything it had; nothing is merged or deleted."
+          },
+          "name": {
+            "type": "string",
+            "description": "The tenant's new name.",
+            "example": "acme"
+          }
+        }
+      },
+      "RenameTenantResponse": {
+        "type": "object",
+        "description": "Response to a successful tenant rename.",
+        "properties": {
+          "displaced": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/TenantInfo"
+              }
+            ],
+            "nullable": true
+          }
+        }
+      },
       "ReplayPolicy": {
         "type": "string",
         "enum": [
diff --git a/python/feldera/rest/feldera_client.py b/python/feldera/rest/feldera_client.py
index fa228dd1cd5..3ffb999ddc9 100644
--- a/python/feldera/rest/feldera_client.py
+++ b/python/feldera/rest/feldera_client.py
@@ -1650,6 +1650,57 @@ def create_api_key(self, name: str, role: str = "write") -> dict:
             body={"name": name, "role": role},
         )
 
+    def list_tenants(self) -> List[dict]:
+        """
+        List every tenant in the installation. Platform owners only.
+
+        :returns: A list of dicts each describing a tenant (`id`, `name`,
+                  `initial_provider`).
+        """
+        return self.http.get(path="/tenants")
+
+    def rename_tenant(
+        self, tenant_id: str, name: str, displace_existing: bool = False
+    ) -> dict:
+        """
+        Rename a tenant. Platform owners only.
+
+        A login resolves its tenant by name, so the new name decides which users
+        arrive in this tenant. Renaming a tenant to a name its provider no longer
+        asserts sends those users to a new, empty tenant on their next request.
+
+        :param tenant_id: Identifier of the tenant to rename.
+        :param name: The new name.
+        :param displace_existing: Take the name from the tenant that currently
+                                  holds it, which is renamed to `<name> (<id>)`
+                                  and keeps everything it had. Needed to recover
+                                  a tenant no login reaches, because every
+                                  request re-creates the name its token
+                                  resolves.
+        :returns: A dict whose `displaced` key describes the tenant that gave up
+                  the name, or is `None` when the name was free.
+        :raises FelderaAPIError: If the name is taken and `displace_existing` is
+                                 not set.
+        """
+        if not name:
+            raise ValueError("Tenant name must be a non-empty string")
+        return self.http.patch(
+            path=f"/tenants/{quote(tenant_id, safe='')}",
+            body={"name": name, "displace_existing": displace_existing},
+        )
+
+    def delete_tenant(self, tenant_id: str) -> None:
+        """
+        Delete a tenant. Platform owners only.
+
+        The tenant must hold no pipelines, API keys or OIDC trust
+        relationships; delete those first.
+
+        :param tenant_id: Identifier of the tenant to delete.
+        :raises FelderaAPIError: If the tenant still holds any of the above.
+        """
+        self.http.delete(path=f"/tenants/{quote(tenant_id, safe='')}")
+
     def list_oidc_trust(self) -> List[dict]:
         """
         List the OIDC trust relationships configured for the current tenant.

From bfd84ac8b3878bcc1dc54fc2a25be9fe6b939f0b Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Mon, 27 Jul 2026 00:36:18 -0700
Subject: [PATCH 28/55] [pipeline-manager] Resolve a route's access rule
 without actix's pattern

RBAC denied `GET /v0/pipelines/{p}/tables/{t}/connectors/{c}/completion_token`
and the sibling `/stats` as unclassified, though both are in the table.

The middleware keyed its lookup on `req.match_pattern()`, which resolves a path
against the route map ignoring the method. Those two paths also match
`POST .../connectors/{connector_name}/{action}`, registered earlier, so the
lookup asked for `("GET", ".../{action}")`, found nothing, and denied by
default. Any route that shares a path shape with an earlier placeholder route of
another method was reachable only by that other method.

Match the table directly instead, method first, preferring literal segments over
placeholders as a router does. `match_pattern()` now answers only whether a
route exists at all, so an unregistered path still reaches actix's 404 rather
than turning into a permission error. The table is bucketed by method and
segment count, leaving the hot path a handful of candidates.

Three tests cover the class: every entry must resolve from a concrete path under
its own method, literal and placeholder siblings must keep their own rules, and
the middleware test now registers the shadowing pair in the order the real app
does.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 crates/pipeline-manager/src/api/rbac.rs | 235 ++++++++++++++++++++----
 1 file changed, 202 insertions(+), 33 deletions(-)

diff --git a/crates/pipeline-manager/src/api/rbac.rs b/crates/pipeline-manager/src/api/rbac.rs
index bdffff45c2f..b4a97fe49ec 100644
--- a/crates/pipeline-manager/src/api/rbac.rs
+++ b/crates/pipeline-manager/src/api/rbac.rs
@@ -136,6 +136,77 @@ pub(crate) fn min_role_for(method: &str, pattern: &str) -> Option<Option<Role>>
     route_table().get(&(method, pattern)).copied()
 }
 
+/// Resolve a request path to its table entry, returning the pattern it matched
+/// and that pattern's rule.
+///
+/// The middleware cannot use actix's `match_pattern()` for this. That resolves
+/// by path alone, ignoring the method, so a request whose path also matches an
+/// earlier-registered pattern of a different method reports the wrong template:
+/// `GET .../connectors/{connector_name}/completion_token` came back as
+/// `POST .../connectors/{connector_name}/{action}`, which is not a GET entry, and
+/// a classified route was denied as unclassified. Matching the table directly,
+/// method first, keeps the enforced rule and the authored rule the same thing.
+///
+/// A literal segment beats a placeholder, as in any router, so `.../start`
+/// resolves to `.../{action}` only when no literal pattern claims it.
+fn classify(method: &str, path: &str) -> Option<(&'static str, Option<Role>)> {
+    let segments: Vec<&str> = path.split('/').collect();
+    let candidates = candidates_by_shape().get(&(method, segments.len()))?;
+    let mut best: Option<(usize, &'static str, Option<Role>)> = None;
+    for (pattern, role) in candidates {
+        let Some(literals) = literal_segments_if_match(pattern, &segments) else {
+            continue;
+        };
+        if best.is_none_or(|(best_literals, _, _)| literals > best_literals) {
+            best = Some((literals, pattern, *role));
+        }
+    }
+    best.map(|(_, pattern, role)| (pattern, role))
+}
+
+/// [`ROUTE_MIN_ROLE`] bucketed by `(method, segment count)`, built once on first
+/// use. A path can only match a pattern of the same shape, so this leaves the
+/// per-request scan a handful of candidates rather than the whole table.
+#[allow(clippy::type_complexity)]
+fn candidates_by_shape(
+) -> &'static HashMap<(&'static str, usize), Vec<(&'static str, Option<Role>)>> {
+    static SHAPES: OnceLock<HashMap<(&'static str, usize), Vec<(&'static str, Option<Role>)>>> =
+        OnceLock::new();
+    SHAPES.get_or_init(|| {
+        let mut shapes: HashMap<(&'static str, usize), Vec<(&'static str, Option<Role>)>> =
+            HashMap::new();
+        for (method, pattern, role) in ROUTE_MIN_ROLE {
+            shapes
+                .entry((method, pattern.split('/').count()))
+                .or_default()
+                .push((pattern, *role));
+        }
+        shapes
+    })
+}
+
+/// How many literal segments `pattern` matches `segments` with, or `None` when
+/// it does not match. A `{name}` segment matches any one non-empty segment.
+fn literal_segments_if_match(pattern: &str, segments: &[&str]) -> Option<usize> {
+    let parts: Vec<&str> = pattern.split('/').collect();
+    if parts.len() != segments.len() {
+        return None;
+    }
+    let mut literals = 0;
+    for (part, segment) in parts.iter().zip(segments) {
+        if part.starts_with('{') && part.ends_with('}') {
+            if segment.is_empty() {
+                return None;
+            }
+        } else if part != segment {
+            return None;
+        } else {
+            literals += 1;
+        }
+    }
+    Some(literals)
+}
+
 /// A 403 in the same JSON shape the rest of the API returns, so clients can
 /// parse a permission denial the same way whether it came from here or a handler.
 fn forbidden(message: &str) -> HttpResponse<BoxBody> {
@@ -145,42 +216,46 @@ fn forbidden(message: &str) -> HttpResponse<BoxBody> {
     }))
 }
 
-/// Decide whether the principal may proceed. `Ok(())` allows; `Err(resp)` is the
-/// 403 to return. `pattern` is the matched route template, not the request path.
+/// Decide whether the principal may proceed, returning the pattern the request
+/// resolved to for the audit line. `Ok` allows; `Err(resp)` is the 403 to return.
+///
+/// `routed` says whether actix has a route for this path at all; the rule itself
+/// comes from [`classify`], which matches the request path against the table.
 ///
 /// ```text
 /// // a writer posting a pipeline
-/// authorize("POST", Some("/v0/pipelines"), Some(&writer))  => Ok(())
+/// authorize("POST", true,  "/v0/pipelines", Some(&writer))  => Ok(..)
 /// // a reader posting a pipeline
-/// authorize("POST", Some("/v0/pipelines"), Some(&reader))  => Err(403)
+/// authorize("POST", true,  "/v0/pipelines", Some(&reader))  => Err(403)
 /// // an admin listing tenants, which is owner-only
-/// authorize("GET",  Some("/v0/tenants"),   Some(&admin))   => Err(403)
+/// authorize("GET",  true,  "/v0/tenants",   Some(&admin))   => Err(403)
 /// // no route matched, so this is a 404 for actix to answer, not a denial
-/// authorize("GET",  None,                  Some(&reader))  => Ok(())
+/// authorize("GET",  false, "/v0/nonesuch",  Some(&reader))  => Ok(..)
 /// ```
 fn authorize(
     method: &str,
-    pattern: Option<&str>,
+    routed: bool,
+    path: &str,
     principal: Option<&AuthenticatedPrincipal>,
-) -> Result<(), HttpResponse<BoxBody>> {
+) -> Result<Option<&'static str>, HttpResponse<BoxBody>> {
     // No route matched, so there is nothing to guard. Passing it through lets
     // actix answer 404; denying here would report a missing route as a
     // permission error.
-    let Some(pattern) = pattern else {
-        return Ok(());
+    if !routed {
+        return Ok(None);
+    }
+    let Some((pattern, rule)) = classify(method, path) else {
+        // A registered route with no table entry is a bug: deny it rather
+        // than serve it unguarded.
+        error!("RBAC: route {method} {path} has no access-control entry; denying");
+        return Err(forbidden(
+            "This endpoint has no access-control classification and is denied",
+        ));
     };
-    match min_role_for(method, pattern) {
-        None => {
-            // A registered route with no table entry is a bug: deny it rather
-            // than serve it unguarded.
-            error!("RBAC: route {method} {pattern} has no access-control entry; denying");
-            Err(forbidden(
-                "This endpoint has no access-control classification and is denied",
-            ))
-        }
-        Some(None) => Ok(()),
-        Some(Some(required)) => match principal {
-            Some(p) if p.role.satisfies(required) => Ok(()),
+    match rule {
+        None => Ok(Some(pattern)),
+        Some(required) => match principal {
+            Some(p) if p.role.satisfies(required) => Ok(Some(pattern)),
             Some(p) => Err(DBError::InsufficientPermissions {
                 required,
                 actual: p.role,
@@ -212,11 +287,12 @@ pub(crate) async fn rbac_middleware(
 ) -> Result<ServiceResponse<BoxBody>, actix_web::Error> {
     let principal = req.extensions().get::<AuthenticatedPrincipal>().cloned();
     let method = req.method().clone();
-    let pattern = req.match_pattern();
+    let routed = req.match_pattern().is_some();
+    let path = req.path().to_string();
 
-    match authorize(method.as_str(), pattern.as_deref(), principal.as_ref()) {
-        Ok(()) => {
-            if let Some(pattern) = pattern.as_deref() {
+    match authorize(method.as_str(), routed, &path, principal.as_ref()) {
+        Ok(pattern) => {
+            if let Some(pattern) = pattern {
                 audit(&method, pattern, principal.as_ref());
             }
             Ok(next.call(req).await?.map_into_boxed_body())
@@ -240,7 +316,7 @@ mod test {
     #[test]
     fn unknown_route_is_denied() {
         let p = AuthenticatedPrincipal::for_test(Role::Owner);
-        assert!(authorize("GET", Some("/v0/does/not/exist"), Some(&p)).is_err());
+        assert!(authorize("GET", true, "/v0/does/not/exist", Some(&p)).is_err());
     }
 
     #[test]
@@ -248,13 +324,78 @@ mod test {
         let reader = AuthenticatedPrincipal::for_test(Role::Read);
         let writer = AuthenticatedPrincipal::for_test(Role::Write);
         // A write route rejects a reader and admits a writer.
-        assert!(authorize("POST", Some("/v0/pipelines"), Some(&reader)).is_err());
-        assert!(authorize("POST", Some("/v0/pipelines"), Some(&writer)).is_ok());
+        assert!(authorize("POST", true, "/v0/pipelines", Some(&reader)).is_err());
+        assert!(authorize("POST", true, "/v0/pipelines", Some(&writer)).is_ok());
         // A read route admits a reader.
-        assert!(authorize("GET", Some("/v0/pipelines"), Some(&reader)).is_ok());
+        assert!(authorize("GET", true, "/v0/pipelines", Some(&reader)).is_ok());
         // An owner-only route rejects an admin.
         let admin = AuthenticatedPrincipal::for_test(Role::Admin);
-        assert!(authorize("GET", Some("/v0/tenants"), Some(&admin)).is_err());
+        assert!(authorize("GET", true, "/v0/tenants", Some(&admin)).is_err());
+    }
+
+    /// A concrete request path for a route template, with each `{name}`
+    /// placeholder filled by a value that cannot be mistaken for a literal
+    /// segment of some other pattern.
+    fn concrete_path(pattern: &str) -> String {
+        pattern
+            .split('/')
+            .map(|part| {
+                if part.starts_with('{') && part.ends_with('}') {
+                    format!("sample-{}", part.trim_matches(|c| c == '{' || c == '}'))
+                } else {
+                    part.to_string()
+                }
+            })
+            .collect::<Vec<_>>()
+            .join("/")
+    }
+
+    /// Every entry must be reachable from a real request path, under its own
+    /// method. A pattern that another entry shadows would be enforced with the
+    /// wrong rule, or denied as unclassified, which is how
+    /// `GET .../connectors/{connector_name}/completion_token` came to be refused:
+    /// it shares a path shape with `POST .../connectors/{connector_name}/{action}`.
+    #[test]
+    fn every_table_entry_resolves_from_a_concrete_path() {
+        for (method, pattern, role) in ROUTE_MIN_ROLE {
+            let path = concrete_path(pattern);
+            let resolved = classify(method, &path);
+            assert_eq!(
+                resolved,
+                Some((*pattern, *role)),
+                "{method} {path} resolved to {resolved:?}, expected {pattern}"
+            );
+        }
+    }
+
+    /// A literal segment wins over a placeholder, and a placeholder still
+    /// catches everything else, so both siblings keep their own rule.
+    #[test]
+    fn a_literal_route_wins_over_a_placeholder_sibling() {
+        let base = "/v0/pipelines/p/tables/t/connectors/c";
+        assert_eq!(
+            classify("GET", &format!("{base}/completion_token")),
+            Some((
+                "/v0/pipelines/{pipeline_name}/tables/{table_name}/connectors/{connector_name}/completion_token",
+                Some(Role::Write)
+            ))
+        );
+        assert_eq!(
+            classify("GET", &format!("{base}/stats")),
+            Some((
+                "/v0/pipelines/{pipeline_name}/tables/{table_name}/connectors/{connector_name}/stats",
+                Some(Role::Read)
+            ))
+        );
+        assert_eq!(
+            classify("POST", &format!("{base}/start")),
+            Some((
+                "/v0/pipelines/{pipeline_name}/tables/{table_name}/connectors/{connector_name}/{action}",
+                Some(Role::Write)
+            ))
+        );
+        // The method is part of the match: no GET entry has that shape.
+        assert_eq!(classify("GET", &format!("{base}/start")), None);
     }
 
     /// Systematic matrix: for every classified route and every role, a request
@@ -268,7 +409,8 @@ mod test {
         for (method, pattern, min) in ROUTE_MIN_ROLE {
             for role in all_roles {
                 let principal = AuthenticatedPrincipal::for_test(role);
-                let allowed = authorize(method, Some(pattern), Some(&principal)).is_ok();
+                let allowed =
+                    authorize(method, true, &concrete_path(pattern), Some(&principal)).is_ok();
                 let expected = match min {
                     None => true, // any authenticated principal
                     Some(required) => role >= *required,
@@ -281,7 +423,7 @@ mod test {
             // A request with no principal at all is always refused on a
             // classified route (fail closed).
             assert!(
-                authorize(method, Some(pattern), None).is_err(),
+                authorize(method, true, &concrete_path(pattern), None).is_err(),
                 "{method} {pattern}: missing principal must be denied"
             );
         }
@@ -403,6 +545,16 @@ mod test {
                     .route(
                         "/tenants",
                         web::get().to(|| async { HttpResponse::Ok().finish() }),
+                    )
+                    // Registered in the same order as the real app: the
+                    // placeholder route first, the literal one behind it.
+                    .route(
+                        "/pipelines/{pipeline_name}/tables/{table_name}/connectors/{connector_name}/{action}",
+                        web::post().to(|| async { HttpResponse::Ok().finish() }),
+                    )
+                    .route(
+                        "/pipelines/{pipeline_name}/tables/{table_name}/connectors/{connector_name}/completion_token",
+                        web::get().to(|| async { HttpResponse::Ok().finish() }),
                     ),
             ),
         )
@@ -426,6 +578,23 @@ mod test {
         // owner-only tenant list: admin refused, owner admitted.
         assert_eq!(call("GET", "/v0/tenants", "admin").await.status(), 403);
         assert_eq!(call("GET", "/v0/tenants", "owner").await.status(), 200);
+
+        // A route whose path is also claimed by an earlier placeholder route of
+        // another method keeps its own rule, rather than resolving to that
+        // route and being denied as unclassified.
+        let token = "/v0/pipelines/p/tables/t/connectors/c/completion_token";
+        assert_eq!(call("GET", token, "write").await.status(), 200);
+        assert_eq!(call("GET", token, "read").await.status(), 403);
+        assert_eq!(
+            call(
+                "POST",
+                "/v0/pipelines/p/tables/t/connectors/c/start",
+                "write"
+            )
+            .await
+            .status(),
+            200
+        );
     }
 
     /// The authenticated `/v0` surface, enumerated from the generated OpenAPI

From 71b807dea9f1fd46b60426181287c3261418a2b9 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Mon, 27 Jul 2026 09:04:24 -0700
Subject: [PATCH 29/55] [docs] Authentication: apply review wording

Lalith's review of #6729. The steps to take before switching authentication on
now open the section as a warning, rather than trailing it; the tenant takeover
is explained in two sentences instead of walking through what the id turns into;
and the surviving-a-provider-change advice states the recommendation outright.

Two departures from the suggested text. The opening no longer says the changes
"move users between tenants", which the review itself catches as contradicting
"users cannot survive a provider change": what moves is the tenant a login lands
in, not the identities. And the web console does not delete the tenant a rename
displaced, so the claim that it does is left out; the list has its own delete.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 .../enterprise/authentication/index.mdx       | 90 +++++++++----------
 1 file changed, 45 insertions(+), 45 deletions(-)

diff --git a/docs.feldera.com/docs/get-started/enterprise/authentication/index.mdx b/docs.feldera.com/docs/get-started/enterprise/authentication/index.mdx
index 3d5c9ab153f..4d5f9d7cc33 100644
--- a/docs.feldera.com/docs/get-started/enterprise/authentication/index.mdx
+++ b/docs.feldera.com/docs/get-started/enterprise/authentication/index.mdx
@@ -160,10 +160,10 @@ authorization:
 
 ## Changing your authentication setup
 
-Feldera supports a single identity provider at a time, so the two changes that
-move users between tenants are enabling authentication on a deployment that ran
-without it, and pointing an authenticated deployment at a different provider.
-Both need planning, because a tenant is where pipelines live.
+Feldera supports a single identity provider at a time. Two supported changes
+alter which tenant a login lands in: 1) enabling authentication on a deployment
+that ran without it, and 2) pointing an authenticated deployment at a different
+provider. Both need planning, because a tenant is where pipelines live.
 
 ### How a tenant is identified
 
@@ -171,24 +171,31 @@ A tenant is identified by its **name** alone. The name is derived from the token
 on each login, by whichever [tenant assignment strategy](#tenant-assignment-strategies)
 you configured.
 
-A user is identified by the pair `(issuer, subject)`. That pair is what
-memberships and roles hang off, and unlike the tenant name it **does** include
-the issuer, because OIDC only guarantees `sub` to be unique within one issuer.
+A user is identified by the pair `(issuer, subject)`, where the subject is the
+token's `sub` claim. That pair is what memberships and roles are based on. Note,
+OIDC only guarantees `sub` to be unique within one issuer, which is why the
+issuer is part of the pair.
 
-The consequence is that a tenant can survive a provider change, but the users in
-it cannot. They arrive as new identities and must be granted their roles again.
+In short, a tenant can survive a provider change, but the users in it cannot.
+Users arrive as new identities and must be granted their roles again.
 
 ### Enabling authentication on an existing deployment
 
-Without authentication, everything lives in one built-in tenant named `default`,
-whose id is the all-zero UUID `00000000-0000-0000-0000-000000000000`. Once
-authentication is on, each login resolves to a tenant named by your chosen
-strategy, which is no longer `default`, so pipelines and API keys created while
-authentication was disabled are no longer visible to ordinary logins. The data
-is intact, just in a tenant nobody resolves to any more.
+:::warning Plan this before you enable authentication
+Without authentication, all pipelines live in a built-in tenant named `default`,
+whose `id` is the all-zero UUID `00000000-0000-0000-0000-000000000000`.
+
+When authentication is enabled for the first time in such a deployment, logins
+resolve to a tenant named by your authentication provider and tenant strategy.
+This makes `default` tenant pipelines and API keys no longer visible to
+authenticated logins, even though the data is intact.
+
+To avoid this problem, plan the following steps **before** enabling
+authentication on a deployment that already holds pipelines.
+:::
 
 A platform [owner](/get-started/enterprise/authentication/roles) can still reach
-it by naming that tenant explicitly:
+the `default` tenant by naming it explicitly:
 
 ```bash
 curl -H "Authorization: Bearer $OWNER_TOKEN" \
@@ -196,7 +203,7 @@ curl -H "Authorization: Bearer $OWNER_TOKEN" \
      https://<your-host>/v0/pipelines
 ```
 
-You have two ways to go on from there:
+There are two options:
 
 - Recreate the resources in the tenant your logins now reach, then stop and
   delete the pipelines left behind in `default`. Deleting them matters: a
@@ -215,31 +222,23 @@ curl -X PATCH -H "Authorization: Bearer $OWNER_TOKEN" \
      https://<your-host>/v0/tenants/00000000-0000-0000-0000-000000000000
 ```
 
-`displace_existing` is what makes this work. The first login after the switch
-created a tenant under `acme.us-west1.idp.com` already, and every request
-re-creates that name, so a plain rename, with `displace_existing: false`,
-conflicts. With `displace_existing`, the freshly created `acme.us-west1.idp.com`
-is renamed to `acme.us-west1.idp.com (<its id>)`, reported in the response under
-`displaced`, and `default` takes the name. From the next request on,
-`acme.us-west1.idp.com` resolves to the original `default` tenant, with your
-pipelines. The displaced tenant is empty, having been created after the switch,
-so delete it:
+The first login after the switch already created a tenant named
+`acme.us-west1.idp.com`, so the rename needs `displace_existing`. It hands the
+name over: `default` takes it, and the tenant that held it is renamed out of the
+way and reported in the response under `displaced`. Logins now resolve to your
+original pipelines.
+
+The displaced tenant is empty, so delete it:
 
 ```bash
 curl -X DELETE -H "Authorization: Bearer $OWNER_TOKEN" \
      https://<your-host>/v0/tenants/<displaced id>
 ```
 
-The web console does the same: rename `default`, and when the name collides it
-offers to take it, then delete the tenant it displaced.
-
-Plan this before enabling authentication on a deployment that already holds
-pipelines.
-
 ### Changing the identity provider
 
-Whether a tenant survives depends on whether its **name** still comes out the
-same from the new provider's tokens:
+When changing identity providers, each tenant's **name** (per the
+provider-supplied tokens) decides whether it survives the migration:
 
 | Strategy | Tenant name comes from | Survives a provider change? |
 |---|---|---|
@@ -247,9 +246,9 @@ same from the new provider's tokens:
 | Organization-wide | the issuer hostname | Only if the hostname is unchanged, e.g. a new authorization server on the same domain |
 | Individual tenancy | the `sub` claim | No, in practice: a new provider issues different subjects |
 
-So the mode that migrates cleanly is managed tenancy, because the tenant name is
-a value you control at the provider rather than something derived from it. If you
-expect to change providers regularly, prefer it.
+Managed tenancy migrates cleanly, because the tenant name is a value you control
+at the provider rather than something derived from it. **Use this strategy if you
+expect to change providers regularly**.
 
 Where the name does change, the old tenant keeps every pipeline and is no longer
 reachable by ordinary logins. Recover it the same way as above: an owner selects
@@ -257,16 +256,17 @@ it with `Feldera-Tenant` (by name or UUID, and `GET /v0/tenants` lists both) and
 moves what is needed, or gives it the name the new provider produces, with
 `displace_existing`, so the logins land back on it.
 
-Whichever way you go, do not leave pipelines behind in a tenant nobody reaches.
-They keep their Kubernetes pods and volumes running, and nobody is watching
-them. Stop and delete the pipelines, then delete the empty tenant with
+In general, do not leave pipelines in an unreachable tenant. The corresponding
+pipelines use system resources (like Kubernetes pods) while running and can go
+unnoticed. Stop and delete those pipelines, then delete the empty tenant with
 `DELETE /v0/tenants/{tenant_id}`.
 
-The destructive rename is the opposite one: taking a name away from the tenant
-whose users still arrive under it. Rename `acme.us-west1.idp.com` to `tmp` while
-the provider keeps asserting `acme.us-west1.idp.com`, and the next request from
-those users re-creates that name as an empty tenant, which is where they then
-work. Rename a tenant only to a name you want its users to arrive under.
+The destructive rename works the opposite way: taking a name away from the
+tenant whose users still arrive under it. Say you rename `acme.us-west1.idp.com`
+to an unreachable `tmp` while the provider keeps asserting
+`acme.us-west1.idp.com`. The next request from those users re-creates that name
+as an empty tenant, which is where they then work. Rename a tenant only to a
+name you want its users to arrive under.
 
 :::warning Roles are not carried across a provider change
 Even when the tenant survives, its members do not. A membership is keyed to

From 7e8e8d45123a330e73b7f550a846b228452d6cc5 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Mon, 27 Jul 2026 18:50:52 -0700
Subject: [PATCH 30/55] [fda] Apply review feedback on the tenant and
 auth-token commands

Mihai's review of #6729.

`run_auth_token_command` ran `sh -c`, which Windows has no answer for, though
the release builds ship `fda.exe`. Pick the platform's shell instead, and mark
the three tests that drive POSIX syntax as Unix-only.

The rest is prose. The `--auth-token-command` examples are backquoted, and each
now reads as one line: clap joins a paragraph's lines, so a shell comment above
a command came out run together with it. The tenant help drops "asserts" and the
rename caveat, and says what `--displace-existing` is for, which is making the
rename atomic. A comment records what a `displaced` tenant in the response is.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 crates/fda/src/cli.rs  | 21 ++++++++++-----------
 crates/fda/src/main.rs | 24 +++++++++++++++++-------
 2 files changed, 27 insertions(+), 18 deletions(-)

diff --git a/crates/fda/src/cli.rs b/crates/fda/src/cli.rs
index 83a12a90cb6..d763f505680 100644
--- a/crates/fda/src/cli.rs
+++ b/crates/fda/src/cli.rs
@@ -132,14 +132,14 @@ pub struct Cli {
     ///
     /// Examples:
     ///
-    ///   # Kubernetes projected service-account token
-    ///   --auth-token-command 'cat /var/run/secrets/kubernetes.io/serviceaccount/token'
+    /// Kubernetes projected service-account token:
+    /// `--auth-token-command 'cat /var/run/secrets/kubernetes.io/serviceaccount/token'`
     ///
-    ///   # AWS EKS, IAM roles for service accounts
-    ///   --auth-token-command 'cat $AWS_WEB_IDENTITY_TOKEN_FILE'
+    /// AWS EKS, IAM roles for service accounts:
+    /// `--auth-token-command 'cat $AWS_WEB_IDENTITY_TOKEN_FILE'`
     ///
-    ///   # Google Cloud (an ID token is a JWT; an access token is not)
-    ///   --auth-token-command 'gcloud auth print-identity-token'
+    /// Google Cloud, where an ID token is a JWT and an access token is not:
+    /// `--auth-token-command 'gcloud auth print-identity-token'`
     #[arg(
         long,
         env = "FELDERA_AUTH_TOKEN_COMMAND",
@@ -350,17 +350,16 @@ pub enum TenantActions {
     /// Rename a tenant.
     ///
     /// A login resolves its tenant by name, so the new name decides which users
-    /// arrive in this tenant. Renaming a tenant to a name its provider no longer
-    /// asserts sends those users to a new, empty tenant on their next request.
+    /// arrive in this tenant.
     Rename {
         /// Identifier of the tenant to rename, as shown by `fda tenant list`.
         tenant_id: Uuid,
         /// The new name.
         name: String,
         /// Take the name from the tenant that currently holds it, which is
-        /// renamed to `<name> (<id>)` and keeps everything it had. Needed to
-        /// recover a tenant no login reaches, because every request re-creates
-        /// the name its token resolves.
+        /// renamed to `<name> (<id>)` and keeps everything it had. Makes the
+        /// rename atomic, so no request handled in between can re-create the
+        /// name as a new tenant.
         #[arg(long)]
         displace_existing: bool,
     },
diff --git a/crates/fda/src/main.rs b/crates/fda/src/main.rs
index 54830914022..4a73ddbe5e5 100644
--- a/crates/fda/src/main.rs
+++ b/crates/fda/src/main.rs
@@ -118,9 +118,8 @@ pub(crate) fn make_client(
         }
     }
 
-    // Resolve the token only for https, where it is actually sent. Running the
-    // auth-token-command for an http host would spawn a subprocess whose output
-    // is then discarded.
+    // Only execute the auth-token command if we are actually going to send the
+    // credentials, which is https alone.
     if host.starts_with("https://") {
         let resolved_auth = match auth_token_command {
             Some(cmd) => Some(run_auth_token_command(&cmd)?),
@@ -137,11 +136,17 @@ pub(crate) fn make_client(
     Ok(Client::new_with_client(host.as_str(), client))
 }
 
-/// Execute the user-supplied auth-token command via `sh -c` and return
-/// trimmed stdout. Errors if the command fails or prints nothing.
+/// Execute the user-supplied auth-token command through the platform's shell and
+/// return trimmed stdout. Errors if the command fails or prints nothing.
 fn run_auth_token_command(cmd: &str) -> Result<String, Box<dyn std::error::Error>> {
-    let output = std::process::Command::new("sh")
-        .arg("-c")
+    // Windows has no `sh`; `cmd /C` is what runs a command line there.
+    let (shell, shell_flag) = if cfg!(windows) {
+        ("cmd", "/C")
+    } else {
+        ("sh", "-c")
+    };
+    let output = std::process::Command::new(shell)
+        .arg(shell_flag)
         .arg(cmd)
         .output()
         .map_err(|e| format!("failed to spawn auth-token-command `{cmd}`: {e}"))?;
@@ -620,6 +625,8 @@ async fn tenant_commands(format: OutputFormat, action: TenantActions, client: Cl
                     1,
                 ))
                 .unwrap();
+            // `displaced` is set when --displace-existing took the name from
+            // another tenant; that tenant was renamed and keeps its contents.
             match &response.displaced {
                 Some(displaced) => println!(
                     "Renamed tenant {tenant_id} to '{name}'. The tenant that held the name is now '{}' ({}).",
@@ -3625,18 +3632,21 @@ aC3Oy4iVrYGOq9v6uP9iblE=\n\
         }
     }
 
+    #[cfg(unix)]
     #[test]
     fn auth_token_command_trims_stdout() {
         let token = run_auth_token_command("printf '  tok-123\\n'").expect("command succeeds");
         assert_eq!(token, "tok-123");
     }
 
+    #[cfg(unix)]
     #[test]
     fn auth_token_command_empty_output_is_error() {
         let err = run_auth_token_command("true").expect_err("empty output must error");
         assert!(err.to_string().contains("empty output"), "{err}");
     }
 
+    #[cfg(unix)]
     #[test]
     fn auth_token_command_nonzero_exit_is_error() {
         let err = run_auth_token_command("echo boom >&2; exit 3").expect_err("failure must error");

From 53eca853f304f120f95af6df2f8ea2dc419a322f Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Mon, 27 Jul 2026 21:14:59 -0700
Subject: [PATCH 31/55] [pipeline-manager] Apply review feedback on the RBAC
 surface

Mihai's review of #6729.

No route sits at the "any authenticated principal" tier, so `ROUTE_MIN_ROLE`
holds a `Role` rather than an `Option<Role>`: the lookup, the middleware and the
OpenAPI annotation all lose an arm they never took. A new test pins the one
invariant the methods really carry, that a route which can change something
never admits `read`, with the compile-only and profiling POSTs listed as what
they are.

Admin and owner requests are audited at info now. Those are the requests an
operator has to be able to account for afterwards: admin manages a tenant's
members and trusts, owner acts across tenants including ones it does not belong
to. Read and write traffic is one line per request and stays at debug.

The rest is prose. Implementation notes move from doc comments into the bodies
they describe, HTTP status codes leave the database layer, which has no such
thing, the migration header says what the migration does rather than what the
schema used to lack, and the comment on the trust table's CHECK sits on the
CHECK. `displaced` and the scope `Option` say what they mean, and the API
reference for renaming a tenant is down to what a caller needs.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 .../pipeline-manager/migrations/V35__rbac.sql |  61 ++-
 .../src/api/endpoints/oidc_trust.rs           |  13 +-
 .../src/api/endpoints/tenant.rs               |  31 +-
 crates/pipeline-manager/src/api/main.rs       |  19 +-
 crates/pipeline-manager/src/api/rbac.rs       | 390 +++++++++---------
 .../src/db/operations/oidc_trust.rs           |   8 +-
 .../src/db/operations/tenant.rs               |  30 +-
 .../src/db/operations/user.rs                 |   7 +-
 .../src/db/operations/utils.rs                |   5 +-
 crates/pipeline-manager/src/db/storage.rs     |  22 +-
 crates/pipeline-manager/src/db/test.rs        |  14 +-
 .../src/db/types/oidc_trust.rs                |  11 +-
 .../src/lib/services/manager/sdk.gen.ts       |  20 +-
 openapi.json                                  |   4 +-
 14 files changed, 316 insertions(+), 319 deletions(-)

diff --git a/crates/pipeline-manager/migrations/V35__rbac.sql b/crates/pipeline-manager/migrations/V35__rbac.sql
index 2c14462a7e1..ded47f91004 100644
--- a/crates/pipeline-manager/migrations/V35__rbac.sql
+++ b/crates/pipeline-manager/migrations/V35__rbac.sql
@@ -1,13 +1,12 @@
 -- Role-based access control, OIDC workload-identity trust, and tenant identity.
 --
--- Adds the user concept and the per-(user, tenant) role link that the platform
--- previously lacked (the only principal was the tenant). The released `api_key`
--- table carried a `scopes text[]`; it is replaced with a single `role`.
--- Roles: 'read' < 'write' < 'admin' (and 'owner', which is platform-wide and
--- never stored in a membership; it is sourced from configuration or an owner
--- OIDC trust relationship).
+-- Adds a user, and a role per (user, tenant). Replaces `api_key.scopes text[]`
+-- with a single `role`. Roles are ordered 'read' < 'write' < 'admin'; 'owner'
+-- is platform-wide, never stored in a membership, and comes from configuration
+-- or from an owner OIDC trust relationship.
 --
--- The second half makes a tenant's name, on its own, its identity.
+-- The `tenant identity` section at the end of this file makes a tenant's name,
+-- on its own, its identity.
 
 CREATE TABLE IF NOT EXISTS app_user (
     id       uuid PRIMARY KEY,
@@ -45,8 +44,7 @@ ALTER TABLE api_key DROP COLUMN scopes;
 -- Scope follows the role. read/write/admin trusts are tenant-scoped: `tenant_id`
 -- names the tenant they authorize into. An `owner` trust is platform-wide and
 -- belongs to no tenant, so `tenant_id` is NULL; the acting tenant then comes
--- from the Feldera-Tenant header at request time. The CHECK makes the two
--- inseparable: tenant_id is NULL if and only if the role is owner.
+-- from the Feldera-Tenant header at request time.
 CREATE TABLE IF NOT EXISTS oidc_trust_relationship (
     id uuid PRIMARY KEY,
     tenant_id uuid,
@@ -56,6 +54,8 @@ CREATE TABLE IF NOT EXISTS oidc_trust_relationship (
     subject varchar NOT NULL,
     audience varchar,
     role varchar NOT NULL DEFAULT 'read' CHECK (role IN ('read', 'write', 'admin', 'owner')),
+    -- Scope and role are inseparable: tenant_id is NULL if and only if the
+    -- role is owner.
     CONSTRAINT oidc_trust_owner_is_platform CHECK ((tenant_id IS NULL) = (role = 'owner')),
     CONSTRAINT unique_oidc_trust_name UNIQUE (tenant_id, name),
     FOREIGN KEY (tenant_id) REFERENCES tenant(id) ON DELETE CASCADE
@@ -77,35 +77,24 @@ CREATE INDEX IF NOT EXISTS idx_oidc_trust_issuer ON oidc_trust_relationship (iss
 --
 -- Make the tenant name, on its own, the tenant's identity.
 --
--- V0 keyed a tenant by (tenant, provider), where `provider` is the OIDC issuer
--- its users authenticate through. Only one issuer is ever configured, so the
--- pair never distinguished two tenants. What it did do was tie a tenant's
--- identity to the issuer string: changing FELDERA_AUTH_ISSUER (an IdP migration,
--- a custom domain, a recreated Cognito pool) made the next login miss the
--- conflict target and create a second tenant of the same name, leaving every
--- pipeline on the unreachable first one.
---
--- Keying on the name alone makes that case reuse the existing tenant. The issuer
--- stays as provenance, under a name that says so: `initial_provider`.
+-- V0 keyed a tenant by (tenant, provider), where `provider` is the OIDC issuer.
+-- Only one issuer is ever configured, so the pair never distinguished two
+-- tenants; all it did was tie a tenant's identity to the issuer string. Change
+-- FELDERA_AUTH_ISSUER and the next login forked a second tenant of the same
+-- name, leaving the pipelines on the first one, which nothing could reach. The
+-- issuer stays on as provenance, renamed `initial_provider` at the end.
 
--- A deployment whose issuer changed before this migration already has two
--- tenants sharing a name, and we cannot tell from here which deployments those
--- are. Rename rather than refuse: a failed migration would stop the manager from
--- starting and leave no in-product way out, whereas renaming keeps every tenant
--- present, reachable and unchanged.
---
--- Nothing is merged, moved or deleted. The name stays with the tenant users
--- already reach today, which is the one registered under the issuer that is
--- configured now: only that one was reachable before this migration, since a
--- login resolved (name, issuer). Keeping the name there means the upgrade does
--- not change what anyone sees. `feldera.auth_issuer` is set on this connection
--- by `run_migrations`; when it is absent, as with authentication disabled, fall
--- back to the tenant holding the most pipelines so the name still follows the
--- work. Ties break on the id for determinism.
+-- Two tenants may already share a name here, from an issuer change made before
+-- this migration, and nothing in the database says which deployments those are.
+-- Rename rather than refuse: a migration that fails stops the manager from
+-- starting, with no way out from inside the product.
 --
--- The others keep all of their own pipelines under a name qualified by their id,
--- which is unique. An owner finds them through `GET /v0/tenants`, acts in them
--- with the `Feldera-Tenant` header, and can rename them.
+-- The name stays with the tenant its users reach today, which is the one
+-- registered under the issuer configured now, so the upgrade changes nothing
+-- anyone sees. `run_migrations` puts that issuer in `feldera.auth_issuer`; with
+-- authentication off it is absent and the name follows the pipelines instead.
+-- Ties break on the id. Every other tenant keeps its own pipelines under
+-- `<name> (<id>)`, which an owner can list and rename.
 DO $$
 DECLARE renamed int;
 BEGIN
diff --git a/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs b/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
index a87a84223da..17fb4bb06d6 100644
--- a/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
+++ b/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
@@ -35,8 +35,10 @@ pub(crate) struct TrustScope {
     platform: bool,
 }
 
-// The scope a trust operation targets: `None` (platform-wide owner trusts, which
-// only an owner may touch) when `platform` is set, else the caller's tenant.
+/// The tenant a trust operation targets, mirroring the `tenant_id` column the
+/// trust is stored in: `Some(tenant)` for a tenant-scoped trust, and `None` for
+/// the platform-wide owner trusts, which belong to no tenant and which the
+/// schema stores with `tenant_id IS NULL`. Only an owner may target those.
 fn trust_scope(
     scope: &TrustScope,
     tenant_id: TenantId,
@@ -125,6 +127,10 @@ pub(crate) async fn list_oidc_trust(
 }
 
 /// Get OIDC Trust
+///
+/// Retrieve one trust relationship by `name`, the name it was created under,
+/// which is unique within the tenant (or, with `platform`, across the
+/// platform-wide owner trusts).
 #[utoipa::path(
     context_path = "/v0",
     security(("JSON web token (JWT) or API key" = [])),
@@ -197,6 +203,9 @@ pub(crate) async fn post_oidc_trust(
         Some(*tenant_id)
     };
 
+    // The remaining fields are validated in the database operation, which is
+    // the one place every caller passes through: the name against the
+    // permitted character set, and the issuer and subject against being empty.
     state
         .db
         .lock()
diff --git a/crates/pipeline-manager/src/api/endpoints/tenant.rs b/crates/pipeline-manager/src/api/endpoints/tenant.rs
index c67b65e2600..bb51c3d9661 100644
--- a/crates/pipeline-manager/src/api/endpoints/tenant.rs
+++ b/crates/pipeline-manager/src/api/endpoints/tenant.rs
@@ -63,14 +63,14 @@ pub(crate) struct AddMemberResponse {
     pub user_id: UserId,
 }
 
-/// Reject a requested role the caller may not grant: `owner` is platform-wide
-/// and never a tenant membership. The second check, that no one grants above
-/// their own role, cannot fire while these routes require `admin` (the highest
-/// grantable role); it is kept so lowering the route's minimum role stays safe.
+/// Reject a requested role the caller may not grant.
 fn check_grantable_role(requested: Role, caller: Role) -> Result<(), ManagerError> {
+    // `owner` is platform-wide, never a tenant membership.
     if requested == Role::Owner {
         return Err(DBError::OwnerRoleNotAssignable.into());
     }
+    // Cannot fire while these routes require `admin`, the highest grantable
+    // role; kept so that lowering the route's minimum role stays safe.
     if requested > caller {
         return Err(DBError::RoleExceedsCreator {
             requested,
@@ -105,10 +105,13 @@ pub(crate) struct RenameTenantRequest {
 #[derive(Debug, Serialize, ToSchema)]
 pub(crate) struct RenameTenantResponse {
     /// The tenant that gave up the name, when `displace_existing` was set and
-    /// another tenant held it. `null` when the name was free.
+    /// another tenant held it. `null` when no other tenant had that name.
     pub displaced: Option<TenantInfo>,
 }
 
+/// Parse the `tenant_id` path parameter. A value that is not a UUID names no
+/// tenant, so it is reported as an unknown tenant (404) rather than as a
+/// separate parse error.
 fn parse_tenant_id(req: &HttpRequest) -> Result<TenantId, ManagerError> {
     let raw = parse_url_parameter(req, "tenant_id")?;
     let uuid = Uuid::parse_str(&raw)
@@ -116,6 +119,8 @@ fn parse_tenant_id(req: &HttpRequest) -> Result<TenantId, ManagerError> {
     Ok(TenantId(uuid))
 }
 
+/// Parse the `user_id` path parameter. As with [`parse_tenant_id`], a value
+/// that is not a UUID names no user and is reported as an unknown user.
 fn parse_user_id(req: &HttpRequest) -> Result<UserId, ManagerError> {
     let raw = parse_url_parameter(req, "user_id")?;
     let uuid = Uuid::parse_str(&raw).map_err(|_| {
@@ -301,18 +306,10 @@ pub(crate) struct NewTenantResponse {
 /// and OIDC trust relationships all reference the tenant by its identifier and
 /// are unaffected.
 ///
-/// A login resolves its tenant by name, so renaming decides which tenant those
-/// users reach. Two consequences follow. Renaming a tenant away from a name the
-/// identity provider still asserts sends its users to a new, empty tenant on
-/// their next request, which re-creates the name. And a tenant that no login
-/// reaches, such as `default` after authentication is switched on, is recovered
-/// by giving it the name logins do resolve.
-///
-/// Recovery normally wants a name that is already taken, by the tenant the
-/// first login created. Set `displace_existing` to take it: that tenant is
-/// renamed to `<name> (<id>)` in the same transaction and keeps everything it
-/// had. One step is what makes recovery possible at all, since freeing the name
-/// and claiming it as two calls loses to the next request re-creating it.
+/// Set `displace_existing` to replace a tenant atomically with one that's
+/// currently in use. This renames the conflicting tenant to `<name> (<id>)` in
+/// the same transaction, with everything it had. Two calls potentially lose to
+/// another user request, which could re-create the name in between.
 #[utoipa::path(
     context_path = "/v0",
     security(("JSON web token (JWT) or API key" = [])),
diff --git a/crates/pipeline-manager/src/api/main.rs b/crates/pipeline-manager/src/api/main.rs
index ec76da810ae..79f60cc8cb4 100644
--- a/crates/pipeline-manager/src/api/main.rs
+++ b/crates/pipeline-manager/src/api/main.rs
@@ -806,9 +806,8 @@ impl Modify for SecurityAddon {
 }
 
 /// Annotates each gated operation with its minimum RBAC role, sourced from
-/// `ROUTE_MIN_ROLE` (rbac.rs) so the API reference cannot drift from the enforced
-/// policy. The note is prepended to the operation description, which the docs
-/// site renders as markdown.
+/// `ROUTE_MIN_ROLE` (rbac.rs) so the API reference cannot drift from the
+/// enforced policy.
 struct MinRoleAddon;
 
 impl Modify for MinRoleAddon {
@@ -826,16 +825,16 @@ impl Modify for MinRoleAddon {
                 };
                 // Only gated routes appear in the table; leave anything else
                 // (public infra endpoints) untouched.
-                let Some(rule) = crate::api::rbac::min_role_for(http, path.as_str()) else {
+                let Some(required) = crate::api::rbac::min_role_for(http, path.as_str()) else {
                     continue;
                 };
-                let note = match rule {
+                // Prepended to the operation description, which the docs site
+                // renders as markdown.
+                let note = if required == crate::db::types::role::Role::Owner {
                     // `owner` is the highest role, so "or higher" would be misleading.
-                    Some(crate::db::types::role::Role::Owner) => {
-                        "Required role: `owner`.".to_string()
-                    }
-                    Some(role) => format!("Required role: `{role}` or higher."),
-                    None => "Required role: any authenticated user.".to_string(),
+                    "Required role: `owner`.".to_string()
+                } else {
+                    format!("Required role: `{required}` or higher.")
                 };
                 operation.description = Some(match operation.description.take() {
                     Some(existing) if !existing.trim().is_empty() => {
diff --git a/crates/pipeline-manager/src/api/rbac.rs b/crates/pipeline-manager/src/api/rbac.rs
index b4a97fe49ec..0af7dcb7cda 100644
--- a/crates/pipeline-manager/src/api/rbac.rs
+++ b/crates/pipeline-manager/src/api/rbac.rs
@@ -5,10 +5,8 @@
 //! role against the minimum role declared for the matched route. The
 //! `ROUTE_MIN_ROLE` table below is the single source of truth for the
 //! access-control model. Enforcement is deny-by-default: a route that is
-//! reached but absent from the table is refused, so a
-//! newly added endpoint cannot ship silently world-accessible. The
-//! `every_registered_v0_route_is_classified` test enforces that every route
-//! actually registered gets an entry.
+//! reached but absent from the table is refused, so a newly added endpoint
+//! cannot ship silently world-accessible.
 
 use crate::auth::AuthenticatedPrincipal;
 use crate::db::error::DBError;
@@ -20,96 +18,94 @@ use actix_web::middleware::Next;
 use actix_web::{HttpMessage, HttpResponse, ResponseError};
 use std::collections::HashMap;
 use std::sync::OnceLock;
-use tracing::{debug, error};
+use tracing::{debug, error, info};
 
-/// Minimum role required to reach each `/v0` route. `None` means the route is
-/// reachable by any authenticated principal (no role floor). A `(method, path)`
-/// absent from this table is denied by the middleware.
+/// Minimum role required to reach each `/v0` route. A `(method, path)` absent
+/// from this table is denied by the middleware.
 #[rustfmt::skip]
-static ROUTE_MIN_ROLE: &[(&str, &str, Option<Role>)] = &[
-    ("GET", "/v0/api_keys", Some(Role::Write)), // list_api_keys
-    ("POST", "/v0/api_keys", Some(Role::Write)), // post_api_key
-    ("DELETE", "/v0/api_keys/{api_key_name}", Some(Role::Write)), // delete_api_key
-    ("GET", "/v0/api_keys/{api_key_name}", Some(Role::Write)), // get_api_key
-    ("GET", "/v0/cluster/events", Some(Role::Read)), // list_cluster_events
-    ("GET", "/v0/cluster/events/{event_id}", Some(Role::Read)), // get_cluster_event
-    ("GET", "/v0/cluster_healthz", Some(Role::Read)), // get_cluster_health
-    ("GET", "/v0/config", Some(Role::Read)), // get_config
-    ("GET", "/v0/config/demos", Some(Role::Read)), // get_config_demos
-    ("GET", "/v0/config/session", Some(Role::Read)), // get_config_session
-    ("GET", "/v0/metrics", Some(Role::Read)), // get_metrics
-    ("GET", "/v0/oidc_trust", Some(Role::Admin)), // list_oidc_trust
-    ("POST", "/v0/oidc_trust", Some(Role::Admin)), // post_oidc_trust
-    ("DELETE", "/v0/oidc_trust/{name}", Some(Role::Admin)), // delete_oidc_trust
-    ("GET", "/v0/oidc_trust/{name}", Some(Role::Admin)), // get_oidc_trust
-    ("GET", "/v0/pipelines", Some(Role::Read)), // list_pipelines
-    ("POST", "/v0/pipelines", Some(Role::Write)), // post_pipeline
-    ("DELETE", "/v0/pipelines/{pipeline_name}", Some(Role::Write)), // delete_pipeline
-    ("GET", "/v0/pipelines/{pipeline_name}", Some(Role::Read)), // get_pipeline
-    ("PATCH", "/v0/pipelines/{pipeline_name}", Some(Role::Write)), // patch_pipeline
-    ("PUT", "/v0/pipelines/{pipeline_name}", Some(Role::Write)), // put_pipeline
-    ("POST", "/v0/pipelines/{pipeline_name}/activate", Some(Role::Write)), // post_pipeline_activate
-    ("POST", "/v0/pipelines/{pipeline_name}/approve", Some(Role::Write)), // post_pipeline_approve
-    ("POST", "/v0/pipelines/{pipeline_name}/checkpoint", Some(Role::Write)), // checkpoint_pipeline
-    ("POST", "/v0/pipelines/{pipeline_name}/checkpoint/sync", Some(Role::Write)), // sync_checkpoint
-    ("GET", "/v0/pipelines/{pipeline_name}/checkpoint/sync_status", Some(Role::Read)), // get_checkpoint_sync_status
-    ("GET", "/v0/pipelines/{pipeline_name}/checkpoint_status", Some(Role::Read)), // get_checkpoint_status
-    ("GET", "/v0/pipelines/{pipeline_name}/checkpoints", Some(Role::Read)), // get_checkpoints
-    ("GET", "/v0/pipelines/{pipeline_name}/checkpoints/remote", Some(Role::Read)), // get_remote_checkpoints
-    ("GET", "/v0/pipelines/{pipeline_name}/circuit_json_profile", Some(Role::Read)), // get_pipeline_circuit_json_profile
-    ("GET", "/v0/pipelines/{pipeline_name}/circuit_profile", Some(Role::Read)), // get_pipeline_circuit_profile
-    ("POST", "/v0/pipelines/{pipeline_name}/clear", Some(Role::Write)), // post_pipeline_clear
-    ("POST", "/v0/pipelines/{pipeline_name}/clock/advance", Some(Role::Write)), // clock_advance
-    ("POST", "/v0/pipelines/{pipeline_name}/commit_transaction", Some(Role::Write)), // commit_transaction
-    ("GET", "/v0/pipelines/{pipeline_name}/completion_status", Some(Role::Read)), // completion_status
-    ("GET", "/v0/pipelines/{pipeline_name}/dataflow_graph", Some(Role::Read)), // get_pipeline_dataflow_graph
-    ("POST", "/v0/pipelines/{pipeline_name}/diff", Some(Role::Read)), // post_pipeline_diff (compile-only, no data/state change)
-    ("POST", "/v0/pipelines/{pipeline_name}/dismiss_error", Some(Role::Write)), // post_pipeline_dismiss_error
-    ("POST", "/v0/pipelines/{pipeline_name}/egress/{table_name}", Some(Role::Write)), // http_output
-    ("GET", "/v0/pipelines/{pipeline_name}/events", Some(Role::Read)), // list_pipeline_events
-    ("GET", "/v0/pipelines/{pipeline_name}/events/{event_id}", Some(Role::Read)), // get_pipeline_event
-    ("GET", "/v0/pipelines/{pipeline_name}/heap_profile", Some(Role::Read)), // get_pipeline_heap_profile
-    ("POST", "/v0/pipelines/{pipeline_name}/ingress/{table_name}", Some(Role::Write)), // http_input
-    ("GET", "/v0/pipelines/{pipeline_name}/logs", Some(Role::Read)), // get_pipeline_logs
-    ("GET", "/v0/pipelines/{pipeline_name}/metrics", Some(Role::Read)), // get_pipeline_metrics
-    ("POST", "/v0/pipelines/{pipeline_name}/pause", Some(Role::Write)), // post_pipeline_pause
-    ("GET", "/v0/pipelines/{pipeline_name}/query", Some(Role::Write)), // pipeline_adhoc_sql
-    ("POST", "/v0/pipelines/{pipeline_name}/rebalance", Some(Role::Write)), // post_pipeline_rebalance
-    ("POST", "/v0/pipelines/{pipeline_name}/resume", Some(Role::Write)), // post_pipeline_resume
-    ("GET", "/v0/pipelines/{pipeline_name}/samply_profile", Some(Role::Read)), // get_pipeline_samply_profile
-    ("POST", "/v0/pipelines/{pipeline_name}/samply_profile", Some(Role::Read)), // start_samply_profile
-    ("POST", "/v0/pipelines/{pipeline_name}/start", Some(Role::Write)), // post_pipeline_start
-    ("POST", "/v0/pipelines/{pipeline_name}/start_compaction", Some(Role::Write)), // post_pipeline_start_compaction
-    ("POST", "/v0/pipelines/{pipeline_name}/start_transaction", Some(Role::Write)), // start_transaction
-    ("GET", "/v0/pipelines/{pipeline_name}/stats", Some(Role::Read)), // get_pipeline_stats
-    ("POST", "/v0/pipelines/{pipeline_name}/stop", Some(Role::Write)), // post_pipeline_stop
-    ("GET", "/v0/pipelines/{pipeline_name}/support_bundle", Some(Role::Read)), // get_pipeline_support_bundle
-    ("GET", "/v0/pipelines/{pipeline_name}/tables/{table_name}/connectors/{connector_name}/completion_token", Some(Role::Write)), // completion_token
-    ("GET", "/v0/pipelines/{pipeline_name}/tables/{table_name}/connectors/{connector_name}/stats", Some(Role::Read)), // get_pipeline_input_connector_status
-    ("POST", "/v0/pipelines/{pipeline_name}/tables/{table_name}/connectors/{connector_name}/{action}", Some(Role::Write)), // post_pipeline_input_connector_action
-    ("POST", "/v0/pipelines/{pipeline_name}/testing", Some(Role::Write)), // post_pipeline_testing
-    ("GET", "/v0/pipelines/{pipeline_name}/time_series", Some(Role::Read)), // get_pipeline_time_series
-    ("GET", "/v0/pipelines/{pipeline_name}/time_series_stream", Some(Role::Read)), // get_pipeline_time_series_stream
-    ("POST", "/v0/pipelines/{pipeline_name}/update_runtime", Some(Role::Write)), // post_update_runtime
-    ("POST", "/v0/validate_program", Some(Role::Read)), // post_validate_program (compile-only, no data/state change)
-    ("POST", "/v0/pipelines/{pipeline_name}/views/{view_name}/connectors/{connector_name}/command", Some(Role::Write)), // post_pipeline_output_connector_command
-    ("GET", "/v0/pipelines/{pipeline_name}/views/{view_name}/connectors/{connector_name}/stats", Some(Role::Read)), // get_pipeline_output_connector_status
+static ROUTE_MIN_ROLE: &[(&str, &str, Role)] = &[
+    ("GET", "/v0/api_keys", Role::Write), // list_api_keys
+    ("POST", "/v0/api_keys", Role::Write), // post_api_key
+    ("DELETE", "/v0/api_keys/{api_key_name}", Role::Write), // delete_api_key
+    ("GET", "/v0/api_keys/{api_key_name}", Role::Write), // get_api_key
+    ("GET", "/v0/cluster/events", Role::Read), // list_cluster_events
+    ("GET", "/v0/cluster/events/{event_id}", Role::Read), // get_cluster_event
+    ("GET", "/v0/cluster_healthz", Role::Read), // get_cluster_health
+    ("GET", "/v0/config", Role::Read), // get_config
+    ("GET", "/v0/config/demos", Role::Read), // get_config_demos
+    ("GET", "/v0/config/session", Role::Read), // get_config_session
+    ("GET", "/v0/metrics", Role::Read), // get_metrics
+    ("GET", "/v0/oidc_trust", Role::Admin), // list_oidc_trust
+    ("POST", "/v0/oidc_trust", Role::Admin), // post_oidc_trust
+    ("DELETE", "/v0/oidc_trust/{name}", Role::Admin), // delete_oidc_trust
+    ("GET", "/v0/oidc_trust/{name}", Role::Admin), // get_oidc_trust
+    ("GET", "/v0/pipelines", Role::Read), // list_pipelines
+    ("POST", "/v0/pipelines", Role::Write), // post_pipeline
+    ("DELETE", "/v0/pipelines/{pipeline_name}", Role::Write), // delete_pipeline
+    ("GET", "/v0/pipelines/{pipeline_name}", Role::Read), // get_pipeline
+    ("PATCH", "/v0/pipelines/{pipeline_name}", Role::Write), // patch_pipeline
+    ("PUT", "/v0/pipelines/{pipeline_name}", Role::Write), // put_pipeline
+    ("POST", "/v0/pipelines/{pipeline_name}/activate", Role::Write), // post_pipeline_activate
+    ("POST", "/v0/pipelines/{pipeline_name}/approve", Role::Write), // post_pipeline_approve
+    ("POST", "/v0/pipelines/{pipeline_name}/checkpoint", Role::Write), // checkpoint_pipeline
+    ("POST", "/v0/pipelines/{pipeline_name}/checkpoint/sync", Role::Write), // sync_checkpoint
+    ("GET", "/v0/pipelines/{pipeline_name}/checkpoint/sync_status", Role::Read), // get_checkpoint_sync_status
+    ("GET", "/v0/pipelines/{pipeline_name}/checkpoint_status", Role::Read), // get_checkpoint_status
+    ("GET", "/v0/pipelines/{pipeline_name}/checkpoints", Role::Read), // get_checkpoints
+    ("GET", "/v0/pipelines/{pipeline_name}/checkpoints/remote", Role::Read), // get_remote_checkpoints
+    ("GET", "/v0/pipelines/{pipeline_name}/circuit_json_profile", Role::Read), // get_pipeline_circuit_json_profile
+    ("GET", "/v0/pipelines/{pipeline_name}/circuit_profile", Role::Read), // get_pipeline_circuit_profile
+    ("POST", "/v0/pipelines/{pipeline_name}/clear", Role::Write), // post_pipeline_clear
+    ("POST", "/v0/pipelines/{pipeline_name}/clock/advance", Role::Write), // clock_advance
+    ("POST", "/v0/pipelines/{pipeline_name}/commit_transaction", Role::Write), // commit_transaction
+    ("GET", "/v0/pipelines/{pipeline_name}/completion_status", Role::Read), // completion_status
+    ("GET", "/v0/pipelines/{pipeline_name}/dataflow_graph", Role::Read), // get_pipeline_dataflow_graph
+    ("POST", "/v0/pipelines/{pipeline_name}/diff", Role::Read), // post_pipeline_diff (compile-only, no data/state change)
+    ("POST", "/v0/pipelines/{pipeline_name}/dismiss_error", Role::Write), // post_pipeline_dismiss_error
+    ("POST", "/v0/pipelines/{pipeline_name}/egress/{table_name}", Role::Write), // http_output
+    ("GET", "/v0/pipelines/{pipeline_name}/events", Role::Read), // list_pipeline_events
+    ("GET", "/v0/pipelines/{pipeline_name}/events/{event_id}", Role::Read), // get_pipeline_event
+    ("GET", "/v0/pipelines/{pipeline_name}/heap_profile", Role::Read), // get_pipeline_heap_profile
+    ("POST", "/v0/pipelines/{pipeline_name}/ingress/{table_name}", Role::Write), // http_input
+    ("GET", "/v0/pipelines/{pipeline_name}/logs", Role::Read), // get_pipeline_logs
+    ("GET", "/v0/pipelines/{pipeline_name}/metrics", Role::Read), // get_pipeline_metrics
+    ("POST", "/v0/pipelines/{pipeline_name}/pause", Role::Write), // post_pipeline_pause
+    ("GET", "/v0/pipelines/{pipeline_name}/query", Role::Write), // pipeline_adhoc_sql
+    ("POST", "/v0/pipelines/{pipeline_name}/rebalance", Role::Write), // post_pipeline_rebalance
+    ("POST", "/v0/pipelines/{pipeline_name}/resume", Role::Write), // post_pipeline_resume
+    ("GET", "/v0/pipelines/{pipeline_name}/samply_profile", Role::Read), // get_pipeline_samply_profile
+    ("POST", "/v0/pipelines/{pipeline_name}/samply_profile", Role::Read), // start_samply_profile
+    ("POST", "/v0/pipelines/{pipeline_name}/start", Role::Write), // post_pipeline_start
+    ("POST", "/v0/pipelines/{pipeline_name}/start_compaction", Role::Write), // post_pipeline_start_compaction
+    ("POST", "/v0/pipelines/{pipeline_name}/start_transaction", Role::Write), // start_transaction
+    ("GET", "/v0/pipelines/{pipeline_name}/stats", Role::Read), // get_pipeline_stats
+    ("POST", "/v0/pipelines/{pipeline_name}/stop", Role::Write), // post_pipeline_stop
+    ("GET", "/v0/pipelines/{pipeline_name}/support_bundle", Role::Read), // get_pipeline_support_bundle
+    ("GET", "/v0/pipelines/{pipeline_name}/tables/{table_name}/connectors/{connector_name}/completion_token", Role::Write), // completion_token
+    ("GET", "/v0/pipelines/{pipeline_name}/tables/{table_name}/connectors/{connector_name}/stats", Role::Read), // get_pipeline_input_connector_status
+    ("POST", "/v0/pipelines/{pipeline_name}/tables/{table_name}/connectors/{connector_name}/{action}", Role::Write), // post_pipeline_input_connector_action
+    ("POST", "/v0/pipelines/{pipeline_name}/testing", Role::Write), // post_pipeline_testing
+    ("GET", "/v0/pipelines/{pipeline_name}/time_series", Role::Read), // get_pipeline_time_series
+    ("GET", "/v0/pipelines/{pipeline_name}/time_series_stream", Role::Read), // get_pipeline_time_series_stream
+    ("POST", "/v0/pipelines/{pipeline_name}/update_runtime", Role::Write), // post_update_runtime
+    ("POST", "/v0/validate_program", Role::Read), // post_validate_program (compile-only, no data/state change)
+    ("POST", "/v0/pipelines/{pipeline_name}/views/{view_name}/connectors/{connector_name}/command", Role::Write), // post_pipeline_output_connector_command
+    ("GET", "/v0/pipelines/{pipeline_name}/views/{view_name}/connectors/{connector_name}/stats", Role::Read), // get_pipeline_output_connector_status
     // RBAC tenant/user management
-    ("GET", "/v0/tenant/users", Some(Role::Admin)), // list_tenant_users
-    ("POST", "/v0/tenant/users", Some(Role::Admin)), // add_tenant_user (pre-provision)
-    ("PUT", "/v0/tenant/users/{user_id}", Some(Role::Admin)), // put_tenant_user
-    ("DELETE", "/v0/tenant/users/{user_id}", Some(Role::Admin)), // delete_tenant_user
-    ("GET", "/v0/tenants", Some(Role::Owner)), // list_tenants
-    ("POST", "/v0/tenants", Some(Role::Owner)), // create_tenant
-    ("PATCH", "/v0/tenants/{tenant_id}", Some(Role::Owner)), // patch_tenant
-    ("DELETE", "/v0/tenants/{tenant_id}", Some(Role::Owner)), // delete_tenant
+    ("GET", "/v0/tenant/users", Role::Admin), // list_tenant_users
+    ("POST", "/v0/tenant/users", Role::Admin), // add_tenant_user (pre-provision)
+    ("PUT", "/v0/tenant/users/{user_id}", Role::Admin), // put_tenant_user
+    ("DELETE", "/v0/tenant/users/{user_id}", Role::Admin), // delete_tenant_user
+    ("GET", "/v0/tenants", Role::Owner), // list_tenants
+    ("POST", "/v0/tenants", Role::Owner), // create_tenant
+    ("PATCH", "/v0/tenants/{tenant_id}", Role::Owner), // patch_tenant
+    ("DELETE", "/v0/tenants/{tenant_id}", Role::Owner), // delete_tenant
 ];
 
-/// [`ROUTE_MIN_ROLE`] indexed by `(method, path)`, built once on first use. The
-/// table is the authoring format; this map is the form the auth hot path needs,
-/// turning a per-request scan into a hash lookup.
-fn route_table() -> &'static HashMap<(&'static str, &'static str), Option<Role>> {
-    static TABLE: OnceLock<HashMap<(&'static str, &'static str), Option<Role>>> = OnceLock::new();
+/// [`ROUTE_MIN_ROLE`] indexed by `(method, pattern)`, built once on first use,
+/// for callers that already hold a route template rather than a request path.
+fn route_table() -> &'static HashMap<(&'static str, &'static str), Role> {
+    static TABLE: OnceLock<HashMap<(&'static str, &'static str), Role>> = OnceLock::new();
     TABLE.get_or_init(|| {
         ROUTE_MIN_ROLE
             .iter()
@@ -118,41 +114,40 @@ fn route_table() -> &'static HashMap<(&'static str, &'static str), Option<Role>>
     })
 }
 
-/// The access rule for a route, used both by the middleware below and by the
-/// OpenAPI annotation that documents each endpoint's minimum role, so the API
-/// reference cannot drift from the enforced policy.
+/// The minimum role for a route template, or `None` when the table does not
+/// classify it, which the middleware treats as a denial.
 ///
 /// ```text
-/// min_role_for("POST", "/v0/pipelines")            => Some(Some(Role::Write))
-/// min_role_for("GET",  "/v0/pipelines")            => Some(Some(Role::Read))
-/// min_role_for("POST", "/v0/tenants")              => Some(Some(Role::Owner))
-/// min_role_for("GET",  "/v0/not-a-route")          => None   // unknown: denied
+/// min_role_for("POST", "/v0/tenants")     => Some(Role::Owner)
+/// min_role_for("GET",  "/v0/not-a-route") => None
 /// ```
 ///
-/// `None` means the route is not in the table and is denied; `Some(None)` means
-/// any authenticated principal may proceed; `Some(Some(role))` requires at least
-/// `role`.
-pub(crate) fn min_role_for(method: &str, pattern: &str) -> Option<Option<Role>> {
+/// The OpenAPI annotation reads the same table as the middleware, so the API
+/// reference cannot drift from the enforced policy.
+pub(crate) fn min_role_for(method: &str, pattern: &str) -> Option<Role> {
     route_table().get(&(method, pattern)).copied()
 }
 
 /// Resolve a request path to its table entry, returning the pattern it matched
 /// and that pattern's rule.
 ///
-/// The middleware cannot use actix's `match_pattern()` for this. That resolves
-/// by path alone, ignoring the method, so a request whose path also matches an
-/// earlier-registered pattern of a different method reports the wrong template:
-/// `GET .../connectors/{connector_name}/completion_token` came back as
-/// `POST .../connectors/{connector_name}/{action}`, which is not a GET entry, and
-/// a classified route was denied as unclassified. Matching the table directly,
-/// method first, keeps the enforced rule and the authored rule the same thing.
+/// Actix's `match_pattern()` cannot serve here: it resolves by path alone,
+/// ignoring the method, so it reports whichever registered pattern claims the
+/// path first. Matching the table directly, method first, keeps the enforced
+/// rule and the authored rule the same thing.
+///
+/// A literal segment beats a placeholder, as in any router:
 ///
-/// A literal segment beats a placeholder, as in any router, so `.../start`
-/// resolves to `.../{action}` only when no literal pattern claims it.
-fn classify(method: &str, path: &str) -> Option<(&'static str, Option<Role>)> {
+/// ```text
+/// GET  /v0/pipelines/p/tables/t/connectors/c/completion_token
+///   => .../connectors/{connector_name}/completion_token   (literal wins)
+/// POST /v0/pipelines/p/tables/t/connectors/c/start
+///   => .../connectors/{connector_name}/{action}           (no literal claims it)
+/// ```
+fn classify(method: &str, path: &str) -> Option<(&'static str, Role)> {
     let segments: Vec<&str> = path.split('/').collect();
     let candidates = candidates_by_shape().get(&(method, segments.len()))?;
-    let mut best: Option<(usize, &'static str, Option<Role>)> = None;
+    let mut best: Option<(usize, &'static str, Role)> = None;
     for (pattern, role) in candidates {
         let Some(literals) = literal_segments_if_match(pattern, &segments) else {
             continue;
@@ -165,16 +160,14 @@ fn classify(method: &str, path: &str) -> Option<(&'static str, Option<Role>)> {
 }
 
 /// [`ROUTE_MIN_ROLE`] bucketed by `(method, segment count)`, built once on first
-/// use. A path can only match a pattern of the same shape, so this leaves the
-/// per-request scan a handful of candidates rather than the whole table.
+/// use. A path can only match a pattern of the same shape, so a request compares
+/// itself against a handful of candidates rather than the whole table.
 #[allow(clippy::type_complexity)]
-fn candidates_by_shape(
-) -> &'static HashMap<(&'static str, usize), Vec<(&'static str, Option<Role>)>> {
-    static SHAPES: OnceLock<HashMap<(&'static str, usize), Vec<(&'static str, Option<Role>)>>> =
+fn candidates_by_shape() -> &'static HashMap<(&'static str, usize), Vec<(&'static str, Role)>> {
+    static SHAPES: OnceLock<HashMap<(&'static str, usize), Vec<(&'static str, Role)>>> =
         OnceLock::new();
     SHAPES.get_or_init(|| {
-        let mut shapes: HashMap<(&'static str, usize), Vec<(&'static str, Option<Role>)>> =
-            HashMap::new();
+        let mut shapes: HashMap<(&'static str, usize), Vec<(&'static str, Role)>> = HashMap::new();
         for (method, pattern, role) in ROUTE_MIN_ROLE {
             shapes
                 .entry((method, pattern.split('/').count()))
@@ -244,7 +237,7 @@ fn authorize(
     if !routed {
         return Ok(None);
     }
-    let Some((pattern, rule)) = classify(method, path) else {
+    let Some((pattern, required)) = classify(method, path) else {
         // A registered route with no table entry is a bug: deny it rather
         // than serve it unguarded.
         error!("RBAC: route {method} {path} has no access-control entry; denying");
@@ -252,35 +245,45 @@ fn authorize(
             "This endpoint has no access-control classification and is denied",
         ));
     };
-    match rule {
-        None => Ok(Some(pattern)),
-        Some(required) => match principal {
-            Some(p) if p.role.satisfies(required) => Ok(Some(pattern)),
-            Some(p) => Err(DBError::InsufficientPermissions {
-                required,
-                actual: p.role,
-            }
-            .error_response()),
-            None => {
-                error!("RBAC: no authenticated principal for {method} {pattern}; denying");
-                Err(forbidden("No authenticated principal"))
-            }
-        },
+    match principal {
+        Some(p) if p.role.satisfies(required) => Ok(Some(pattern)),
+        Some(p) => Err(DBError::InsufficientPermissions {
+            required,
+            actual: p.role,
+        }
+        .error_response()),
+        None => {
+            error!("RBAC: no authenticated principal for {method} {pattern}; denying");
+            Err(forbidden("No authenticated principal"))
+        }
     }
 }
 
-/// Record who reached which route, in which tenant, at what role. `role=owner`
-/// identifies a platform owner acting in a tenant it may not belong to.
+/// Record who reached which route, in which tenant, at what role.
+///
+/// Privileged access is logged unconditionally: `admin` manages a tenant's
+/// members and trusts, and `owner` acts across tenants, including in tenants it
+/// is not a member of, so those are the requests an operator has to be able to
+/// account for after the fact. Read and write traffic is the data plane, one
+/// line per request, and stays at debug.
 fn audit(method: &Method, pattern: &str, principal: Option<&AuthenticatedPrincipal>) {
     let Some(p) = principal else { return };
-    debug!(
-        "audit: user='{}' tenant={} role={} {} {}",
-        p.label, p.acting_tenant, p.role, method, pattern
-    );
+    if p.role >= Role::Admin {
+        info!(
+            "audit: user='{}' tenant={} role={} {} {}",
+            p.label, p.acting_tenant, p.role, method, pattern
+        );
+    } else {
+        debug!(
+            "audit: user='{}' tenant={} role={} {} {}",
+            p.label, p.acting_tenant, p.role, method, pattern
+        );
+    }
 }
 
-/// RBAC enforcement middleware for the authenticated `/v0` scope. Runs after
-/// `auth_validator` has installed the principal.
+/// Refuse any `/v0` request whose principal is below the role its route
+/// requires, and record the ones that pass. Runs after `auth_validator` has
+/// installed the principal, so the role is already resolved here.
 pub(crate) async fn rbac_middleware(
     req: ServiceRequest,
     next: Next<impl MessageBody + 'static>,
@@ -351,10 +354,10 @@ mod test {
     }
 
     /// Every entry must be reachable from a real request path, under its own
-    /// method. A pattern that another entry shadows would be enforced with the
-    /// wrong rule, or denied as unclassified, which is how
-    /// `GET .../connectors/{connector_name}/completion_token` came to be refused:
-    /// it shares a path shape with `POST .../connectors/{connector_name}/{action}`.
+    /// method: an entry that another pattern shadows is enforced with the wrong
+    /// rule, or denied as unclassified. For example, `GET
+    /// .../connectors/{connector_name}/completion_token` shares a path shape
+    /// with `POST .../connectors/{connector_name}/{action}`.
     #[test]
     fn every_table_entry_resolves_from_a_concrete_path() {
         for (method, pattern, role) in ROUTE_MIN_ROLE {
@@ -377,21 +380,21 @@ mod test {
             classify("GET", &format!("{base}/completion_token")),
             Some((
                 "/v0/pipelines/{pipeline_name}/tables/{table_name}/connectors/{connector_name}/completion_token",
-                Some(Role::Write)
+                Role::Write
             ))
         );
         assert_eq!(
             classify("GET", &format!("{base}/stats")),
             Some((
                 "/v0/pipelines/{pipeline_name}/tables/{table_name}/connectors/{connector_name}/stats",
-                Some(Role::Read)
+                Role::Read
             ))
         );
         assert_eq!(
             classify("POST", &format!("{base}/start")),
             Some((
                 "/v0/pipelines/{pipeline_name}/tables/{table_name}/connectors/{connector_name}/{action}",
-                Some(Role::Write)
+                Role::Write
             ))
         );
         // The method is part of the match: no GET entry has that shape.
@@ -406,18 +409,15 @@ mod test {
     #[test]
     fn every_route_admits_exactly_its_minimum_role() {
         let all_roles = [Role::Read, Role::Write, Role::Admin, Role::Owner];
-        for (method, pattern, min) in ROUTE_MIN_ROLE {
+        for (method, pattern, required) in ROUTE_MIN_ROLE {
             for role in all_roles {
                 let principal = AuthenticatedPrincipal::for_test(role);
                 let allowed =
                     authorize(method, true, &concrete_path(pattern), Some(&principal)).is_ok();
-                let expected = match min {
-                    None => true, // any authenticated principal
-                    Some(required) => role >= *required,
-                };
+                let expected = role >= *required;
                 assert_eq!(
                     allowed, expected,
-                    "{method} {pattern}: role {role} allowed={allowed}, expected={expected} (min={min:?})"
+                    "{method} {pattern}: role {role} allowed={allowed}, expected={expected} (min={required})"
                 );
             }
             // A request with no principal at all is always refused on a
@@ -429,6 +429,27 @@ mod test {
         }
     }
 
+    /// A route that can change something never admits `read`. The exceptions
+    /// are the POSTs that compile or profile: they take a body but leave no
+    /// data or state behind.
+    #[test]
+    fn a_mutating_route_never_admits_read() {
+        let posts_that_change_nothing = [
+            "/v0/pipelines/{pipeline_name}/diff",
+            "/v0/pipelines/{pipeline_name}/samply_profile",
+            "/v0/validate_program",
+        ];
+        for (method, pattern, required) in ROUTE_MIN_ROLE {
+            if *method == "GET" || posts_that_change_nothing.contains(pattern) {
+                continue;
+            }
+            assert!(
+                *required >= Role::Write,
+                "{method} {pattern} admits {required}; a mutating route needs at least write"
+            );
+        }
+    }
+
     /// Independent pin of the most security-sensitive classifications, so an
     /// accidental downgrade in the table is caught here regardless of the
     /// self-consistent matrix test above. Revert any of these table entries and
@@ -443,61 +464,37 @@ mod test {
             );
         };
         // Data plane and mutations require write; read must never reach them.
-        expect("POST", "/v0/pipelines", Some(Role::Write));
-        expect("DELETE", "/v0/pipelines/{pipeline_name}", Some(Role::Write));
-        expect(
-            "POST",
-            "/v0/pipelines/{pipeline_name}/start",
-            Some(Role::Write),
-        );
-        expect(
-            "POST",
-            "/v0/pipelines/{pipeline_name}/stop",
-            Some(Role::Write),
-        );
-        expect(
-            "POST",
-            "/v0/pipelines/{pipeline_name}/clear",
-            Some(Role::Write),
-        );
+        expect("POST", "/v0/pipelines", Role::Write);
+        expect("DELETE", "/v0/pipelines/{pipeline_name}", Role::Write);
+        expect("POST", "/v0/pipelines/{pipeline_name}/start", Role::Write);
+        expect("POST", "/v0/pipelines/{pipeline_name}/stop", Role::Write);
+        expect("POST", "/v0/pipelines/{pipeline_name}/clear", Role::Write);
         expect(
             "POST",
             "/v0/pipelines/{pipeline_name}/ingress/{table_name}",
-            Some(Role::Write),
+            Role::Write,
         );
         expect(
             "POST",
             "/v0/pipelines/{pipeline_name}/egress/{table_name}",
-            Some(Role::Write),
-        );
-        expect(
-            "GET",
-            "/v0/pipelines/{pipeline_name}/query",
-            Some(Role::Write),
+            Role::Write,
         );
+        expect("GET", "/v0/pipelines/{pipeline_name}/query", Role::Write);
         expect(
             "POST",
             "/v0/pipelines/{pipeline_name}/start_transaction",
-            Some(Role::Write),
+            Role::Write,
         );
         // Monitoring is read.
-        expect("GET", "/v0/pipelines", Some(Role::Read));
-        expect(
-            "GET",
-            "/v0/pipelines/{pipeline_name}/stats",
-            Some(Role::Read),
-        );
-        expect(
-            "GET",
-            "/v0/pipelines/{pipeline_name}/logs",
-            Some(Role::Read),
-        );
+        expect("GET", "/v0/pipelines", Role::Read);
+        expect("GET", "/v0/pipelines/{pipeline_name}/stats", Role::Read);
+        expect("GET", "/v0/pipelines/{pipeline_name}/logs", Role::Read);
         // Identity administration is admin.
-        expect("POST", "/v0/oidc_trust", Some(Role::Admin));
-        expect("GET", "/v0/tenant/users", Some(Role::Admin));
+        expect("POST", "/v0/oidc_trust", Role::Admin);
+        expect("GET", "/v0/tenant/users", Role::Admin);
         // Platform administration is owner.
-        expect("GET", "/v0/tenants", Some(Role::Owner));
-        expect("POST", "/v0/tenants", Some(Role::Owner));
+        expect("GET", "/v0/tenants", Role::Owner);
+        expect("POST", "/v0/tenants", Role::Owner);
     }
 
     /// End-to-end through a real actix pipeline: the middleware short-circuits
@@ -579,9 +576,8 @@ mod test {
         assert_eq!(call("GET", "/v0/tenants", "admin").await.status(), 403);
         assert_eq!(call("GET", "/v0/tenants", "owner").await.status(), 200);
 
-        // A route whose path is also claimed by an earlier placeholder route of
-        // another method keeps its own rule, rather than resolving to that
-        // route and being denied as unclassified.
+        // Shadowed route: `GET .../completion_token` shares its path shape with
+        // `POST .../{action}`, registered first, and keeps its own rule anyway.
         let token = "/v0/pipelines/p/tables/t/connectors/c/completion_token";
         assert_eq!(call("GET", token, "write").await.status(), 200);
         assert_eq!(call("GET", token, "read").await.status(), 403);
diff --git a/crates/pipeline-manager/src/db/operations/oidc_trust.rs b/crates/pipeline-manager/src/db/operations/oidc_trust.rs
index b85ae3f1862..82a06c37b75 100644
--- a/crates/pipeline-manager/src/db/operations/oidc_trust.rs
+++ b/crates/pipeline-manager/src/db/operations/oidc_trust.rs
@@ -10,6 +10,10 @@ use deadpool_postgres::Transaction;
 use std::str::FromStr;
 use uuid::Uuid;
 
+/// Build a trust from a row of the `SELECT` list used throughout this module.
+/// `row.get` panics if a column's type or position does not match, which is a
+/// bug in that `SELECT`, not a runtime condition; only the role, stored as text,
+/// can fail on data and returns an error.
 fn row_to_descr(row: &tokio_postgres::Row) -> Result<OidcTrustDescr, DBError> {
     let id: Uuid = row.get(0);
     let name: String = row.get(1);
@@ -117,7 +121,9 @@ pub async fn delete_oidc_trust(
 
 // `tenant_id` is `None` for a platform-wide owner trust and `Some` for a
 // tenant-scoped one; the caller pairs it with the role (owner iff None), which
-// the `oidc_trust_owner_is_platform` CHECK also enforces.
+// the `oidc_trust_owner_is_platform` CHECK also enforces. A tenant that does
+// not exist is refused by the foreign key and reported as `UnknownTenant`;
+// callers take the id from the authenticated principal, not from the request.
 #[allow(clippy::too_many_arguments)]
 pub async fn create_oidc_trust(
     txn: &Transaction<'_>,
diff --git a/crates/pipeline-manager/src/db/operations/tenant.rs b/crates/pipeline-manager/src/db/operations/tenant.rs
index 4ee5a5d6a19..dac64bc5cbf 100644
--- a/crates/pipeline-manager/src/db/operations/tenant.rs
+++ b/crates/pipeline-manager/src/db/operations/tenant.rs
@@ -18,10 +18,8 @@ pub async fn get_or_create_tenant_id(
         .0)
 }
 
-/// As [`get_or_create_tenant_id`], but also reports whether the tenant was
-/// newly created by this call. The boolean lets the login path grant the very
-/// first principal of a fresh tenant the role configured by
-/// `--first-user-role` / `FELDERA_AUTH_FIRST_USER_ROLE` (`admin` by default).
+/// As [`get_or_create_tenant_id`]. The second component of the returned value
+/// is `true` if this call created the tenant, and `false` if it already existed.
 pub async fn get_or_create_tenant_id_created(
     txn: &Transaction<'_>,
     new_id: Uuid,
@@ -72,8 +70,8 @@ pub async fn get_tenant_id_by_name(txn: &Transaction<'_>, name: &str) -> Result<
 /// Strict resolution of a `Feldera-Tenant` selector, used wherever a principal
 /// picks one of the tenants it is authorized for. A selector that parses as a
 /// UUID is resolved by tenant id; otherwise it is resolved by name. Never
-/// creates a tenant; errors with `UnknownTenantName` (HTTP 404) on miss, so a
-/// typo cannot silently create or cross into the wrong tenant. The caller is
+/// creates a tenant; errors with `UnknownTenantName` on miss, so a typo cannot
+/// silently create or cross into the wrong tenant. The caller is
 /// responsible for checking that the resolved tenant is one the principal may
 /// act in.
 pub async fn resolve_tenant_selector(
@@ -119,19 +117,19 @@ pub async fn create_tenant(
 /// no membership, key, pipeline or trust is affected. The name is what a login
 /// resolves, though, so renaming changes which tenant those users land in.
 ///
-/// With `displace_existing`, the tenant that currently holds `new_name` gives it
-/// up and takes `<name> (<id>)` instead, as the V35 migration does for names
-/// shared by two tenants; the displaced tenant is returned. This has to happen
-/// in one transaction: a login re-creates the name it resolves on its very next
-/// request, so freeing the name and claiming it as two calls can never win the
-/// race. Nothing is merged or deleted, and the displaced tenant keeps
-/// everything it had.
+/// With `displace_existing`, the tenant that currently holds `new_name` is
+/// renamed to `<name> (<id>)` so that this one can have the name, and is
+/// returned. It keeps its pipelines, keys, members and trusts; nothing is
+/// merged or deleted.
 pub async fn rename_tenant(
     txn: &Transaction<'_>,
     tenant_id: TenantId,
     new_name: &str,
     displace_existing: bool,
 ) -> Result<Option<TenantInfo>, DBError> {
+    // Both renames run in this one transaction. A login re-creates the name it
+    // resolves on its very next request, so freeing the name and claiming it as
+    // two calls loses the race every time.
     let displaced = if displace_existing {
         displace_name_holder(txn, tenant_id, new_name).await?
     } else {
@@ -151,9 +149,9 @@ pub async fn rename_tenant(
     }
 }
 
-/// Renames whichever tenant holds `name` to `<name> (<id>)`, so that the caller
-/// can take the name. Returns the displaced tenant, or `None` when the name is
-/// free or already belongs to `keep`.
+/// Renames whichever tenant holds `name` to `<name> (<id>)`, leaving `name`
+/// for the caller to claim. Returns that tenant, or `None` when no tenant held
+/// the name or it is `keep`'s own name already.
 async fn displace_name_holder(
     txn: &Transaction<'_>,
     keep: TenantId,
diff --git a/crates/pipeline-manager/src/db/operations/user.rs b/crates/pipeline-manager/src/db/operations/user.rs
index ebebece8ac4..ec868e5fdc6 100644
--- a/crates/pipeline-manager/src/db/operations/user.rs
+++ b/crates/pipeline-manager/src/db/operations/user.rs
@@ -98,7 +98,10 @@ pub async fn upsert_member_role(
     Ok(())
 }
 
-/// Removes a user from a tenant.
+/// Removes a user from a tenant. The membership is keyed by both ids, so a
+/// caller holding one tenant can never delete a membership in another: the
+/// tenant here is the caller's acting tenant, fixed when the request was
+/// authenticated, not something the request body carries.
 pub async fn remove_member(
     txn: &Transaction<'_>,
     tenant_id: TenantId,
@@ -117,7 +120,7 @@ pub async fn remove_member(
     }
 }
 
-/// Lists the members of a tenant joined with their identity, for the admin UI.
+/// Lists the members of a tenant, each joined with the identity it belongs to.
 pub async fn list_tenant_members(
     txn: &Transaction<'_>,
     tenant_id: TenantId,
diff --git a/crates/pipeline-manager/src/db/operations/utils.rs b/crates/pipeline-manager/src/db/operations/utils.rs
index 0c2c7a824a9..7ed46c05ca2 100644
--- a/crates/pipeline-manager/src/db/operations/utils.rs
+++ b/crates/pipeline-manager/src/db/operations/utils.rs
@@ -57,8 +57,9 @@ pub(crate) fn maybe_tenant_id_foreign_key_constraint_err(
 }
 
 /// Maps a foreign-key violation on a `*user_id_fkey` constraint to a clear
-/// `UnknownUser`, so assigning a role to a nonexistent user id yields 404
-/// rather than a raw 500. Other errors pass through unchanged.
+/// `UnknownUser`, so assigning a role to a nonexistent user id names the cause
+/// instead of surfacing a raw Postgres error. Other errors pass through
+/// unchanged.
 pub(crate) fn maybe_user_id_foreign_key_constraint_err(err: DBError, user_id: UserId) -> DBError {
     if let DBError::PostgresError { error, .. } = &err {
         if let Some(db_err) = error.as_db_error() {
diff --git a/crates/pipeline-manager/src/db/storage.rs b/crates/pipeline-manager/src/db/storage.rs
index e933907b5ea..40c7f274ea4 100644
--- a/crates/pipeline-manager/src/db/storage.rs
+++ b/crates/pipeline-manager/src/db/storage.rs
@@ -95,13 +95,13 @@ pub(crate) trait Storage {
     async fn get_tenant_name(&self, tenant_id: TenantId) -> Result<String, DBError>;
 
     /// Strict resolution of a `Feldera-Tenant` selector (a tenant UUID or name)
-    /// for an owner acting cross-tenant. Never creates a tenant; errors (HTTP
-    /// 404) on miss. See
+    /// for an owner acting cross-tenant. Never creates a tenant; errors on
+    /// miss. See
     /// [`crate::db::operations::tenant::resolve_tenant_selector`].
     async fn resolve_tenant_selector(&self, selector: &str) -> Result<TenantId, DBError>;
 
-    /// Creates a tenant, failing with a conflict (HTTP 409) if the name is
-    /// already taken.
+    /// Creates a tenant, failing with `DuplicateName` if the name is already
+    /// taken.
     async fn create_tenant(
         &self,
         id: Uuid,
@@ -109,9 +109,9 @@ pub(crate) trait Storage {
         provider: &str,
     ) -> Result<TenantId, DBError>;
 
-    /// Renames a tenant, failing with a conflict (HTTP 409) if the name is
-    /// already taken, unless `displace_existing` lets it take the name from the
-    /// tenant holding it. Returns the displaced tenant, if any.
+    /// Renames a tenant, failing with `DuplicateName` if the name is already
+    /// taken, unless `displace_existing` lets it take the name from the tenant
+    /// holding it. Returns the displaced tenant, if any.
     /// See [`crate::db::operations::tenant::rename_tenant`].
     async fn rename_tenant(
         &self,
@@ -120,7 +120,7 @@ pub(crate) trait Storage {
         displace_existing: bool,
     ) -> Result<Option<TenantInfo>, DBError>;
 
-    /// Deletes a tenant, failing with a conflict (HTTP 409) unless it holds no
+    /// Deletes a tenant, failing with `TenantNotEmpty` unless it holds no
     /// pipelines, API keys or OIDC trust relationships.
     /// See [`crate::db::operations::tenant::delete_tenant`].
     async fn delete_tenant(&self, tenant_id: TenantId) -> Result<(), DBError>;
@@ -245,9 +245,9 @@ pub(crate) trait Storage {
         role: Role,
     ) -> Result<(), DBError>;
 
-    /// Cheap indexed check that an issuer is named by at least one trust
-    /// relationship. Called before any OIDC discovery/JWKS fetch so an
-    /// unregistered issuer never triggers an outbound request (SSRF/DoS gate).
+    /// Whether at least one trust relationship names this issuer. Called before
+    /// any OIDC discovery/JWKS fetch so an unregistered issuer never triggers an
+    /// outbound request (SSRF/DoS gate).
     async fn is_trusted_issuer(&self, issuer: &str) -> Result<bool, DBError>;
 
     /// Every tenant that trusts a federated token, with the token's role in each
diff --git a/crates/pipeline-manager/src/db/test.rs b/crates/pipeline-manager/src/db/test.rs
index 27511eee8e5..4e2d7badbef 100644
--- a/crates/pipeline-manager/src/db/test.rs
+++ b/crates/pipeline-manager/src/db/test.rs
@@ -300,10 +300,11 @@ fn map_val_to_limited_pipeline_name(val: PipelineNamePropVal) -> String {
     }
 }
 
-/// Generates a limited OIDC trust name (1/4 is invalid).
+/// Generates `trust-1`, `trust-2`, `trust-3`, or the empty string, which no
+/// trust may be named, so a quarter of the generated names are rejected.
 fn limited_oidc_trust_name() -> impl Strategy<Value = String> {
     any::<u8>().prop_map(|val| match val % 4 {
-        0 => "".to_string(), // An invalid trust name
+        0 => "".to_string(),
         n => format!("trust-{n}"),
     })
 }
@@ -1034,8 +1035,8 @@ async fn tenant_survives_a_changed_issuer() {
     );
 }
 
-/// A tenant no login reaches is recovered by taking the name logins do resolve,
-/// even though every request re-creates that name.
+/// A tenant that no login resolves to is recovered by giving it the name that
+/// logins do resolve, even though every request re-creates that name.
 #[tokio::test]
 async fn renaming_takes_a_name_that_logins_keep_recreating() {
     let handle = test_setup().await;
@@ -5214,8 +5215,9 @@ fn db_impl_behaves_like_model() {
 /// Compares the OIDC trust and tenant-membership operations against the model.
 ///
 /// Kept separate from `db_impl_behaves_like_model` rather than folded into
-/// `StorageAction`: that enum and the future its dispatch builds are already
-/// near the test thread's stack limit, and adding these actions overflowed it.
+/// `StorageAction`. Adding these actions to that enum overflows the test
+/// thread's stack: its dispatch builds one future holding every arm, which is
+/// already close to the limit, and boxing the arms did not bring it back down.
 #[test]
 #[allow(clippy::field_reassign_with_default)]
 fn rbac_db_impl_behaves_like_model() {
diff --git a/crates/pipeline-manager/src/db/types/oidc_trust.rs b/crates/pipeline-manager/src/db/types/oidc_trust.rs
index 33e8d7b5d6b..b2b433b80ef 100644
--- a/crates/pipeline-manager/src/db/types/oidc_trust.rs
+++ b/crates/pipeline-manager/src/db/types/oidc_trust.rs
@@ -44,12 +44,13 @@ pub struct OidcTrustDescr {
 /// any sequence of characters and all other characters must match exactly.
 ///
 /// The `*`-separated literals must occur in order, with the first anchored at
-/// the start of `value` and the last at its end. Matching each middle literal at
-/// its earliest position is optimal here because the trailing literal is
-/// anchored separately, so no backtracking is needed. A plain matcher rather
-/// than a regex: patterns come from user-registered trust relationships, and
-/// this way there is nothing to escape and no pathological input to guard.
+/// the start of `value` and the last at its end.
 pub fn claim_matches(pattern: &str, value: &str) -> bool {
+    // A plain matcher rather than a regex: patterns come from user-registered
+    // trust relationships, so this way there is nothing to escape and no
+    // pathological input to guard against. Taking each middle literal at its
+    // earliest position needs no backtracking, because the trailing literal is
+    // anchored separately.
     let mut literals = pattern.split('*');
     // `split` always yields at least one item.
     let first = literals.next().unwrap_or_default();
diff --git a/js-packages/web-console/src/lib/services/manager/sdk.gen.ts b/js-packages/web-console/src/lib/services/manager/sdk.gen.ts
index b2ae2b34c01..75270517445 100644
--- a/js-packages/web-console/src/lib/services/manager/sdk.gen.ts
+++ b/js-packages/web-console/src/lib/services/manager/sdk.gen.ts
@@ -571,6 +571,10 @@ export const deleteOidcTrust = <ThrowOnError extends boolean = true>(
  * Get OIDC Trust
  *
  * Required role: `admin` or higher.
+ *
+ * Retrieve one trust relationship by `name`, the name it was created under,
+ * which is unique within the tenant (or, with `platform`, across the
+ * platform-wide owner trusts).
  */
 export const getOidcTrust = <ThrowOnError extends boolean = true>(
   options: Options<GetOidcTrustData, ThrowOnError>
@@ -2051,18 +2055,10 @@ export const deleteTenant = <ThrowOnError extends boolean = true>(
  * and OIDC trust relationships all reference the tenant by its identifier and
  * are unaffected.
  *
- * A login resolves its tenant by name, so renaming decides which tenant those
- * users reach. Two consequences follow. Renaming a tenant away from a name the
- * identity provider still asserts sends its users to a new, empty tenant on
- * their next request, which re-creates the name. And a tenant that no login
- * reaches, such as `default` after authentication is switched on, is recovered
- * by giving it the name logins do resolve.
- *
- * Recovery normally wants a name that is already taken, by the tenant the
- * first login created. Set `displace_existing` to take it: that tenant is
- * renamed to `<name> (<id>)` in the same transaction and keeps everything it
- * had. One step is what makes recovery possible at all, since freeing the name
- * and claiming it as two calls loses to the next request re-creating it.
+ * Set `displace_existing` to replace a tenant atomically with one that's
+ * currently in use. This renames the conflicting tenant to `<name> (<id>)` in
+ * the same transaction, with everything it had. Two calls potentially lose to
+ * another user request, which could re-create the name in between.
  */
 export const patchTenant = <ThrowOnError extends boolean = true>(
   options: Options<PatchTenantData, ThrowOnError>
diff --git a/openapi.json b/openapi.json
index 09b55f06870..3a6f02178dc 100644
--- a/openapi.json
+++ b/openapi.json
@@ -688,7 +688,7 @@
           "Platform"
         ],
         "summary": "Get OIDC Trust",
-        "description": "Required role: `admin` or higher.",
+        "description": "Required role: `admin` or higher.\n\nRetrieve one trust relationship by `name`, the name it was created under,\nwhich is unique within the tenant (or, with `platform`, across the\nplatform-wide owner trusts).",
         "operationId": "get_oidc_trust",
         "parameters": [
           {
@@ -7809,7 +7809,7 @@
           "Platform"
         ],
         "summary": "Rename Tenant",
-        "description": "Required role: `owner`.\n\nChange a tenant's name. Only the name changes: pipelines, API keys, members\nand OIDC trust relationships all reference the tenant by its identifier and\nare unaffected.\n\nA login resolves its tenant by name, so renaming decides which tenant those\nusers reach. Two consequences follow. Renaming a tenant away from a name the\nidentity provider still asserts sends its users to a new, empty tenant on\ntheir next request, which re-creates the name. And a tenant that no login\nreaches, such as `default` after authentication is switched on, is recovered\nby giving it the name logins do resolve.\n\nRecovery normally wants a name that is already taken, by the tenant the\nfirst login created. Set `displace_existing` to take it: that tenant is\nrenamed to `<name> (<id>)` in the same transaction and keeps everything it\nhad. One step is what makes recovery possible at all, since freeing the name\nand claiming it as two calls loses to the next request re-creating it.",
+        "description": "Required role: `owner`.\n\nChange a tenant's name. Only the name changes: pipelines, API keys, members\nand OIDC trust relationships all reference the tenant by its identifier and\nare unaffected.\n\nSet `displace_existing` to replace a tenant atomically with one that's\ncurrently in use. This renames the conflicting tenant to `<name> (<id>)` in\nthe same transaction, with everything it had. Two calls potentially lose to\nanother user request, which could re-create the name in between.",
         "operationId": "patch_tenant",
         "parameters": [
           {

From 64994a8d049efcf633548efc3ee0f6ccd76ec4a9 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Mon, 27 Jul 2026 22:28:38 -0700
Subject: [PATCH 32/55] [pipeline-manager] Make the owner role deploy-time
 configuration only

An owner was configurable at launch as a user (`--owners`) but mintable at
runtime as a workload: any owner could register an OIDC trust carrying `owner`.
Owner now comes from configuration in both cases. `--owner-trusts`
(`FELDERA_OWNER_TRUSTS`, Helm `authorization.ownerTrusts`) takes a JSON array of
`{issuer, subject, audience?}`, matched the same way a registered trust is, and
no request can grant `owner` any more.

That removes the awkward half of the trust schema. A trust row always belongs to
a tenant, so `tenant_id` is `NOT NULL`, the role stops at `admin`, and the
`oidc_trust_owner_is_platform` CHECK and the platform-name partial index are
gone, along with the `platform` query parameter and the `Option<TenantId>` scope
that ran through the database layer.

An owner that names no tenant now acts in the `default` tenant, as a configured
owner already did, rather than being refused. Without this an owner declared
only as a trust could not reach the tenant routes on a deployment that has no
tenants: naming no tenant failed, and naming the one about to be created failed
too. Automation can now create the first tenant with no login having happened,
which is what prompted this.

`GET /v0/config/owners` reports the configured owners, owner-only and read-only,
and the web console's admin page shows them in place of the owner-trust manager
it used to carry.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 crates/fda/src/cli.rs                         |   7 +-
 crates/fda/src/main.rs                        |   7 +-
 .../pipeline-manager/migrations/V35__rbac.sql |  22 +--
 .../src/api/endpoints/config.rs               |  57 ++++++
 .../src/api/endpoints/oidc_trust.rs           | 114 ++++--------
 crates/pipeline-manager/src/api/main.rs       |   4 +
 crates/pipeline-manager/src/api/rbac.rs       |   1 +
 crates/pipeline-manager/src/auth.rs           |  48 ++---
 crates/pipeline-manager/src/config.rs         | 166 +++++++++++++++++-
 crates/pipeline-manager/src/db/error.rs       |  12 +-
 .../src/db/operations/oidc_trust.rs           | 125 ++++---------
 crates/pipeline-manager/src/db/storage.rs     |  17 +-
 .../src/db/storage_postgres.rs                |  17 +-
 crates/pipeline-manager/src/db/test.rs        | 148 +++++-----------
 .../enterprise/authentication/index.mdx       |   8 +
 .../enterprise/authentication/roles.md        |  57 +++---
 .../src/lib/components/admin/AdminPage.svelte | 106 ++++-------
 .../oidcTrust/NewOidcTrustForm.svelte         |  50 ++----
 .../src/lib/services/manager/index.ts         |   8 +
 .../src/lib/services/manager/sdk.gen.ts       |  28 +++
 .../src/lib/services/manager/types.gen.ts     |  85 ++++++---
 .../src/lib/services/pipelineManager.ts       |  34 ++--
 openapi.json                                  | 128 ++++++++++----
 python/feldera/rest/feldera_client.py         |   8 +-
 24 files changed, 685 insertions(+), 572 deletions(-)

diff --git a/crates/fda/src/cli.rs b/crates/fda/src/cli.rs
index d763f505680..dae2480c669 100644
--- a/crates/fda/src/cli.rs
+++ b/crates/fda/src/cli.rs
@@ -319,10 +319,8 @@ pub enum OidcTrustActions {
         /// Shown when listing trust relationships.
         #[arg(long)]
         description: Option<String>,
-        /// Role granted to a matching token: `read` (default), `write`,
-        /// `admin`, or `owner`. Capped at the caller's role. `owner` requires a
-        /// platform owner and registers a platform-wide trust that belongs to no
-        /// tenant; the acting tenant then comes from the `Feldera-Tenant` header.
+        /// Role granted to a matching token: `read` (default), `write` or
+        /// `admin`, capped at the caller's role.
         #[arg(long)]
         role: Option<TrustRole>,
     },
@@ -340,7 +338,6 @@ pub enum TrustRole {
     Read,
     Write,
     Admin,
-    Owner,
 }
 
 #[derive(Subcommand)]
diff --git a/crates/fda/src/main.rs b/crates/fda/src/main.rs
index 4a73ddbe5e5..0268a903e07 100644
--- a/crates/fda/src/main.rs
+++ b/crates/fda/src/main.rs
@@ -450,10 +450,9 @@ async fn oidc_trust_commands(format: OutputFormat, action: OidcTrustActions, cli
         } => {
             debug!("Creating OIDC trust relationship: {name}");
             let role = role.map(|r| match r {
-                TrustRole::Read => feldera_rest_api::types::Role::Read,
-                TrustRole::Write => feldera_rest_api::types::Role::Write,
-                TrustRole::Admin => feldera_rest_api::types::Role::Admin,
-                TrustRole::Owner => feldera_rest_api::types::Role::Owner,
+                TrustRole::Read => feldera_rest_api::types::MemberRole::Read,
+                TrustRole::Write => feldera_rest_api::types::MemberRole::Write,
+                TrustRole::Admin => feldera_rest_api::types::MemberRole::Admin,
             });
             let body = NewOidcTrustRequest::builder()
                 .name(name.clone())
diff --git a/crates/pipeline-manager/migrations/V35__rbac.sql b/crates/pipeline-manager/migrations/V35__rbac.sql
index ded47f91004..d89c752f1b2 100644
--- a/crates/pipeline-manager/migrations/V35__rbac.sql
+++ b/crates/pipeline-manager/migrations/V35__rbac.sql
@@ -39,34 +39,22 @@ ALTER TABLE api_key DROP COLUMN scopes;
 -- A trust registers an issuer plus subject/audience match patterns; an incoming
 -- JWT from that issuer whose claims satisfy the patterns is authorized with the
 -- recorded role, like a signature-verified API key. `role` is capped at the
--- creator's role at write time.
---
--- Scope follows the role. read/write/admin trusts are tenant-scoped: `tenant_id`
--- names the tenant they authorize into. An `owner` trust is platform-wide and
--- belongs to no tenant, so `tenant_id` is NULL; the acting tenant then comes
--- from the Feldera-Tenant header at request time.
+-- creator's role at write time, and at 'admin' by the CHECK: 'owner' is
+-- platform-wide and comes from configuration (`--owner-trusts`), never from a
+-- row here, so no request can mint an owner.
 CREATE TABLE IF NOT EXISTS oidc_trust_relationship (
     id uuid PRIMARY KEY,
-    tenant_id uuid,
+    tenant_id uuid NOT NULL,
     name varchar NOT NULL,
     description varchar,
     issuer varchar NOT NULL,
     subject varchar NOT NULL,
     audience varchar,
-    role varchar NOT NULL DEFAULT 'read' CHECK (role IN ('read', 'write', 'admin', 'owner')),
-    -- Scope and role are inseparable: tenant_id is NULL if and only if the
-    -- role is owner.
-    CONSTRAINT oidc_trust_owner_is_platform CHECK ((tenant_id IS NULL) = (role = 'owner')),
+    role varchar NOT NULL DEFAULT 'read' CHECK (role IN ('read', 'write', 'admin')),
     CONSTRAINT unique_oidc_trust_name UNIQUE (tenant_id, name),
     FOREIGN KEY (tenant_id) REFERENCES tenant(id) ON DELETE CASCADE
 );
 
--- unique_oidc_trust_name bounds tenant-scoped names per tenant, but a UNIQUE
--- constraint treats NULL tenant_ids as distinct and so does not bound owner
--- trusts. Name owner trusts uniquely across the platform with a partial index.
-CREATE UNIQUE INDEX IF NOT EXISTS idx_oidc_owner_trust_name
-    ON oidc_trust_relationship (name) WHERE tenant_id IS NULL;
-
 -- The auth hot path resolves a federated token by its issuer, so index it.
 CREATE INDEX IF NOT EXISTS idx_oidc_trust_issuer ON oidc_trust_relationship (issuer);
 
diff --git a/crates/pipeline-manager/src/api/endpoints/config.rs b/crates/pipeline-manager/src/api/endpoints/config.rs
index b1876571a4d..4d82cb40d87 100644
--- a/crates/pipeline-manager/src/api/endpoints/config.rs
+++ b/crates/pipeline-manager/src/api/endpoints/config.rs
@@ -274,5 +274,62 @@ pub(crate) async fn get_config_session(
     Ok(HttpResponse::Ok().json(session_info))
 }
 
+/// The platform owners configured at deploy time.
+#[derive(Serialize, ToSchema)]
+pub(crate) struct ConfiguredOwners {
+    /// Identities granted `owner`, as configured through
+    /// `authorization.owners` / `FELDERA_OWNERS`. Each entry is a
+    /// provider-verified email, a bare OIDC subject, or an issuer and subject
+    /// separated by a space.
+    pub owners: Vec<String>,
+    /// Workload identities granted `owner`, as configured through
+    /// `authorization.ownerTrusts` / `FELDERA_OWNER_TRUSTS`.
+    pub owner_trusts: Vec<ConfiguredOwnerTrust>,
+}
+
+/// A workload identity granted `owner` by configuration.
+#[derive(Serialize, ToSchema)]
+pub(crate) struct ConfiguredOwnerTrust {
+    pub issuer: String,
+    pub subject: String,
+    pub audience: Option<String>,
+}
+
+/// Get Configured Owners
+///
+/// List the identities that hold the platform-wide `owner` role.
+///
+/// Owner comes from deploy-time configuration and cannot be granted through the
+/// API, so this list is read-only: changing it means changing the deployment.
+#[utoipa::path(
+    context_path = "/v0",
+    security(("JSON web token (JWT) or API key" = [])),
+    responses(
+        (status = OK, description = "Configured owners retrieved", body = ConfiguredOwners),
+        (status = FORBIDDEN, description = "Caller's role is below the required role", body = ErrorResponse),
+        (status = INTERNAL_SERVER_ERROR, body = ErrorResponse)
+    ),
+    tag = "Platform"
+)]
+#[get("/config/owners")]
+pub(crate) async fn get_config_owners(
+    state: WebData<ServerState>,
+) -> Result<HttpResponse, ManagerError> {
+    let config = &state.config;
+    Ok(HttpResponse::Ok().json(&ConfiguredOwners {
+        owners: config.owners.clone(),
+        owner_trusts: config
+            .owner_trusts
+            .0
+            .iter()
+            .map(|trust| ConfiguredOwnerTrust {
+                issuer: trust.issuer.clone(),
+                subject: trust.subject.clone(),
+                audience: trust.audience.clone(),
+            })
+            .collect(),
+    }))
+}
+
 #[derive(Serialize, ToSchema)]
 pub(crate) struct EmptyResponse {}
diff --git a/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs b/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
index 17fb4bb06d6..82b2c850cb1 100644
--- a/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
+++ b/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
@@ -1,17 +1,21 @@
-// OIDC workload identity trust relationships.
-//
-// A trust relationship lets a tenant authorize JWT-bearing requests from an
-// external OIDC issuer (e.g. GitHub Actions, AWS, GCP, Auth0) without
-// provisioning a long-lived Feldera API key. The issuer is verified via OIDC
-// discovery + JWKS; the `subject` and (optional) `audience` claims are matched
-// against patterns recorded on the trust relationship (`*` is a wildcard).
+//! OIDC workload identity trust relationships.
+//!
+//! A trust relationship lets a tenant authorize JWT-bearing requests from an
+//! external OIDC issuer (e.g. GitHub Actions, AWS, GCP, Auth0) without
+//! provisioning a long-lived Feldera API key. The issuer is verified via OIDC
+//! discovery + JWKS; the `subject` and (optional) `audience` claims are matched
+//! against patterns recorded on the trust relationship (`*` is a wildcard).
+//!
+//! Every trust here belongs to the acting tenant and grants at most `admin`. The
+//! platform-wide `owner` role is configuration only (`--owner-trusts`), so no
+//! request can mint an owner.
 use crate::api::main::ServerState;
 use crate::api::util::parse_url_parameter;
 use crate::auth::AuthenticatedPrincipal;
 use crate::db::error::DBError;
 use crate::db::storage::Storage;
 use crate::db::types::oidc_trust::OidcTrustId;
-use crate::db::types::role::Role;
+use crate::db::types::role::{MemberRole, Role};
 use crate::db::types::tenant::TenantId;
 use crate::error::ManagerError;
 use actix_web::{
@@ -23,41 +27,9 @@ use actix_web::{
 };
 use serde::{Deserialize, Serialize};
 use tracing::info;
-use utoipa::{IntoParams, ToSchema};
+use utoipa::ToSchema;
 use uuid::Uuid;
 
-/// Selects which trusts an operation targets.
-#[derive(Debug, Default, Deserialize, IntoParams)]
-pub(crate) struct TrustScope {
-    /// Select the platform-wide owner trusts, which belong to no tenant,
-    /// instead of the trusts scoped to the caller's tenant. Owner-only.
-    #[serde(default)]
-    platform: bool,
-}
-
-/// The tenant a trust operation targets, mirroring the `tenant_id` column the
-/// trust is stored in: `Some(tenant)` for a tenant-scoped trust, and `None` for
-/// the platform-wide owner trusts, which belong to no tenant and which the
-/// schema stores with `tenant_id IS NULL`. Only an owner may target those.
-fn trust_scope(
-    scope: &TrustScope,
-    tenant_id: TenantId,
-    role: Role,
-) -> Result<Option<TenantId>, ManagerError> {
-    if scope.platform {
-        if role != Role::Owner {
-            return Err(DBError::InsufficientPermissions {
-                required: Role::Owner,
-                actual: role,
-            }
-            .into());
-        }
-        Ok(None)
-    } else {
-        Ok(Some(tenant_id))
-    }
-}
-
 /// Request to create a new OIDC trust relationship.
 #[derive(Debug, Deserialize, ToSchema)]
 pub(crate) struct NewOidcTrustRequest {
@@ -85,11 +57,10 @@ pub(crate) struct NewOidcTrustRequest {
     #[serde(default)]
     pub audience: Option<String>,
 
-    /// Role granted to a token that satisfies this trust. Capped at the
-    /// caller's own role. `owner` may be set only by an owner. Defaults to
-    /// `read`.
+    /// Role granted to a token that satisfies this trust: `read`, `write`, or
+    /// `admin`, capped at the caller's own role. Defaults to `read`.
     #[serde(default)]
-    pub role: Option<Role>,
+    pub role: Option<MemberRole>,
 }
 
 /// Response to a successful create.
@@ -104,10 +75,9 @@ pub(crate) struct NewOidcTrustResponse {
 #[utoipa::path(
     context_path = "/v0",
     security(("JSON web token (JWT) or API key" = [])),
-    params(TrustScope),
     responses(
         (status = OK, description = "Trust relationships retrieved", body = [OidcTrustDescr]),
-        (status = FORBIDDEN, description = "Caller's role is below the required role, or `platform` was set by a non-owner", body = ErrorResponse),
+        (status = FORBIDDEN, description = "Caller's role is below the required role", body = ErrorResponse),
         (status = INTERNAL_SERVER_ERROR, body = ErrorResponse)
     ),
     tag = "Platform"
@@ -116,11 +86,8 @@ pub(crate) struct NewOidcTrustResponse {
 pub(crate) async fn list_oidc_trust(
     state: WebData<ServerState>,
     tenant_id: ReqData<TenantId>,
-    principal: ReqData<AuthenticatedPrincipal>,
-    scope: web::Query<TrustScope>,
 ) -> Result<HttpResponse, ManagerError> {
-    let scope = trust_scope(&scope, *tenant_id, principal.role)?;
-    let items = state.db.lock().await.list_oidc_trust(scope).await?;
+    let items = state.db.lock().await.list_oidc_trust(*tenant_id).await?;
     Ok(HttpResponse::Ok()
         .insert_header(CacheControl(vec![CacheDirective::NoCache]))
         .json(&items))
@@ -134,10 +101,10 @@ pub(crate) async fn list_oidc_trust(
 #[utoipa::path(
     context_path = "/v0",
     security(("JSON web token (JWT) or API key" = [])),
-    params(("name" = String, Path, description = "Trust relationship name"), TrustScope),
+    params(("name" = String, Path, description = "Trust relationship name")),
     responses(
         (status = OK, description = "Trust relationship retrieved", body = OidcTrustDescr),
-        (status = FORBIDDEN, description = "Caller's role is below the required role, or `platform` was set by a non-owner", body = ErrorResponse),
+        (status = FORBIDDEN, description = "Caller's role is below the required role", body = ErrorResponse),
         (status = NOT_FOUND, description = "No relationship with that name", body = ErrorResponse),
         (status = INTERNAL_SERVER_ERROR, body = ErrorResponse)
     ),
@@ -147,13 +114,15 @@ pub(crate) async fn list_oidc_trust(
 pub(crate) async fn get_oidc_trust(
     state: WebData<ServerState>,
     tenant_id: ReqData<TenantId>,
-    principal: ReqData<AuthenticatedPrincipal>,
-    scope: web::Query<TrustScope>,
     req: HttpRequest,
 ) -> Result<HttpResponse, ManagerError> {
     let name = parse_url_parameter(&req, "name")?;
-    let scope = trust_scope(&scope, *tenant_id, principal.role)?;
-    let item = state.db.lock().await.get_oidc_trust(scope, &name).await?;
+    let item = state
+        .db
+        .lock()
+        .await
+        .get_oidc_trust(*tenant_id, &name)
+        .await?;
     Ok(HttpResponse::Ok()
         .insert_header(CacheControl(vec![CacheDirective::NoCache]))
         .json(&item))
@@ -183,9 +152,8 @@ pub(crate) async fn post_oidc_trust(
     let new_id = Uuid::now_v7();
     let body = body.into_inner();
 
-    // Mint cap: the granted role may not exceed the caller's role. An owner
-    // trust may be created only by an owner.
-    let requested = body.role.unwrap_or(Role::Read);
+    // The type admits no `owner`, so only the cap against the caller is left.
+    let requested = body.role.map_or(Role::Read, MemberRole::role);
     if requested > principal.role {
         return Err(DBError::RoleExceedsCreator {
             requested,
@@ -194,15 +162,6 @@ pub(crate) async fn post_oidc_trust(
         .into());
     }
 
-    // Scope follows the role: an owner trust is platform-wide (no tenant), any
-    // other role is scoped to the acting tenant. Tenant selection at auth time
-    // comes from the Feldera-Tenant header.
-    let scope = if requested == Role::Owner {
-        None
-    } else {
-        Some(*tenant_id)
-    };
-
     // The remaining fields are validated in the database operation, which is
     // the one place every caller passes through: the name against the
     // permitted character set, and the issuer and subject against being empty.
@@ -211,7 +170,7 @@ pub(crate) async fn post_oidc_trust(
         .lock()
         .await
         .create_oidc_trust(
-            scope,
+            *tenant_id,
             new_id,
             &body.name,
             body.description.as_deref(),
@@ -222,8 +181,8 @@ pub(crate) async fn post_oidc_trust(
         )
         .await?;
     info!(
-        "Created OIDC trust '{}' (scope: {:?}, issuer: {})",
-        body.name, scope, body.issuer
+        "Created OIDC trust '{}' (tenant: {}, issuer: {})",
+        body.name, *tenant_id, body.issuer
     );
     Ok(HttpResponse::Created()
         .insert_header(CacheControl(vec![CacheDirective::NoCache]))
@@ -237,10 +196,10 @@ pub(crate) async fn post_oidc_trust(
 #[utoipa::path(
     context_path = "/v0",
     security(("JSON web token (JWT) or API key" = [])),
-    params(("name" = String, Path, description = "Trust relationship name"), TrustScope),
+    params(("name" = String, Path, description = "Trust relationship name")),
     responses(
         (status = OK, description = "Trust relationship deleted"),
-        (status = FORBIDDEN, description = "Caller's role is below the required role, or `platform` was set by a non-owner", body = ErrorResponse),
+        (status = FORBIDDEN, description = "Caller's role is below the required role", body = ErrorResponse),
         (status = NOT_FOUND, description = "No relationship with that name", body = ErrorResponse),
         (status = INTERNAL_SERVER_ERROR, body = ErrorResponse)
     ),
@@ -250,18 +209,15 @@ pub(crate) async fn post_oidc_trust(
 pub(crate) async fn delete_oidc_trust(
     state: WebData<ServerState>,
     tenant_id: ReqData<TenantId>,
-    principal: ReqData<AuthenticatedPrincipal>,
-    scope: web::Query<TrustScope>,
     req: HttpRequest,
 ) -> Result<HttpResponse, ManagerError> {
     let name = parse_url_parameter(&req, "name")?;
-    let scope = trust_scope(&scope, *tenant_id, principal.role)?;
     state
         .db
         .lock()
         .await
-        .delete_oidc_trust(scope, &name)
+        .delete_oidc_trust(*tenant_id, &name)
         .await?;
-    info!("Deleted OIDC trust '{name}' (scope: {scope:?})");
+    info!("Deleted OIDC trust '{name}' (tenant: {})", *tenant_id);
     Ok(HttpResponse::Ok().finish())
 }
diff --git a/crates/pipeline-manager/src/api/main.rs b/crates/pipeline-manager/src/api/main.rs
index 79f60cc8cb4..87b737544ba 100644
--- a/crates/pipeline-manager/src/api/main.rs
+++ b/crates/pipeline-manager/src/api/main.rs
@@ -253,6 +253,7 @@ It contains the following fields:
         endpoints::config::get_config_authentication,
         endpoints::config::get_config_demos,
         endpoints::config::get_config_session,
+        endpoints::config::get_config_owners,
         endpoints::config::get_config,
 
         // Metrics
@@ -287,6 +288,8 @@ It contains the following fields:
         crate::api::endpoints::config::Configuration,
         crate::api::endpoints::config::BuildInformation,
         crate::api::endpoints::config::SessionInfo,
+        crate::api::endpoints::config::ConfiguredOwners,
+        crate::api::endpoints::config::ConfiguredOwnerTrust,
 
         // Pipeline
         crate::db::types::pipeline::PipelineId,
@@ -765,6 +768,7 @@ fn api_scope() -> Scope {
         .service(endpoints::config::get_config)
         .service(endpoints::config::get_config_demos)
         .service(endpoints::config::get_config_session)
+        .service(endpoints::config::get_config_owners)
         // Metrics of all pipelines belonging to this tenant
         .service(endpoints::metrics::get_metrics)
         // Cluster health check
diff --git a/crates/pipeline-manager/src/api/rbac.rs b/crates/pipeline-manager/src/api/rbac.rs
index 0af7dcb7cda..30e28e5a184 100644
--- a/crates/pipeline-manager/src/api/rbac.rs
+++ b/crates/pipeline-manager/src/api/rbac.rs
@@ -34,6 +34,7 @@ static ROUTE_MIN_ROLE: &[(&str, &str, Role)] = &[
     ("GET", "/v0/config", Role::Read), // get_config
     ("GET", "/v0/config/demos", Role::Read), // get_config_demos
     ("GET", "/v0/config/session", Role::Read), // get_config_session
+    ("GET", "/v0/config/owners", Role::Owner), // get_config_owners
     ("GET", "/v0/metrics", Role::Read), // get_metrics
     ("GET", "/v0/oidc_trust", Role::Admin), // list_oidc_trust
     ("POST", "/v0/oidc_trust", Role::Admin), // post_oidc_trust
diff --git a/crates/pipeline-manager/src/auth.rs b/crates/pipeline-manager/src/auth.rs
index 10773edbcdf..e6fc906f752 100644
--- a/crates/pipeline-manager/src/auth.rs
+++ b/crates/pipeline-manager/src/auth.rs
@@ -315,8 +315,13 @@ async fn oidc_trust_auth(
     let state = req.app_data::<Data<ServerState>>().unwrap().clone();
 
     // SSRF/DoS gate: only fetch discovery/JWKS for an issuer that at least one
-    // trust relationship names.
-    match state.db.lock().await.is_trusted_issuer(&iss).await {
+    // trust names, whether configured at launch or registered in a tenant.
+    let trusted_issuer = if state.config.owner_trusts.names_issuer(&iss) {
+        Ok(true)
+    } else {
+        state.db.lock().await.is_trusted_issuer(&iss).await
+    };
+    match trusted_issuer {
         Ok(true) => {}
         Ok(false) => {
             debug!("Federated token from unregistered issuer '{iss}' rejected");
@@ -358,6 +363,10 @@ async fn oidc_trust_auth(
     }
 
     let audiences = audiences_from_claim(token_data.claims.aud.as_ref());
+    let owner_trust = state
+        .config
+        .owner_trusts
+        .admits(&iss, &token_data.claims.sub, &audiences);
     let matches = {
         let db = state.db.lock().await;
         db.match_oidc_trust(&iss, &token_data.claims.sub, &audiences)
@@ -370,7 +379,7 @@ async fn oidc_trust_auth(
             return unauthorized(format!("Database error: {e}"), req);
         }
     };
-    if matches.is_empty() {
+    if matches.is_empty() && !owner_trust {
         let ip = req
             .peer_addr()
             .map(|a| a.ip().to_string())
@@ -396,22 +405,19 @@ async fn oidc_trust_auth(
             .map(str::to_string)
     };
 
-    // An owner trust is platform-wide with no tenant of its own, so the acting
-    // tenant must be named explicitly. It wins over any tenant-scoped match.
-    if matches
-        .iter()
-        .any(|(t, r)| t.is_none() && *r == Role::Owner)
-    {
-        let Some(selector) = header_tenant(&req) else {
-            return db_err(DBError::OwnerTrustNeedsTenant, req);
-        };
-        let resolved = {
+    // An owner belongs to no tenant of its own, so it acts wherever the
+    // Feldera-Tenant header points, and in the default tenant without one, as a
+    // configured owner does. That is what lets an owner call the platform-wide
+    // tenant routes on a deployment that has no tenants yet. Owner wins over any
+    // tenant-scoped match.
+    if owner_trust {
+        let acting = {
             let db = state.db.lock().await;
-            db.resolve_tenant_selector(&selector).await
+            resolve_owner_acting_tenant(&db, req.headers(), DEFAULT_TENANT_ID).await
         };
-        let acting = match resolved {
+        let acting = match acting {
             Ok(t) => t,
-            Err(e) => return db_err(e, req),
+            Err(e) => return Err((e, req)),
         };
         AuthenticatedPrincipal {
             acting_tenant: acting,
@@ -422,12 +428,9 @@ async fn oidc_trust_auth(
         return Ok(req);
     }
 
-    // Tenant-scoped matches (each carries a tenant). One is unambiguous; several
-    // require the Feldera-Tenant header to name one of them.
-    let tenant_matches: Vec<(TenantId, Role)> = matches
-        .into_iter()
-        .filter_map(|(t, r)| t.map(|t| (t, r)))
-        .collect();
+    // Tenant-scoped matches. One is unambiguous; several require the
+    // Feldera-Tenant header to name one of them.
+    let tenant_matches: Vec<(TenantId, Role)> = matches;
     let (acting_tenant, role) = if tenant_matches.len() == 1 {
         tenant_matches[0]
     } else {
@@ -1545,6 +1548,7 @@ mod test {
             issuer_tenant: false,
             auth_audience: "feldera-api".to_string(),
             owners: vec![],
+            owner_trusts: crate::config::OwnerTrusts::default(),
             default_role: Role::Read,
             first_user_role: Role::Admin,
         };
diff --git a/crates/pipeline-manager/src/config.rs b/crates/pipeline-manager/src/config.rs
index 60cfe515ec2..b9185cf9f3c 100644
--- a/crates/pipeline-manager/src/config.rs
+++ b/crates/pipeline-manager/src/config.rs
@@ -1,3 +1,4 @@
+use crate::db::types::oidc_trust::claim_matches;
 use crate::db::types::program::CompilationProfile;
 use crate::db::types::role::Role;
 use crate::db::types::version::Version;
@@ -20,7 +21,7 @@ use reqwest::Certificate;
 use rustls::pki_types::pem::PemObject;
 use rustls::pki_types::{CertificateDer, PrivateKeyDer};
 use rustls::{ClientConfig, RootCertStore};
-use serde::Deserialize;
+use serde::{Deserialize, Serialize};
 use std::str::FromStr;
 use std::sync::Arc;
 use std::{
@@ -991,6 +992,21 @@ pub struct ApiServerConfig {
     #[arg(long, value_delimiter = ',', env = "FELDERA_OWNERS")]
     pub owners: Vec<String>,
 
+    /// OIDC trust relationships granting the platform-wide `owner` role, as a
+    /// JSON array. A token from `issuer` whose `sub` matches `subject`, and
+    /// whose `aud` matches `audience` when one is given, acts as an owner. `*`
+    /// is a wildcard in `subject` and `audience`.
+    ///
+    /// `FELDERA_OWNER_TRUSTS='[{"issuer": "https://accounts.google.com",
+    /// "subject": "1234567890", "audience": "my-client-id"}]'`
+    ///
+    /// Owner is configuration only, like `--owners`: it is never granted at
+    /// runtime, so no request can mint an owner. Trusts registered through the
+    /// API grant `read`, `write` or `admin` within one tenant.
+    #[serde(default)]
+    #[arg(long, default_value = "[]", env = "FELDERA_OWNER_TRUSTS")]
+    pub owner_trusts: OwnerTrusts,
+
     /// Role assigned to an authenticated user who has no explicit tenant
     /// membership yet. Must be `read` or `write`. Default: `read`.
     #[serde(default = "default_default_role")]
@@ -1007,6 +1023,78 @@ pub struct ApiServerConfig {
     pub first_user_role: Role,
 }
 
+/// A trust relationship granting the platform-wide `owner` role, declared at
+/// launch through `--owner-trusts` / `FELDERA_OWNER_TRUSTS`.
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+pub struct OwnerTrust {
+    /// Issuer URL, matched against the token's `iss` claim exactly.
+    pub issuer: String,
+    /// Pattern matched against the token's `sub` claim. `*` matches any
+    /// sequence of characters.
+    pub subject: String,
+    /// Pattern matched against the token's `aud` claim. Omit to accept any
+    /// audience.
+    #[serde(default)]
+    pub audience: Option<String>,
+}
+
+impl OwnerTrust {
+    /// Whether this trust admits the token described by these claims. The
+    /// issuer must match exactly; the subject and, when the trust sets one, the
+    /// audience match as claim patterns, where `*` stands for any sequence. A
+    /// trust that sets no audience accepts any, since some issuers put nothing
+    /// useful in the audience of a workload token.
+    pub fn admits(&self, issuer: &str, subject: &str, audiences: &[String]) -> bool {
+        self.issuer == issuer
+            && claim_matches(&self.subject, subject)
+            && match &self.audience {
+                None => true,
+                Some(pattern) => audiences.iter().any(|aud| claim_matches(pattern, aud)),
+            }
+    }
+}
+
+/// The configured owner trusts. A newtype so that the command line and the
+/// environment can carry the whole list as one JSON value, while a config file
+/// can spell it as an ordinary list.
+#[derive(Clone, Debug, Default, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(transparent)]
+pub struct OwnerTrusts(pub Vec<OwnerTrust>);
+
+impl OwnerTrusts {
+    /// Whether any configured trust admits this token as a platform owner.
+    pub fn admits(&self, issuer: &str, subject: &str, audiences: &[String]) -> bool {
+        self.0
+            .iter()
+            .any(|trust| trust.admits(issuer, subject, audiences))
+    }
+
+    /// Whether any configured trust names this issuer. The auth path checks
+    /// this before fetching an issuer's discovery document, so that an issuer
+    /// nobody trusts never causes an outbound request.
+    pub fn names_issuer(&self, issuer: &str) -> bool {
+        self.0.iter().any(|trust| trust.issuer == issuer)
+    }
+}
+
+impl FromStr for OwnerTrusts {
+    type Err = String;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        let trusts: Vec<OwnerTrust> = serde_json::from_str(value)
+            .map_err(|e| format!("owner trusts must be a JSON array: {e}"))?;
+        for trust in &trusts {
+            if trust.issuer.is_empty() {
+                return Err("owner trust issuer must not be empty".to_string());
+            }
+            if trust.subject.is_empty() {
+                return Err("owner trust subject must not be empty".to_string());
+            }
+        }
+        Ok(OwnerTrusts(trusts))
+    }
+}
+
 impl ApiServerConfig {
     /// CORS configuration
     pub(crate) fn cors(&self) -> actix_cors::Cors {
@@ -1052,6 +1140,7 @@ impl ApiServerConfig {
             authorized_groups: vec![],
             auth_audience: "feldera-api".to_string(),
             owners: vec![],
+            owner_trusts: OwnerTrusts::default(),
             default_role: Role::Read,
             first_user_role: Role::Admin,
         }
@@ -1255,6 +1344,81 @@ mod tests {
     use super::*;
     use std::path::Path;
 
+    #[test]
+    fn owner_trusts_parse_from_json() {
+        let trusts: OwnerTrusts = r#"[
+            {"issuer": "https://accounts.google.com", "subject": "1234567890", "audience": "my-client"},
+            {"issuer": "https://token.actions.githubusercontent.com", "subject": "repo:acme/*"}
+        ]"#
+        .parse()
+        .expect("valid owner trusts");
+        assert_eq!(trusts.0.len(), 2);
+        assert_eq!(trusts.0[0].audience.as_deref(), Some("my-client"));
+        // An omitted audience accepts any audience.
+        assert_eq!(trusts.0[1].audience, None);
+
+        // The default, and the value the argument carries when unset.
+        assert_eq!("[]".parse::<OwnerTrusts>().unwrap(), OwnerTrusts::default());
+
+        // A trust that names no issuer or no subject would match on the wrong
+        // half of the pair, so it is refused at startup rather than at auth time.
+        assert!(r#"[{"issuer": "", "subject": "x"}]"#.parse::<OwnerTrusts>().is_err());
+        assert!(r#"[{"issuer": "https://idp.example", "subject": ""}]"#
+            .parse::<OwnerTrusts>()
+            .is_err());
+        assert!("not json".parse::<OwnerTrusts>().is_err());
+    }
+
+    #[test]
+    fn owner_trusts_admit_the_right_tokens() {
+        let trust = |issuer: &str, subject: &str, audience: Option<&str>| OwnerTrust {
+            issuer: issuer.to_string(),
+            subject: subject.to_string(),
+            audience: audience.map(str::to_string),
+        };
+        let aud = |a: &str| vec![a.to_string()];
+
+        let trusts = OwnerTrusts(vec![
+            trust(
+                "https://accounts.google.com",
+                "1234567890",
+                Some("client-a"),
+            ),
+            trust("https://ci.example", "repo:acme/*", None),
+        ]);
+
+        // Issuer, subject and audience all agree.
+        assert!(trusts.admits(
+            "https://accounts.google.com",
+            "1234567890",
+            &aud("client-a")
+        ));
+        // Right subject, wrong audience.
+        assert!(!trusts.admits(
+            "https://accounts.google.com",
+            "1234567890",
+            &aud("client-b")
+        ));
+        // The issuer is matched exactly, never as a pattern.
+        assert!(!trusts.admits(
+            "https://accounts.google.com.evil.test",
+            "1234567890",
+            &aud("client-a")
+        ));
+        // A trust with no audience accepts any, including none at all.
+        assert!(trusts.admits("https://ci.example", "repo:acme/api", &aud("any")));
+        assert!(trusts.admits("https://ci.example", "repo:acme/api", &[]));
+        // The subject pattern still has to match.
+        assert!(!trusts.admits("https://ci.example", "repo:other/api", &[]));
+        // No configured trusts admits nobody.
+        assert!(!OwnerTrusts::default().admits("https://ci.example", "x", &[]));
+
+        // The issuer gate is separate: it asks only whether fetching that
+        // issuer's keys is worth doing.
+        assert!(trusts.names_issuer("https://ci.example"));
+        assert!(!trusts.names_issuer("https://elsewhere.example"));
+    }
+
     #[test]
     fn test_cpu_quantity() {
         assert_eq!(cpu_quantity_to_workers("100m").unwrap(), 1);
diff --git a/crates/pipeline-manager/src/db/error.rs b/crates/pipeline-manager/src/db/error.rs
index 04c4560f9b5..f323235634f 100644
--- a/crates/pipeline-manager/src/db/error.rs
+++ b/crates/pipeline-manager/src/db/error.rs
@@ -165,7 +165,6 @@ pub enum DBError {
         field: String,
     },
     AmbiguousOidcTenant,
-    OwnerTrustNeedsTenant,
     OidcTenantNotTrusted {
         tenant: String,
     },
@@ -670,7 +669,7 @@ impl Display for DBError {
             DBError::OwnerRoleNotAssignable => {
                 write!(
                     f,
-                    "The 'owner' role is platform-wide and cannot be assigned as a tenant membership"
+                    "The 'owner' role is platform-wide: it is set at deploy time and cannot be granted through the API"
                 )
             }
             DBError::InvalidRoleString { value } => {
@@ -695,13 +694,6 @@ impl Display for DBError {
                      set the Feldera-Tenant header to select one"
                 )
             }
-            DBError::OwnerTrustNeedsTenant => {
-                write!(
-                    f,
-                    "Owner trust is platform-wide; set the Feldera-Tenant header \
-                     to choose the tenant to act in"
-                )
-            }
             DBError::OidcTenantNotTrusted { tenant } => {
                 write!(f, "Token is not trusted in tenant '{tenant}'")
             }
@@ -1016,7 +1008,6 @@ impl DetailedError for DBError {
             Self::UnknownOidcTrust { .. } => Cow::from("UnknownOidcTrust"),
             Self::EmptyOidcTrustField { .. } => Cow::from("EmptyOidcTrustField"),
             Self::AmbiguousOidcTenant => Cow::from("AmbiguousOidcTenant"),
-            Self::OwnerTrustNeedsTenant => Cow::from("OwnerTrustNeedsTenant"),
             Self::OidcTenantNotTrusted { .. } => Cow::from("OidcTenantNotTrusted"),
             Self::InvalidOidcToken { .. } => Cow::from("InvalidOidcToken"),
             Self::UnauthorizedOidcToken => Cow::from("UnauthorizedOidcToken"),
@@ -1144,7 +1135,6 @@ impl ResponseError for DBError {
             Self::UnknownOidcTrust { .. } => StatusCode::NOT_FOUND,
             Self::EmptyOidcTrustField { .. } => StatusCode::BAD_REQUEST,
             Self::AmbiguousOidcTenant => StatusCode::BAD_REQUEST,
-            Self::OwnerTrustNeedsTenant => StatusCode::BAD_REQUEST,
             Self::OidcTenantNotTrusted { .. } => StatusCode::FORBIDDEN,
             Self::InvalidOidcToken { .. } => StatusCode::UNAUTHORIZED,
             Self::UnauthorizedOidcToken => StatusCode::UNAUTHORIZED,
diff --git a/crates/pipeline-manager/src/db/operations/oidc_trust.rs b/crates/pipeline-manager/src/db/operations/oidc_trust.rs
index 82a06c37b75..8fdb8a75bce 100644
--- a/crates/pipeline-manager/src/db/operations/oidc_trust.rs
+++ b/crates/pipeline-manager/src/db/operations/oidc_trust.rs
@@ -33,52 +33,32 @@ fn row_to_descr(row: &tokio_postgres::Row) -> Result<OidcTrustDescr, DBError> {
     })
 }
 
-// `tenant_id` scopes the query: `Some(t)` selects that tenant's trusts;
-// `None` selects the platform-wide owner trusts (rows with NULL tenant_id).
 pub async fn list_oidc_trust(
     txn: &Transaction<'_>,
-    tenant_id: Option<TenantId>,
+    tenant_id: TenantId,
 ) -> Result<Vec<OidcTrustDescr>, DBError> {
-    const COLS: &str =
-        "SELECT id, name, description, issuer, subject, audience, role FROM oidc_trust_relationship";
-    let rows = match tenant_id {
-        Some(t) => {
-            let stmt = txn
-                .prepare_cached(&format!("{COLS} WHERE tenant_id = $1"))
-                .await?;
-            txn.query(&stmt, &[&t.0]).await?
-        }
-        None => {
-            let stmt = txn
-                .prepare_cached(&format!("{COLS} WHERE tenant_id IS NULL"))
-                .await?;
-            txn.query(&stmt, &[]).await?
-        }
-    };
+    let stmt = txn
+        .prepare_cached(
+            "SELECT id, name, description, issuer, subject, audience, role \
+             FROM oidc_trust_relationship WHERE tenant_id = $1",
+        )
+        .await?;
+    let rows = txn.query(&stmt, &[&tenant_id.0]).await?;
     rows.iter().map(row_to_descr).collect()
 }
 
 pub async fn get_oidc_trust(
     txn: &Transaction<'_>,
-    tenant_id: Option<TenantId>,
+    tenant_id: TenantId,
     name: &str,
 ) -> Result<OidcTrustDescr, DBError> {
-    const COLS: &str =
-        "SELECT id, name, description, issuer, subject, audience, role FROM oidc_trust_relationship";
-    let maybe_row = match tenant_id {
-        Some(t) => {
-            let stmt = txn
-                .prepare_cached(&format!("{COLS} WHERE tenant_id = $1 AND name = $2"))
-                .await?;
-            txn.query_opt(&stmt, &[&t.0, &name]).await?
-        }
-        None => {
-            let stmt = txn
-                .prepare_cached(&format!("{COLS} WHERE tenant_id IS NULL AND name = $1"))
-                .await?;
-            txn.query_opt(&stmt, &[&name]).await?
-        }
-    };
+    let stmt = txn
+        .prepare_cached(
+            "SELECT id, name, description, issuer, subject, audience, role \
+             FROM oidc_trust_relationship WHERE tenant_id = $1 AND name = $2",
+        )
+        .await?;
+    let maybe_row = txn.query_opt(&stmt, &[&tenant_id.0, &name]).await?;
     match maybe_row {
         Some(row) => row_to_descr(&row),
         None => Err(DBError::UnknownOidcTrust {
@@ -89,27 +69,13 @@ pub async fn get_oidc_trust(
 
 pub async fn delete_oidc_trust(
     txn: &Transaction<'_>,
-    tenant_id: Option<TenantId>,
+    tenant_id: TenantId,
     name: &str,
 ) -> Result<(), DBError> {
-    let res = match tenant_id {
-        Some(t) => {
-            let stmt = txn
-                .prepare_cached(
-                    "DELETE FROM oidc_trust_relationship WHERE tenant_id = $1 AND name = $2",
-                )
-                .await?;
-            txn.execute(&stmt, &[&t.0, &name]).await?
-        }
-        None => {
-            let stmt = txn
-                .prepare_cached(
-                    "DELETE FROM oidc_trust_relationship WHERE tenant_id IS NULL AND name = $1",
-                )
-                .await?;
-            txn.execute(&stmt, &[&name]).await?
-        }
-    };
+    let stmt = txn
+        .prepare_cached("DELETE FROM oidc_trust_relationship WHERE tenant_id = $1 AND name = $2")
+        .await?;
+    let res = txn.execute(&stmt, &[&tenant_id.0, &name]).await?;
     if res > 0 {
         Ok(())
     } else {
@@ -119,15 +85,11 @@ pub async fn delete_oidc_trust(
     }
 }
 
-// `tenant_id` is `None` for a platform-wide owner trust and `Some` for a
-// tenant-scoped one; the caller pairs it with the role (owner iff None), which
-// the `oidc_trust_owner_is_platform` CHECK also enforces. A tenant that does
-// not exist is refused by the foreign key and reported as `UnknownTenant`;
-// callers take the id from the authenticated principal, not from the request.
+// A trust always belongs to one tenant: `owner` is configuration only.
 #[allow(clippy::too_many_arguments)]
 pub async fn create_oidc_trust(
     txn: &Transaction<'_>,
-    tenant_id: Option<TenantId>,
+    tenant_id: TenantId,
     id: Uuid,
     name: &str,
     description: Option<&str>,
@@ -159,7 +121,7 @@ pub async fn create_oidc_trust(
             &stmt,
             &[
                 &id,
-                &tenant_id.map(|t| t.0),
+                &tenant_id.0,
                 &name,
                 &description,
                 &issuer,
@@ -169,13 +131,8 @@ pub async fn create_oidc_trust(
             ],
         )
         .await
-        .map_err(maybe_unique_violation);
-    // The FK only exists for a concrete tenant; owner trusts (NULL) cannot
-    // violate it.
-    let res = match tenant_id {
-        Some(t) => res.map_err(|e| maybe_tenant_id_foreign_key_constraint_err(e, t))?,
-        None => res?,
-    };
+        .map_err(maybe_unique_violation)
+        .map_err(|e| maybe_tenant_id_foreign_key_constraint_err(e, tenant_id))?;
     if res > 0 {
         Ok(())
     } else {
@@ -197,16 +154,14 @@ pub async fn is_trusted_issuer(txn: &Transaction<'_>, issuer: &str) -> Result<bo
     Ok(row.get(0))
 }
 
-/// Resolve a federated token to the tenant and role it is authorized for.
+/// Resolve a federated token to the tenants and roles it is authorized for.
 ///
-/// Every trust matching this token, one entry per scope with the most
-/// permissive matching role. A trust is a candidate when it is registered for
-/// `issuer`, its subject pattern matches `subject`, and, if it sets an audience
-/// pattern, that pattern matches one of `audiences` (the audience is a security
-/// filter, not the tenant key). The scope is the trust's `tenant_id`: `Some`
-/// for a tenant-scoped trust, `None` for a platform-wide owner trust. When the
-/// result spans several scopes the caller disambiguates with the
-/// `Feldera-Tenant` header. Sorted (owner scope first) for a deterministic order.
+/// One entry per tenant, carrying the most permissive role that matched there.
+/// A trust is a candidate when it is registered for `issuer`, its subject
+/// pattern matches `subject`, and, if it sets an audience pattern, that pattern
+/// matches one of `audiences` (the audience is a security filter, not the
+/// tenant key). When the result spans several tenants the caller disambiguates
+/// with the `Feldera-Tenant` header. Sorted by tenant for a deterministic order.
 ///
 /// For a GitHub Actions token with
 /// `iss = https://token.actions.githubusercontent.com`,
@@ -216,21 +171,19 @@ pub async fn is_trusted_issuer(txn: &Transaction<'_>, issuer: &str) -> Result<bo
 /// registered trusts
 ///   ("acme-ci",   tenant=acme, subject="repo:acme/*",     audience=None,    role=write)
 ///   ("acme-main", tenant=acme, subject="repo:acme/api:*", audience="https://github.com/acme", role=admin)
-///   ("bootstrap", tenant=None, subject="repo:acme/*",     audience=None,    role=owner)
 ///   ("other",     tenant=beta, subject="repo:beta/*",     audience=None,    role=write)
 ///
-/// match_oidc_trust(..) => [(None, Owner), (Some(acme), Admin)]
+/// match_oidc_trust(..) => [(acme, Admin)]
 /// ```
 ///
 /// `beta` does not appear because its subject pattern does not match. `acme`
-/// appears once, at `admin`, the most permissive of its two matching trusts. The
-/// result spans two scopes, so the caller needs the `Feldera-Tenant` header.
+/// appears once, at `admin`, the most permissive of its two matching trusts.
 pub async fn match_oidc_trust(
     txn: &Transaction<'_>,
     issuer: &str,
     subject: &str,
     audiences: &[String],
-) -> Result<Vec<(Option<TenantId>, Role)>, DBError> {
+) -> Result<Vec<(TenantId, Role)>, DBError> {
     let stmt = txn
         .prepare_cached(
             "SELECT tenant_id, subject, audience, role \
@@ -238,9 +191,9 @@ pub async fn match_oidc_trust(
         )
         .await?;
     let rows = txn.query(&stmt, &[&issuer]).await?;
-    let mut matched: Vec<(Option<TenantId>, Role)> = Vec::new();
+    let mut matched: Vec<(TenantId, Role)> = Vec::new();
     for row in rows {
-        let tenant_id = row.get::<_, Option<Uuid>>(0).map(TenantId);
+        let tenant_id = TenantId(row.get::<_, Uuid>(0));
         let pattern_subject: String = row.get(1);
         let pattern_audience: Option<String> = row.get(2);
         let role = Role::from_str(&row.get::<_, String>(3))?;
@@ -258,6 +211,6 @@ pub async fn match_oidc_trust(
             None => matched.push((tenant_id, role)),
         }
     }
-    matched.sort_by_key(|(t, _)| t.map(|x| x.0));
+    matched.sort_by_key(|(t, _)| t.0);
     Ok(matched)
 }
diff --git a/crates/pipeline-manager/src/db/storage.rs b/crates/pipeline-manager/src/db/storage.rs
index 40c7f274ea4..1054dc33e29 100644
--- a/crates/pipeline-manager/src/db/storage.rs
+++ b/crates/pipeline-manager/src/db/storage.rs
@@ -211,31 +211,24 @@ pub(crate) trait Storage {
 
     /// Lists OIDC trust relationships in a scope: `Some(tenant)` for that
     /// tenant's trusts, `None` for the platform-wide owner trusts.
-    async fn list_oidc_trust(
-        &self,
-        tenant_id: Option<TenantId>,
-    ) -> Result<Vec<OidcTrustDescr>, DBError>;
+    async fn list_oidc_trust(&self, tenant_id: TenantId) -> Result<Vec<OidcTrustDescr>, DBError>;
 
     /// Retrieves a trust relationship by name within a scope (see `list_oidc_trust`).
     async fn get_oidc_trust(
         &self,
-        tenant_id: Option<TenantId>,
+        tenant_id: TenantId,
         name: &str,
     ) -> Result<OidcTrustDescr, DBError>;
 
     /// Deletes a trust relationship by name within a scope (see `list_oidc_trust`).
-    async fn delete_oidc_trust(
-        &self,
-        tenant_id: Option<TenantId>,
-        name: &str,
-    ) -> Result<(), DBError>;
+    async fn delete_oidc_trust(&self, tenant_id: TenantId, name: &str) -> Result<(), DBError>;
 
     /// Persists a new trust relationship. `tenant_id` is `None` for a
     /// platform-wide owner trust, `Some` for a tenant-scoped one.
     #[allow(clippy::too_many_arguments)]
     async fn create_oidc_trust(
         &self,
-        tenant_id: Option<TenantId>,
+        tenant_id: TenantId,
         id: Uuid,
         name: &str,
         description: Option<&str>,
@@ -259,7 +252,7 @@ pub(crate) trait Storage {
         issuer: &str,
         subject: &str,
         audiences: &[String],
-    ) -> Result<Vec<(Option<TenantId>, Role)>, DBError>;
+    ) -> Result<Vec<(TenantId, Role)>, DBError>;
 
     /// Retrieves a list of pipelines as extended descriptors.
     async fn list_pipelines(
diff --git a/crates/pipeline-manager/src/db/storage_postgres.rs b/crates/pipeline-manager/src/db/storage_postgres.rs
index 57a725462fd..6fa52fd7aec 100644
--- a/crates/pipeline-manager/src/db/storage_postgres.rs
+++ b/crates/pipeline-manager/src/db/storage_postgres.rs
@@ -315,10 +315,7 @@ impl Storage for StoragePostgres {
         Ok(result)
     }
 
-    async fn list_oidc_trust(
-        &self,
-        tenant_id: Option<TenantId>,
-    ) -> Result<Vec<OidcTrustDescr>, DBError> {
+    async fn list_oidc_trust(&self, tenant_id: TenantId) -> Result<Vec<OidcTrustDescr>, DBError> {
         let mut client = self.pool.get().await?;
         let txn = client.transaction().await?;
         let result = operations::oidc_trust::list_oidc_trust(&txn, tenant_id).await?;
@@ -328,7 +325,7 @@ impl Storage for StoragePostgres {
 
     async fn get_oidc_trust(
         &self,
-        tenant_id: Option<TenantId>,
+        tenant_id: TenantId,
         name: &str,
     ) -> Result<OidcTrustDescr, DBError> {
         let mut client = self.pool.get().await?;
@@ -338,11 +335,7 @@ impl Storage for StoragePostgres {
         Ok(result)
     }
 
-    async fn delete_oidc_trust(
-        &self,
-        tenant_id: Option<TenantId>,
-        name: &str,
-    ) -> Result<(), DBError> {
+    async fn delete_oidc_trust(&self, tenant_id: TenantId, name: &str) -> Result<(), DBError> {
         let mut client = self.pool.get().await?;
         let txn = client.transaction().await?;
         let result = operations::oidc_trust::delete_oidc_trust(&txn, tenant_id, name).await?;
@@ -352,7 +345,7 @@ impl Storage for StoragePostgres {
 
     async fn create_oidc_trust(
         &self,
-        tenant_id: Option<TenantId>,
+        tenant_id: TenantId,
         id: Uuid,
         name: &str,
         description: Option<&str>,
@@ -392,7 +385,7 @@ impl Storage for StoragePostgres {
         issuer: &str,
         subject: &str,
         audiences: &[String],
-    ) -> Result<Vec<(Option<TenantId>, Role)>, DBError> {
+    ) -> Result<Vec<(TenantId, Role)>, DBError> {
         let mut client = self.pool.get().await?;
         let txn = client.transaction().await?;
         let result =
diff --git a/crates/pipeline-manager/src/db/test.rs b/crates/pipeline-manager/src/db/test.rs
index 4e2d7badbef..0119af0d6f8 100644
--- a/crates/pipeline-manager/src/db/test.rs
+++ b/crates/pipeline-manager/src/db/test.rs
@@ -380,10 +380,9 @@ fn user_id_for_identity(provider: &str, subject: &str) -> Uuid {
 /// The id a caller would mint for a trust. Distinct trusts get distinct ids, as
 /// `Uuid::now_v7()` would give them, so that several can coexist; re-creating
 /// the same trust reuses the id and collides on the name, as intended.
-fn trust_id_for(platform: bool, name: &str) -> Uuid {
+fn trust_id_for(name: &str) -> Uuid {
     use std::hash::{Hash, Hasher};
     let mut hasher = std::collections::hash_map::DefaultHasher::new();
-    platform.hash(&mut hasher);
     name.hash(&mut hasher);
     let half = hasher.finish().to_be_bytes();
     let mut bytes = [0u8; 16];
@@ -1327,7 +1326,7 @@ async fn oidc_trust_matching_and_issuer_gate() {
     handle
         .db
         .create_oidc_trust(
-            Some(tenant_a),
+            tenant_a,
             Uuid::now_v7(),
             "ta",
             None,
@@ -1341,7 +1340,7 @@ async fn oidc_trust_matching_and_issuer_gate() {
     handle
         .db
         .create_oidc_trust(
-            Some(tenant_b),
+            tenant_b,
             Uuid::now_v7(),
             "tb",
             None,
@@ -1360,7 +1359,7 @@ async fn oidc_trust_matching_and_issuer_gate() {
             .match_oidc_trust(iss, sub, &["a".to_string()])
             .await
             .unwrap(),
-        vec![(Some(tenant_a), Role::Write)]
+        vec![(tenant_a, Role::Write)]
     );
     assert_eq!(
         handle
@@ -1368,7 +1367,7 @@ async fn oidc_trust_matching_and_issuer_gate() {
             .match_oidc_trust(iss, sub, &["b".to_string()])
             .await
             .unwrap(),
-        vec![(Some(tenant_b), Role::Write)]
+        vec![(tenant_b, Role::Write)]
     );
     // A token whose audience matches neither trust does not resolve.
     assert!(handle
@@ -1386,7 +1385,7 @@ async fn oidc_trust_matching_and_issuer_gate() {
     handle
         .db
         .create_oidc_trust(
-            Some(tenant_c),
+            tenant_c,
             Uuid::now_v7(),
             "tc",
             None,
@@ -1402,66 +1401,26 @@ async fn oidc_trust_matching_and_issuer_gate() {
         .match_oidc_trust(iss, sub, &["a".to_string()])
         .await
         .unwrap();
-    got.sort_by_key(|(t, _)| t.map(|x| x.0));
-    let mut want = vec![(Some(tenant_a), Role::Write), (Some(tenant_c), Role::Read)];
-    want.sort_by_key(|(t, _)| t.map(|x| x.0));
+    got.sort_by_key(|(t, _)| t.0);
+    let mut want = vec![(tenant_a, Role::Write), (tenant_c, Role::Read)];
+    want.sort_by_key(|(t, _)| t.0);
     assert_eq!(got, want);
 
-    // An owner trust is platform-wide: it has NULL tenant and matches with scope
-    // None. The `oidc_trust_owner_is_platform` CHECK ties the two together, so a
-    // tenant-scoped owner trust and a tenant-less non-owner trust are both
-    // rejected.
-    let owner_iss = "https://owner.example";
-    handle
-        .db
-        .create_oidc_trust(
-            None,
-            Uuid::now_v7(),
-            "plat",
-            None,
-            owner_iss,
-            "root",
-            None,
-            Role::Owner,
-        )
-        .await
-        .unwrap();
-    assert_eq!(
-        handle
-            .db
-            .match_oidc_trust(owner_iss, "root", &[])
-            .await
-            .unwrap(),
-        vec![(None, Role::Owner)]
-    );
+    // `owner` is configuration only, so the schema refuses a row carrying it.
     assert!(handle
         .db
         .create_oidc_trust(
-            Some(tenant_a),
+            tenant_a,
             Uuid::now_v7(),
-            "bad1",
+            "bad-owner",
             None,
-            owner_iss,
-            "x",
+            "https://owner.example",
+            "root",
             None,
             Role::Owner
         )
         .await
         .is_err());
-    assert!(handle
-        .db
-        .create_oidc_trust(
-            None,
-            Uuid::now_v7(),
-            "bad2",
-            None,
-            owner_iss,
-            "y",
-            None,
-            Role::Read
-        )
-        .await
-        .is_err());
 }
 
 /// Pre-provisioning: an admin grants a role by identity before first login; the
@@ -3901,38 +3860,34 @@ async fn check_rbac_action(
     action: RbacAction,
 ) {
     match action {
-        RbacAction::ListOidcTrust(tenant_id, platform) => {
+        RbacAction::ListOidcTrust(tenant_id) => {
             create_tenants_if_not_exists(model, handle, tenant_id)
                 .await
                 .unwrap();
-            let scope = if platform { None } else { Some(tenant_id) };
-            let mut model_response = model.list_oidc_trust(scope).await.unwrap();
-            let mut impl_response = handle.db.list_oidc_trust(scope).await.unwrap();
+            let mut model_response = model.list_oidc_trust(tenant_id).await.unwrap();
+            let mut impl_response = handle.db.list_oidc_trust(tenant_id).await.unwrap();
             model_response.sort_by(|a, b| a.name.cmp(&b.name));
             impl_response.sort_by(|a, b| a.name.cmp(&b.name));
             assert_eq!(model_response, impl_response);
         }
-        RbacAction::GetOidcTrust(tenant_id, platform, name) => {
+        RbacAction::GetOidcTrust(tenant_id, name) => {
             create_tenants_if_not_exists(model, handle, tenant_id)
                 .await
                 .unwrap();
-            let scope = if platform { None } else { Some(tenant_id) };
-            let model_response = model.get_oidc_trust(scope, &name).await;
-            let impl_response = handle.db.get_oidc_trust(scope, &name).await;
+            let model_response = model.get_oidc_trust(tenant_id, &name).await;
+            let impl_response = handle.db.get_oidc_trust(tenant_id, &name).await;
             check_responses(i, model_response, impl_response);
         }
-        RbacAction::DeleteOidcTrust(tenant_id, platform, name) => {
+        RbacAction::DeleteOidcTrust(tenant_id, name) => {
             create_tenants_if_not_exists(model, handle, tenant_id)
                 .await
                 .unwrap();
-            let scope = if platform { None } else { Some(tenant_id) };
-            let model_response = model.delete_oidc_trust(scope, &name).await;
-            let impl_response = handle.db.delete_oidc_trust(scope, &name).await;
+            let model_response = model.delete_oidc_trust(tenant_id, &name).await;
+            let impl_response = handle.db.delete_oidc_trust(tenant_id, &name).await;
             check_responses(i, model_response, impl_response);
         }
         RbacAction::CreateOidcTrust(
             tenant_id,
-            platform,
             name,
             description,
             issuer,
@@ -3943,16 +3898,11 @@ async fn check_rbac_action(
             create_tenants_if_not_exists(model, handle, tenant_id)
                 .await
                 .unwrap();
-            let id = trust_id_for(platform, &name);
-            // The schema ties the platform scope to `owner`.
-            let (scope, role) = if platform {
-                (None, Role::Owner)
-            } else {
-                (Some(tenant_id), role.role())
-            };
+            let id = trust_id_for(&name);
+            let role = role.role();
             let model_response = model
                 .create_oidc_trust(
-                    scope,
+                    tenant_id,
                     id,
                     &name,
                     description.as_deref(),
@@ -3965,7 +3915,7 @@ async fn check_rbac_action(
             let impl_response = handle
                 .db
                 .create_oidc_trust(
-                    scope,
+                    tenant_id,
                     id,
                     &name,
                     description.as_deref(),
@@ -4088,24 +4038,19 @@ async fn check_rbac_action(
 /// Actions covering OIDC trust relationships and tenant membership.
 #[derive(Debug, Clone, Arbitrary)]
 enum RbacAction {
-    // OIDC trust relationships. `platform` selects the platform-wide owner
-    // scope, which the schema ties to the `owner` role; the tenant scope takes
-    // any assignable role. Generating the pair together keeps every action
-    // inside the `oidc_trust_owner_is_platform` check.
-    ListOidcTrust(TenantId, bool),
+    // OIDC trust relationships, which always belong to one tenant and carry an
+    // assignable role: `owner` comes from configuration, never from a row.
+    ListOidcTrust(TenantId),
     GetOidcTrust(
         TenantId,
-        bool,
         #[proptest(strategy = "limited_oidc_trust_name()")] String,
     ),
     DeleteOidcTrust(
         TenantId,
-        bool,
         #[proptest(strategy = "limited_oidc_trust_name()")] String,
     ),
     CreateOidcTrust(
         TenantId,
-        bool,
         #[proptest(strategy = "limited_oidc_trust_name()")] String,
         Option<String>,
         #[proptest(strategy = "limited_issuer()")] String,
@@ -5280,9 +5225,8 @@ struct DbModel {
     pub pipelines: BTreeMap<(TenantId, PipelineId), ExtendedPipelineDescr>,
     pub pipeline_events: BTreeMap<(TenantId, PipelineId), Vec<ExtendedPipelineMonitorEvent>>,
     pub cluster_events: BTreeMap<ClusterMonitorEventId, ExtendedClusterMonitorEvent>,
-    /// Keyed by scope and name, mirroring the table's uniqueness: `None` is the
-    /// platform-wide owner scope, `Some(t)` a tenant's own trusts.
-    pub oidc_trusts: BTreeMap<(Option<TenantId>, String), OidcTrustDescr>,
+    /// Keyed by tenant and name, mirroring the table's uniqueness.
+    pub oidc_trusts: BTreeMap<(TenantId, String), OidcTrustDescr>,
     /// Keyed by the `(provider, subject)` identity, holding the user's id and
     /// the email last seen for it.
     pub users: BTreeMap<(String, String), (UserId, Option<String>)>,
@@ -5856,23 +5800,19 @@ impl Storage for Mutex<DbModel> {
 
     async fn list_oidc_trust(
         &self,
-        tenant_id: Option<TenantId>,
+        tenant_id: TenantId,
     ) -> DBResult<Vec<crate::db::types::oidc_trust::OidcTrustDescr>> {
         let s = self.lock().await;
         Ok(s.oidc_trusts
             .iter()
-            .filter(
-                |((scope, _), _): &(&(Option<TenantId>, String), &OidcTrustDescr)| {
-                    *scope == tenant_id
-                },
-            )
+            .filter(|((scope, _), _)| *scope == tenant_id)
             .map(|(_, descr)| descr.clone())
             .collect())
     }
 
     async fn get_oidc_trust(
         &self,
-        tenant_id: Option<TenantId>,
+        tenant_id: TenantId,
         name: &str,
     ) -> DBResult<crate::db::types::oidc_trust::OidcTrustDescr> {
         let s = self.lock().await;
@@ -5884,7 +5824,7 @@ impl Storage for Mutex<DbModel> {
             })
     }
 
-    async fn delete_oidc_trust(&self, tenant_id: Option<TenantId>, name: &str) -> DBResult<()> {
+    async fn delete_oidc_trust(&self, tenant_id: TenantId, name: &str) -> DBResult<()> {
         let mut s = self.lock().await;
         s.oidc_trusts
             .remove(&(tenant_id, name.to_string()))
@@ -5897,7 +5837,7 @@ impl Storage for Mutex<DbModel> {
     #[allow(clippy::too_many_arguments)]
     async fn create_oidc_trust(
         &self,
-        tenant_id: Option<TenantId>,
+        tenant_id: TenantId,
         id: Uuid,
         name: &str,
         description: Option<&str>,
@@ -5926,10 +5866,8 @@ impl Storage for Mutex<DbModel> {
         if duplicate_id || s.oidc_trusts.contains_key(&(tenant_id, name.to_string())) {
             return Err(DBError::DuplicateName);
         }
-        if let Some(t) = tenant_id {
-            if !s.tenants.contains_key(&t) {
-                return Err(DBError::UnknownTenant { tenant_id: t });
-            }
+        if !s.tenants.contains_key(&tenant_id) {
+            return Err(DBError::UnknownTenant { tenant_id });
         }
         s.oidc_trusts.insert(
             (tenant_id, name.to_string()),
@@ -5956,9 +5894,9 @@ impl Storage for Mutex<DbModel> {
         issuer: &str,
         subject: &str,
         audiences: &[String],
-    ) -> DBResult<Vec<(Option<TenantId>, Role)>> {
+    ) -> DBResult<Vec<(TenantId, Role)>> {
         let s = self.lock().await;
-        let mut matched: Vec<(Option<TenantId>, Role)> = Vec::new();
+        let mut matched: Vec<(TenantId, Role)> = Vec::new();
         for ((scope, _), descr) in s.oidc_trusts.iter() {
             if descr.issuer != issuer || !claim_matches(&descr.subject, subject) {
                 continue;
@@ -5973,7 +5911,7 @@ impl Storage for Mutex<DbModel> {
                 None => matched.push((*scope, descr.role)),
             }
         }
-        matched.sort_by_key(|(t, _)| t.map(|x| x.0));
+        matched.sort_by_key(|(t, _)| t.0);
         Ok(matched)
     }
 
@@ -6005,7 +5943,7 @@ impl Storage for Mutex<DbModel> {
         let oidc_trusts = s
             .oidc_trusts
             .keys()
-            .filter(|(scope, _)| *scope == Some(tenant_id))
+            .filter(|(scope, _)| *scope == tenant_id)
             .count() as i64;
         if pipelines > 0 || api_keys > 0 || oidc_trusts > 0 {
             return Err(DBError::TenantNotEmpty {
diff --git a/docs.feldera.com/docs/get-started/enterprise/authentication/index.mdx b/docs.feldera.com/docs/get-started/enterprise/authentication/index.mdx
index 4d5f9d7cc33..7a9cc4cfa37 100644
--- a/docs.feldera.com/docs/get-started/enterprise/authentication/index.mdx
+++ b/docs.feldera.com/docs/get-started/enterprise/authentication/index.mdx
@@ -321,6 +321,12 @@ authorization:
   owners:                               # Maps to: FELDERA_OWNERS
     - "ops@example.com"
 
+  # Workloads granted `owner`, matched on their OIDC token (default: [])
+  ownerTrusts:                          # Maps to: FELDERA_OWNER_TRUSTS
+    - issuer: "https://token.actions.githubusercontent.com"
+      subject: "repo:acme/infra:ref:refs/heads/main"
+      audience: "https://github.com/acme"
+
   # Role for an authenticated user with no explicit membership yet (default: "read")
   # Ship "write" when upgrading a pre-RBAC deployment; see the Roles page.
   defaultRole: "write"                  # Maps to: FELDERA_AUTH_DEFAULT_ROLE
@@ -351,6 +357,8 @@ FELDERA_AUTH_ISSUER_TENANT=false             # default: false
 FELDERA_AUTH_AUTHORIZED_GROUPS=group1,group2 # comma-separated list
 FELDERA_AUTH_AUDIENCE=feldera-api            # default: feldera-api
 FELDERA_OWNERS=ops@example.com               # comma-separated; default: (none)
+FELDERA_OWNER_TRUSTS='[{"issuer":"https://token.actions.githubusercontent.com","subject":"repo:acme/infra:*"}]'
+                                             # JSON array; default: []
 FELDERA_AUTH_DEFAULT_ROLE=read               # read or write; default: read
 FELDERA_AUTH_FIRST_USER_ROLE=admin           # read, write, or admin; default: admin
 
diff --git a/docs.feldera.com/docs/get-started/enterprise/authentication/roles.md b/docs.feldera.com/docs/get-started/enterprise/authentication/roles.md
index 2d22b546b92..c13608a1830 100644
--- a/docs.feldera.com/docs/get-started/enterprise/authentication/roles.md
+++ b/docs.feldera.com/docs/get-started/enterprise/authentication/roles.md
@@ -23,42 +23,40 @@ below it.
 | `owner` | platform | Everything `admin` can, in any tenant; create tenants; manage the installation |
 
 `read`, `write`, and `admin` are per-tenant memberships. `owner` is
-platform-wide: it is not stored as a tenant membership and is granted only
-through configuration (`owners`) or an owner OIDC trust relationship. An owner
-can select the tenant it acts in with the `Feldera-Tenant` request header.
+platform-wide and comes only from deploy-time configuration, as a user
+(`authorization.owners`) or as an OIDC trust relationship
+(`authorization.ownerTrusts`). An owner selects the tenant it acts in with the
+`Feldera-Tenant` request header, and acts in the `default` tenant without one.
 
 ## How a role is assigned
 
 - On a user's first login to a tenant, if the user has no membership yet, they
-  are admitted at the configured default role (see [below](#default-role-and-owners))
+  are admitted at the configured default role (see [below](#default-roles))
   and a membership record is created.
 - When that first login also creates the tenant (auto-provisioning, because the
   resolved tenant did not exist yet), the user is granted the configured
-  first-user role, `admin` by default (see [below](#default-role-and-owners)). A
+  first-user role, `admin` by default (see [below](#default-roles)). A
   tenant an owner creates explicitly starts with no members, and the first user
   to log into it is admitted at the default role.
 - An `admin` or `owner` can pre-provision members and change member roles from the
   Admin page in the web console, or through the
   [set-member-role API](/api/assign-member-role).
-- `owner` comes from the `owners` setting or an owner OIDC trust; it is never
-  assigned as a tenant membership.
+- `owner` comes from `authorization.owners` or `authorization.ownerTrusts`; it is
+  never assigned as a tenant membership and never granted through the API.
 - A federated token is matched against every trust registered for its issuer, and
-  the most permissive matching role wins. An owner trust outranks any
-  tenant-scoped trust the same token also matches, so a workload that a tenant
-  trust admits at `write` acts as `owner` once a matching owner trust exists.
-  Keep the subject and audience patterns on an owner trust narrow: only a
-  platform owner can create one, but a broad pattern promotes every workload it
-  matches. An owner trust always requires the `Feldera-Tenant` header to name the
-  tenant to act in.
+  the most permissive matching role wins. A configured owner trust outranks any
+  tenant-scoped trust the same token also matches, so keep its subject and
+  audience patterns narrow: a broad pattern promotes every workload it matches.
 - An API key carries a role capped at its creator's role, limited to `read` or
   `write`.
 
 ## Platform owners
 
-A new installation has no owners until you configure them. Set
-`authorization.owners` (Helm), which sets the `FELDERA_OWNERS` environment
-variable on the pipeline-manager pod, to a list of identities. Each entry matches
-an access token in one of three forms:
+A new installation has no owners until you configure them.
+
+Owners are configured in Helm. Set `authorization.owners`, which sets the
+`FELDERA_OWNERS` environment variable on the pipeline-manager pod, to a list of
+identities. Each entry matches an access token in one of three forms:
 
 | Form | Matches | Example |
 |---|---|---|
@@ -79,11 +77,25 @@ only when the identity provider marks the email verified, and an email address i
 user-facing and can change, whereas the subject is stable.
 :::
 
-An owner can pre-provision members and grant `admin` to the people who will
+Set `authorization.ownerTrusts` (environment: `FELDERA_OWNER_TRUSTS`), a list of
+OIDC trusts whose matching tokens act as owner:
+
+```yaml
+authorization:
+  ownerTrusts:
+    - issuer: "https://token.actions.githubusercontent.com"
+      subject: "repo:acme/infra:ref:refs/heads/main"
+      audience: "https://github.com/acme"
+```
+
+Trust relationships registered through the API belong to one tenant and grant at
+most `admin`.
+
+An owner can pre-provision members and grant `admin` to the users who will
 manage each tenant, from the Admin page or through the
 [set-member-role API](/api/assign-member-role).
 
-## Default role and owners
+## Default roles
 
 These settings govern how much access an authenticated user has before an admin
 or owner assigns them a role.
@@ -101,8 +113,3 @@ in. The Helm chart sets this to `write`.
 role granted to the user whose login first creates a tenant (auto-provisioning).
 It must be `read`, `write`, or `admin`, and defaults to `admin` so the creator can
 administer the tenant.
-
-`authorization.owners` (environment: `FELDERA_OWNERS`) lists the identities
-granted the platform-wide `owner` role, in the forms shown above. It is empty by
-default. At least one owner is needed to manage tenants across the installation
-and to grant `admin` in a tenant that a user did not create.
diff --git a/js-packages/web-console/src/lib/components/admin/AdminPage.svelte b/js-packages/web-console/src/lib/components/admin/AdminPage.svelte
index 69d2fa41136..4c2d563253c 100644
--- a/js-packages/web-console/src/lib/components/admin/AdminPage.svelte
+++ b/js-packages/web-console/src/lib/components/admin/AdminPage.svelte
@@ -4,20 +4,10 @@
   import { page } from '$app/state'
   import TenantList from '$lib/components/admin/TenantList.svelte'
   import UserRoleTable from '$lib/components/admin/UserRoleTable.svelte'
-  import GenericDialog from '$lib/components/dialogs/GenericDialog.svelte'
-  import NewOidcTrustForm from '$lib/components/oidcTrust/NewOidcTrustForm.svelte'
-  import { useGlobalDialog } from '$lib/compositions/layout/useGlobalDialog.svelte'
-  import {
-    deleteOidcTrust,
-    getOidcTrustList,
-    getTenants,
-    type OidcTrustDescr,
-    type Tenant
-  } from '$lib/services/pipelineManager'
+  import { getConfiguredOwners, getTenants, type Tenant } from '$lib/services/pipelineManager'
   import type { Snippet } from '$lib/types/svelte'
 
   const isOwner = $derived(page.data.feldera?.isOwner ?? false)
-  const globalDialog = useGlobalDialog()
   let errorMessage = $state('')
 
   // Owner-only: pick a tenant (by UUID) to inspect its members in place, without
@@ -31,12 +21,16 @@
       'current tenant'
   )
 
-  // Owner (platform-wide) trusts belong to no tenant, so they are fetched with
-  // the platform scope and are independent of the tenant switcher. Per-tenant
-  // trusts are managed from the "Manage OIDC trust" menu, not here.
-  const ownerTrusts = asyncReadable<OidcTrustDescr[]>([], () => getOidcTrustList(undefined, true), {
-    reloadable: true
-  })
+  // Owner comes from deploy-time configuration, so this list is read-only: the
+  // way to change it is to change the deployment. Owner-only, like the endpoint
+  // behind it.
+  const configuredOwners = asyncReadable<
+    | {
+        owners: string[]
+        owner_trusts: { issuer: string; subject: string; audience?: string | null }[]
+      }
+    | undefined
+  >(undefined, getConfiguredOwners)
 </script>
 
 {#snippet section(title: string, description: string, body: Snippet)}
@@ -87,65 +81,33 @@
   )}
 
   {#if isOwner}
-    {#snippet ownerTrustBody()}
-      <div class="scrollbar flex max-h-[40vh] flex-col gap-2 overflow-auto">
-        {#each $ownerTrusts as trust (trust.id)}
-          {#snippet deleteTrustDialog()}
-            <GenericDialog
-              content={{
-                title: `Delete owner trust '${trust.name}'?`,
-                description:
-                  'Tokens matching this trust immediately lose platform-wide owner access. This cannot be undone.',
-                onSuccess: {
-                  name: 'Delete',
-                  callback: async () => {
-                    try {
-                      await deleteOidcTrust(trust.name, undefined, true)
-                      ownerTrusts.reload?.()
-                    } catch (e) {
-                      errorMessage = e instanceof Error ? e.message : String(e)
-                    }
-                    globalDialog.dialog = null
-                  }
-                },
-                onCancel: {
-                  callback: () => {
-                    globalDialog.dialog = null
-                  }
-                }
-              }}
-              noclose
-              danger
-            ></GenericDialog>
-          {/snippet}
-          <div class="flex flex-nowrap items-center gap-2 border-b border-surface-100-900 py-2">
-            <div class="w-full">
-              <div>{trust.name}</div>
-              <div class="text-sm opacity-70">
-                <code>{trust.issuer}</code> · sub=<code>{trust.subject}</code>{#if trust.audience}
-                  · aud=<code>{trust.audience}</code>{/if}
-              </div>
-              {#if trust.description}
-                <div class="text-xs opacity-70">{trust.description}</div>
-              {/if}
+    {#snippet ownersBody()}
+      <div class="flex flex-col gap-3">
+        <div class="flex flex-col gap-1">
+          <div class="text-sm font-medium">Users</div>
+          {#each $configuredOwners?.owners ?? [] as owner (owner)}
+            <div class="text-sm"><code>{owner}</code></div>
+          {:else}
+            <div class="text-sm opacity-70">None configured</div>
+          {/each}
+        </div>
+        <div class="flex flex-col gap-1">
+          <div class="text-sm font-medium">Workloads (OIDC trust)</div>
+          {#each $configuredOwners?.owner_trusts ?? [] as trust (trust.issuer + trust.subject)}
+            <div class="text-sm">
+              <code>{trust.issuer}</code> · sub=<code>{trust.subject}</code>{#if trust.audience}
+                · aud=<code>{trust.audience}</code>{/if}
             </div>
-            <button
-              class="fd fd-trash-2 btn-icon text-[20px]"
-              aria-label="Delete {trust.name} owner trust"
-              onclick={() => (globalDialog.dialog = deleteTrustDialog)}
-            ></button>
-          </div>
-        {:else}
-          <div class="opacity-70">No owner trust relationships configured</div>
-        {/each}
+          {:else}
+            <div class="text-sm opacity-70">None configured</div>
+          {/each}
+        </div>
       </div>
-      <NewOidcTrustForm fixedRole="owner" allowOwner={true} onSuccess={() => ownerTrusts.reload?.()}
-      ></NewOidcTrustForm>
     {/snippet}
     {@render section(
-      'Owner access (platform-wide OIDC trust)',
-      'Owner trusts grant full platform access across all tenants and belong to no single tenant. This is the only place to manage them; a matching workload selects the tenant it acts in with the Feldera-Tenant header.',
-      ownerTrustBody
+      'Platform owners',
+      'Owner is configured at deploy time (authorization.owners and authorization.ownerTrusts) and cannot be granted through the API, so this list is read-only.',
+      ownersBody
     )}
 
     {#snippet tenantsBody()}
diff --git a/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte b/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte
index 2d6316697bc..4a265376924 100644
--- a/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte
+++ b/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte
@@ -5,22 +5,15 @@
   import { valibot } from 'sveltekit-superforms/adapters'
 
   import * as va from 'valibot'
-  import { page } from '$app/state'
-  import { postOidcTrust, type Role } from '$lib/services/pipelineManager'
+  import { postOidcTrust, type MemberRole } from '$lib/services/pipelineManager'
 
   const {
     onSubmit,
     onSuccess,
-    allowOwner = false,
-    fixedRole,
     tenant
   }: {
     onSubmit?: () => void
     onSuccess?: () => void
-    allowOwner?: boolean
-    // When set, the form creates trusts at exactly this role and hides the role
-    // picker (the admin page's owner-access section passes `fixedRole="owner"`).
-    fixedRole?: Role
     tenant?: string
   } = $props()
 
@@ -28,19 +21,13 @@
   // show them as a form-level error rather than pinning every one to Name.
   let submitError = $state('')
 
-  // `owner` is a platform-wide grant, so it is offered only to an owner AND only
-  // where owner trusts belong (the Admin page's owner-access section, which
-  // passes `allowOwner`). The tenant-scoped "Manage OIDC trust" menu never
-  // offers it. read/write/admin trusts are creatable by any tenant admin.
-  const canGrantOwner = allowOwner && (page.data.feldera?.isOwner ?? false)
-
   const schema = va.object({
     name: va.pipe(va.string(), va.minLength(1, 'Specify a name')),
     issuer: va.pipe(va.string(), va.minLength(1, 'Specify the issuer URL')),
     subject: va.pipe(va.string(), va.minLength(1, 'Specify a subject pattern')),
     audience: va.string(),
     description: va.string(),
-    role: va.picklist(['read', 'write', 'admin', 'owner'] as const)
+    role: va.picklist(['read', 'write', 'admin'] as const)
   })
 
   const form = superForm(
@@ -50,7 +37,7 @@
       subject: '',
       audience: '',
       description: '',
-      role: (fixedRole ?? 'read') as Role
+      role: 'read' as MemberRole
     },
     {
       SPA: true,
@@ -170,25 +157,18 @@
     </Control>
   </Field>
 
-  {#if fixedRole}
-    <input type="hidden" bind:value={$formData.role} />
-  {:else}
-    <Field {form} name="role">
-      <Control>
-        {#snippet children(attrs)}
-          <Label>Role</Label>
-          <Select class="w-full" {...attrs} bind:value={$formData.role}>
-            <option value="read">read</option>
-            <option value="write">write</option>
-            <option value="admin">admin</option>
-            {#if canGrantOwner}
-              <option value="owner">owner</option>
-            {/if}
-          </Select>
-        {/snippet}
-      </Control>
-    </Field>
-  {/if}
+  <Field {form} name="role">
+    <Control>
+      {#snippet children(attrs)}
+        <Label>Role</Label>
+        <Select class="w-full" {...attrs} bind:value={$formData.role}>
+          <option value="read">read</option>
+          <option value="write">write</option>
+          <option value="admin">admin</option>
+        </Select>
+      {/snippet}
+    </Control>
+  </Field>
 
   <p class="text-xs opacity-70">
     JWTs from <code>Issuer</code> whose <code>sub</code> matches
diff --git a/js-packages/web-console/src/lib/services/manager/index.ts b/js-packages/web-console/src/lib/services/manager/index.ts
index 902f5586788..70bd857a295 100644
--- a/js-packages/web-console/src/lib/services/manager/index.ts
+++ b/js-packages/web-console/src/lib/services/manager/index.ts
@@ -22,6 +22,7 @@ export {
   getConfig,
   getConfigAuthentication,
   getConfigDemos,
+  getConfigOwners,
   getConfigSession,
   getMetrics,
   getOidcTrust,
@@ -153,6 +154,8 @@ export type {
   ConcurrentBootstrapPhase,
   Condition,
   Configuration,
+  ConfiguredOwners,
+  ConfiguredOwnerTrust,
   ConnectOptions,
   ConnectorConfig,
   ConnectorError,
@@ -256,6 +259,11 @@ export type {
   GetConfigDemosResponses,
   GetConfigError,
   GetConfigErrors,
+  GetConfigOwnersData,
+  GetConfigOwnersError,
+  GetConfigOwnersErrors,
+  GetConfigOwnersResponse,
+  GetConfigOwnersResponses,
   GetConfigResponse,
   GetConfigResponses,
   GetConfigSessionData,
diff --git a/js-packages/web-console/src/lib/services/manager/sdk.gen.ts b/js-packages/web-console/src/lib/services/manager/sdk.gen.ts
index 75270517445..23d9a6d9836 100644
--- a/js-packages/web-console/src/lib/services/manager/sdk.gen.ts
+++ b/js-packages/web-console/src/lib/services/manager/sdk.gen.ts
@@ -65,6 +65,9 @@ import type {
   GetConfigDemosErrors,
   GetConfigDemosResponses,
   GetConfigErrors,
+  GetConfigOwnersData,
+  GetConfigOwnersErrors,
+  GetConfigOwnersResponses,
   GetConfigResponses,
   GetConfigSessionData,
   GetConfigSessionErrors,
@@ -460,6 +463,31 @@ export const getConfigDemos = <ThrowOnError extends boolean = true>(
     ...options
   })
 
+/**
+ * Get Configured Owners
+ *
+ * Required role: `owner`.
+ *
+ * List the identities that hold the platform-wide `owner` role.
+ *
+ * Owner comes from deploy-time configuration and cannot be granted through the
+ * API, so this list is read-only: changing it means changing the deployment.
+ */
+export const getConfigOwners = <ThrowOnError extends boolean = true>(
+  options?: Options<GetConfigOwnersData, ThrowOnError>
+) =>
+  (options?.client ?? client).get<
+    GetConfigOwnersResponses,
+    GetConfigOwnersErrors,
+    ThrowOnError,
+    'data'
+  >({
+    responseStyle: 'data',
+    security: [{ scheme: 'bearer', type: 'http' }],
+    url: '/v0/config/owners',
+    ...options
+  })
+
 /**
  * Get Session
  *
diff --git a/js-packages/web-console/src/lib/services/manager/types.gen.ts b/js-packages/web-console/src/lib/services/manager/types.gen.ts
index 66cd94e515f..b7f54965289 100644
--- a/js-packages/web-console/src/lib/services/manager/types.gen.ts
+++ b/js-packages/web-console/src/lib/services/manager/types.gen.ts
@@ -700,6 +700,33 @@ export type Configuration = {
   version: string
 }
 
+/**
+ * A workload identity granted `owner` by configuration.
+ */
+export type ConfiguredOwnerTrust = {
+  audience?: string | null
+  issuer: string
+  subject: string
+}
+
+/**
+ * The platform owners configured at deploy time.
+ */
+export type ConfiguredOwners = {
+  /**
+   * Workload identities granted `owner`, as configured through
+   * `authorization.ownerTrusts` / `FELDERA_OWNER_TRUSTS`.
+   */
+  owner_trusts: Array<ConfiguredOwnerTrust>
+  /**
+   * Identities granted `owner`, as configured through
+   * `authorization.owners` / `FELDERA_OWNERS`. Each entry is a
+   * provider-verified email, a bare OIDC subject, or an issuer and subject
+   * separated by a space.
+   */
+  owners: Array<string>
+}
+
 /**
  * Options for connecting to a NATS server.
  */
@@ -3269,7 +3296,7 @@ export type NewOidcTrustRequest = {
    * Trust relationship name. Unique within the tenant.
    */
   name: string
-  role?: Role | null
+  role?: MemberRole | null
   /**
    * Subject claim pattern. `*` matches any sequence of characters.
    */
@@ -6372,6 +6399,32 @@ export type GetConfigDemosResponses = {
 
 export type GetConfigDemosResponse = GetConfigDemosResponses[keyof GetConfigDemosResponses]
 
+export type GetConfigOwnersData = {
+  body?: never
+  path?: never
+  query?: never
+  url: '/v0/config/owners'
+}
+
+export type GetConfigOwnersErrors = {
+  /**
+   * Caller's role is below the required role
+   */
+  403: ErrorResponse
+  500: ErrorResponse
+}
+
+export type GetConfigOwnersError = GetConfigOwnersErrors[keyof GetConfigOwnersErrors]
+
+export type GetConfigOwnersResponses = {
+  /**
+   * Configured owners retrieved
+   */
+  200: ConfiguredOwners
+}
+
+export type GetConfigOwnersResponse = GetConfigOwnersResponses[keyof GetConfigOwnersResponses]
+
 export type GetConfigSessionData = {
   body?: never
   path?: never
@@ -6416,19 +6469,13 @@ export type GetMetricsResponse = GetMetricsResponses[keyof GetMetricsResponses]
 export type ListOidcTrustData = {
   body?: never
   path?: never
-  query?: {
-    /**
-     * Select the platform-wide owner trusts, which belong to no tenant,
-     * instead of the trusts scoped to the caller's tenant. Owner-only.
-     */
-    platform?: boolean
-  }
+  query?: never
   url: '/v0/oidc_trust'
 }
 
 export type ListOidcTrustErrors = {
   /**
-   * Caller's role is below the required role, or `platform` was set by a non-owner
+   * Caller's role is below the required role
    */
   403: ErrorResponse
   500: ErrorResponse
@@ -6487,19 +6534,13 @@ export type DeleteOidcTrustData = {
      */
     name: string
   }
-  query?: {
-    /**
-     * Select the platform-wide owner trusts, which belong to no tenant,
-     * instead of the trusts scoped to the caller's tenant. Owner-only.
-     */
-    platform?: boolean
-  }
+  query?: never
   url: '/v0/oidc_trust/{name}'
 }
 
 export type DeleteOidcTrustErrors = {
   /**
-   * Caller's role is below the required role, or `platform` was set by a non-owner
+   * Caller's role is below the required role
    */
   403: ErrorResponse
   /**
@@ -6526,19 +6567,13 @@ export type GetOidcTrustData = {
      */
     name: string
   }
-  query?: {
-    /**
-     * Select the platform-wide owner trusts, which belong to no tenant,
-     * instead of the trusts scoped to the caller's tenant. Owner-only.
-     */
-    platform?: boolean
-  }
+  query?: never
   url: '/v0/oidc_trust/{name}'
 }
 
 export type GetOidcTrustErrors = {
   /**
-   * Caller's role is below the required role, or `platform` was set by a non-owner
+   * Caller's role is below the required role
    */
   403: ErrorResponse
   /**
diff --git a/js-packages/web-console/src/lib/services/pipelineManager.ts b/js-packages/web-console/src/lib/services/pipelineManager.ts
index 6aa84add7ef..7960413b56b 100644
--- a/js-packages/web-console/src/lib/services/pipelineManager.ts
+++ b/js-packages/web-console/src/lib/services/pipelineManager.ts
@@ -14,6 +14,7 @@ import {
   getCheckpoints as _getCheckpoints,
   getClusterEvent as _getClusterEvent,
   getConfig as _getConfig,
+  getConfigOwners as _getConfigOwners,
   getConfigSession as _getConfigSession,
   getOidcTrust as _getOidcTrust,
   getPipeline as _getPipeline,
@@ -74,6 +75,7 @@ export type {
   CheckpointStatus,
   InputEndpointConfig,
   InputEndpointStatus,
+  MemberRole,
   NewOidcTrustRequest,
   // RBAC/OIDC-trust/tenant admin types (generated from the manager's OpenAPI).
   OidcTrustDescr,
@@ -641,34 +643,18 @@ export type Tenant = TenantInfo
 // changing the global acting-tenant selection. Omit it to use the current tenant.
 const tenantHdr = (tenant?: string) => (tenant ? { headers: { 'Feldera-Tenant': tenant } } : {})
 
-// `platform: true` targets the platform-wide owner trusts (which belong to no
-// tenant, and only an owner may manage) instead of a tenant's trusts.
-const platformQuery = (platform?: boolean) => (platform ? { query: { platform: true } } : {})
-
-export const getOidcTrustList = (tenant?: string, platform?: boolean, options?: FetchOptions) =>
-  mapResponse(
-    _listOidcTrust({ ...tenantHdr(tenant), ...platformQuery(platform), ...options }),
-    (v) => v ?? []
-  )
+export const getOidcTrustList = (tenant?: string, options?: FetchOptions) =>
+  mapResponse(_listOidcTrust({ ...tenantHdr(tenant), ...options }), (v) => v ?? [])
 
 export const postOidcTrust = (body: NewOidcTrustRequest, tenant?: string, options?: FetchOptions) =>
   mapResponse(_postOidcTrust({ body, ...tenantHdr(tenant), ...options }), (v) => v)
 
-export const deleteOidcTrust = (
-  name: string,
-  tenant?: string,
-  platform?: boolean,
-  options?: FetchOptions
-) =>
-  mapResponse(
-    _deleteOidcTrust({
-      path: { name },
-      ...tenantHdr(tenant),
-      ...platformQuery(platform),
-      ...options
-    }),
-    (v) => v
-  )
+export const deleteOidcTrust = (name: string, tenant?: string, options?: FetchOptions) =>
+  mapResponse(_deleteOidcTrust({ path: { name }, ...tenantHdr(tenant), ...options }), (v) => v)
+
+// The platform owners, from deploy-time configuration and read-only here.
+export const getConfiguredOwners = (options?: FetchOptions) =>
+  mapResponse(_getConfigOwners({ ...options }), (v) => v)
 
 // Tenant users & roles (min role: admin).
 
diff --git a/openapi.json b/openapi.json
index 3a6f02178dc..da06fb281ef 100644
--- a/openapi.json
+++ b/openapi.json
@@ -481,6 +481,53 @@
         ]
       }
     },
+    "/v0/config/owners": {
+      "get": {
+        "tags": [
+          "Platform"
+        ],
+        "summary": "Get Configured Owners",
+        "description": "Required role: `owner`.\n\nList the identities that hold the platform-wide `owner` role.\n\nOwner comes from deploy-time configuration and cannot be granted through the\nAPI, so this list is read-only: changing it means changing the deployment.",
+        "operationId": "get_config_owners",
+        "responses": {
+          "200": {
+            "description": "Configured owners retrieved",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ConfiguredOwners"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Caller's role is below the required role",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ErrorResponse"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "JSON web token (JWT) or API key": []
+          }
+        ]
+      }
+    },
     "/v0/config/session": {
       "get": {
         "tags": [
@@ -554,17 +601,6 @@
         "summary": "List OIDC Trust",
         "description": "Required role: `admin` or higher.",
         "operationId": "list_oidc_trust",
-        "parameters": [
-          {
-            "name": "platform",
-            "in": "query",
-            "description": "Select the platform-wide owner trusts, which belong to no tenant,\ninstead of the trusts scoped to the caller's tenant. Owner-only.",
-            "required": false,
-            "schema": {
-              "type": "boolean"
-            }
-          }
-        ],
         "responses": {
           "200": {
             "description": "Trust relationships retrieved",
@@ -580,7 +616,7 @@
             }
           },
           "403": {
-            "description": "Caller's role is below the required role, or `platform` was set by a non-owner",
+            "description": "Caller's role is below the required role",
             "content": {
               "application/json": {
                 "schema": {
@@ -699,15 +735,6 @@
             "schema": {
               "type": "string"
             }
-          },
-          {
-            "name": "platform",
-            "in": "query",
-            "description": "Select the platform-wide owner trusts, which belong to no tenant,\ninstead of the trusts scoped to the caller's tenant. Owner-only.",
-            "required": false,
-            "schema": {
-              "type": "boolean"
-            }
           }
         ],
         "responses": {
@@ -722,7 +749,7 @@
             }
           },
           "403": {
-            "description": "Caller's role is below the required role, or `platform` was set by a non-owner",
+            "description": "Caller's role is below the required role",
             "content": {
               "application/json": {
                 "schema": {
@@ -774,15 +801,6 @@
             "schema": {
               "type": "string"
             }
-          },
-          {
-            "name": "platform",
-            "in": "query",
-            "description": "Select the platform-wide owner trusts, which belong to no tenant,\ninstead of the trusts scoped to the caller's tenant. Owner-only.",
-            "required": false,
-            "schema": {
-              "type": "boolean"
-            }
           }
         ],
         "responses": {
@@ -790,7 +808,7 @@
             "description": "Trust relationship deleted"
           },
           "403": {
-            "description": "Caller's role is below the required role, or `platform` was set by a non-owner",
+            "description": "Caller's role is below the required role",
             "content": {
               "application/json": {
                 "schema": {
@@ -9067,6 +9085,50 @@
           }
         }
       },
+      "ConfiguredOwnerTrust": {
+        "type": "object",
+        "description": "A workload identity granted `owner` by configuration.",
+        "required": [
+          "issuer",
+          "subject"
+        ],
+        "properties": {
+          "audience": {
+            "type": "string",
+            "nullable": true
+          },
+          "issuer": {
+            "type": "string"
+          },
+          "subject": {
+            "type": "string"
+          }
+        }
+      },
+      "ConfiguredOwners": {
+        "type": "object",
+        "description": "The platform owners configured at deploy time.",
+        "required": [
+          "owners",
+          "owner_trusts"
+        ],
+        "properties": {
+          "owner_trusts": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/ConfiguredOwnerTrust"
+            },
+            "description": "Workload identities granted `owner`, as configured through\n`authorization.ownerTrusts` / `FELDERA_OWNER_TRUSTS`."
+          },
+          "owners": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Identities granted `owner`, as configured through\n`authorization.owners` / `FELDERA_OWNERS`. Each entry is a\nprovider-verified email, a bare OIDC subject, or an issuer and subject\nseparated by a space."
+          }
+        }
+      },
       "ConnectOptions": {
         "type": "object",
         "description": "Options for connecting to a NATS server.",
@@ -11730,7 +11792,7 @@
           "role": {
             "allOf": [
               {
-                "$ref": "#/components/schemas/Role"
+                "$ref": "#/components/schemas/MemberRole"
               }
             ],
             "nullable": true
diff --git a/python/feldera/rest/feldera_client.py b/python/feldera/rest/feldera_client.py
index 3ffb999ddc9..bfce7604eb4 100644
--- a/python/feldera/rest/feldera_client.py
+++ b/python/feldera/rest/feldera_client.py
@@ -1733,7 +1733,7 @@ def create_oidc_trust(
 
         Any JWT signed by `issuer` whose `sub` claim matches `subject`
         (and, if specified, `aud` claim matches `audience`) is authorized
-        to act as the current tenant with the granted `role`. `*` is a
+        to act in the current tenant with the granted `role`. `*` is a
         wildcard in `subject` and `audience`.
 
         :param name: Unique name within the tenant.
@@ -1742,9 +1742,9 @@ def create_oidc_trust(
         :param audience: Pattern matched against the JWT `aud` claim. Omit
                          to skip audience matching.
         :param description: Free-text description.
-        :param role: Role granted to a matching token (`read`, `write`, or
-                     `admin`; `owner` only for a platform owner). Capped at the
-                     caller's role. Defaults to `read` server-side when omitted.
+        :param role: Role granted to a matching token: `read`, `write` or
+                     `admin`, capped at the caller's role. Defaults to `read`
+                     server-side when omitted.
         :returns: A dict with keys `id` and `name`.
         :raises FelderaAPIError: If `name` is already in use or fields are
                                  invalid.

From 32565a3077ac951b9daa8d4a03de4a80e01e6291 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Mon, 27 Jul 2026 22:45:31 -0700
Subject: [PATCH 33/55] [pipeline-manager] Honour an owner trust from the login
 provider

A configured owner trust was consulted only for tokens from an issuer other
than the one users log in through. Write one for your own identity provider and
nothing happened: the login path decided owner from `--owners` alone. Both
configured routes to `owner` now count on both paths.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 crates/pipeline-manager/src/auth.rs | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/crates/pipeline-manager/src/auth.rs b/crates/pipeline-manager/src/auth.rs
index e6fc906f752..743a7fbc586 100644
--- a/crates/pipeline-manager/src/auth.rs
+++ b/crates/pipeline-manager/src/auth.rs
@@ -522,8 +522,17 @@ async fn bearer_auth(
             } else {
                 None
             };
+            // Either configured way of being an owner counts here. A trust is
+            // usually written for a foreign issuer, but one naming the login
+            // provider is a reasonable thing to write, and silently ignoring it
+            // would be a trap.
             let is_owner =
-                is_configured_owner(&state.config.owners, &provider, &subject, verified_email);
+                is_configured_owner(&state.config.owners, &provider, &subject, verified_email)
+                    || state.config.owner_trusts.admits(
+                        &provider,
+                        &subject,
+                        &audiences_from_claim(token_data.claims.aud.as_ref()),
+                    );
 
             if is_owner {
                 // The owner's home tenant comes from its claims, ignoring the

From c71a056d13be0f89ac73462367e56ae95dce5b89 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Mon, 27 Jul 2026 22:45:31 -0700
Subject: [PATCH 34/55] [scripts] Cover config-only owner in the RBAC demo

The demo passed unchanged after `owner` became configuration only, because it
exercised none of it. It now configures an owner trust alongside the owner user
and checks what the change turned on: a workload token reaching the tenant
routes with no Feldera-Tenant header, which is how automation creates the first
tenant, and `GET /v0/config/owners` answering owners but not admins.

Asking for a trust at `owner` is refused with 400 rather than 403, since the
request type has no such value, so the matrix grew a third expectation to say
that rather than call it an access denial.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 scripts/rbac_demo.py | 48 +++++++++++++++++++++++++++++++++++++-------
 scripts/rbac_up.sh   |  4 ++++
 2 files changed, 45 insertions(+), 7 deletions(-)

diff --git a/scripts/rbac_demo.py b/scripts/rbac_demo.py
index 8f4714ccf4a..0e02d22c50e 100755
--- a/scripts/rbac_demo.py
+++ b/scripts/rbac_demo.py
@@ -31,6 +31,7 @@
   | role  | email             | how the role is granted                         |
   |-------|-------------------|-------------------------------------------------|
   | owner | owner@example.com | FELDERA_OWNERS (config); acts in any tenant     |
+  | owner | ci-bot (no login) | FELDERA_OWNER_TRUSTS (config); a workload token  |
   | admin | admin@example.com | owner assigns 'admin' in tenant acme            |
   | write | writer@example.com| owner assigns 'write' in tenant acme            |
   | read  | reader@example.com| default role on first login to acme             |
@@ -38,6 +39,7 @@
 
 import argparse
 import sys
+import time
 import requests
 
 TENANT_HEADER = "Feldera-Tenant"
@@ -75,6 +77,8 @@ def main() -> int:
     print(f"Minting tokens from {args.oidc} ...")
     tok = {
         "owner": mint(args.oidc, "owner", "owner@example.com", None),
+        # A workload the deployment trusts as owner, with no login behind it.
+        "ownertrust": mint(args.oidc, "ci-bot", None, None),
         "admin": mint(args.oidc, "admin", "admin@example.com", [tenant]),
         "write": mint(args.oidc, "writer", "writer@example.com", [tenant]),
         "read": mint(args.oidc, "reader", "reader@example.com", [tenant]),
@@ -133,7 +137,7 @@ def main() -> int:
     # 6. Verification matrix: each row is (role, method, path, expected, note).
     #    `expected` is the status family we assert: 'ok' = not 403, 'deny' = 403.
     print("\n" + "=" * 72)
-    print("VERIFICATION MATRIX (deny = 403 by RBAC; ok = passed RBAC)")
+    print("VERIFICATION MATRIX (ok = 2xx; deny = 403 by RBAC; invalid = 400)")
     print("=" * 72)
     checks = [
         ("read", "GET", "/pipelines", None, "ok", "monitor"),
@@ -172,18 +176,48 @@ def main() -> int:
             "ok",
             "create trust (write needs concrete audience)",
         ),
+        (
+            "admin",
+            "POST",
+            "/oidc_trust",
+            {"name": "t2", "issuer": "https://x", "subject": "s", "role": "owner"},
+            "invalid",
+            "owner is configuration only",
+        ),
         ("admin", "GET", "/tenants", None, "deny", "owner only"),
         ("owner", "GET", "/tenants", None, "ok", "platform view"),
         ("owner", "GET", "/tenant/users", None, "ok", "acts in tenant"),
+        ("admin", "GET", "/config/owners", None, "deny", "owner only"),
+        ("owner", "GET", "/config/owners", None, "ok", "who holds owner"),
+        # The configured owner trust, with no Feldera-Tenant header at all: this
+        # is how automation reaches the tenant routes on a fresh deployment,
+        # where there is no tenant to name yet.
+        ("ownertrust", "GET", "/tenants", None, "ok", "no header needed", None),
+        (
+            "ownertrust",
+            "POST",
+            "/tenants",
+            {"name": f"bootstrap-{int(time.time())}"},
+            "ok",
+            "creates a tenant with no header",
+            None,
+        ),
     ]
     passed = failed = 0
-    for role, method, path, body, expected, note in checks:
-        tn = tenant if role in ("read", "write", "admin", "owner") else None
+    # A row carries (role, method, path, body, expected, note) and acts in
+    # `tenant`; a seventh element overrides the Feldera-Tenant header, where
+    # None means the request sends none.
+    for check in checks:
+        role, method, path, body, expected, note = check[:6]
+        tn = check[6] if len(check) > 6 else tenant
         code, _ = call(m, method, path, tok[role], tenant=tn, body=body)
-        # ok = passed RBAC and the action succeeded (2xx); deny = blocked by RBAC (403).
-        # Anything else (401, 5xx) is an unexpected failure, not a pass.
-        good = (expected == "deny" and code == 403) or (
-            expected == "ok" and 200 <= code < 300
+        # ok = passed RBAC and the action succeeded (2xx); deny = blocked by RBAC
+        # (403); invalid = the request itself is not expressible (400). Anything
+        # else (401, 5xx) is an unexpected failure, not a pass.
+        good = (
+            (expected == "deny" and code == 403)
+            or (expected == "invalid" and code == 400)
+            or (expected == "ok" and 200 <= code < 300)
         )
         passed += good
         failed += not good
diff --git a/scripts/rbac_up.sh b/scripts/rbac_up.sh
index 7070aef3df1..31b2e63ea75 100755
--- a/scripts/rbac_up.sh
+++ b/scripts/rbac_up.sh
@@ -47,11 +47,15 @@ for _ in $(seq 1 30); do
 done
 
 echo "== starting pipeline-manager (:8080, auth on, owner=owner@example.com) =="
+# Two ways to be an owner, both configured here and neither grantable at
+# runtime: a user (FELDERA_OWNERS) and a workload (FELDERA_OWNER_TRUSTS), the
+# latter standing in for CI that holds no login.
 AUTH_PROVIDER=generic-oidc \
 FELDERA_AUTH_CLIENT_ID=feldera \
 FELDERA_AUTH_ISSUER=http://localhost:9876 \
 FELDERA_AUTH_AUDIENCE=feldera-api \
 FELDERA_OWNERS=owner@example.com \
+FELDERA_OWNER_TRUSTS='[{"issuer": "http://localhost:9876", "subject": "ci-bot", "audience": "feldera-api"}]' \
 FELDERA_UNSTABLE_FEATURES='runtime_version,testing' \
   "$BIN" \
     --pg-embed-working-directory="$DEMO/pg" \

From e2f620e54ac42d8277051d28bcb46b4775f98e46 Mon Sep 17 00:00:00 2001
From: Karakatiza666 <bulakh.96@gmail.com>
Date: Tue, 28 Jul 2026 13:22:55 +0000
Subject: [PATCH 35/55] [web-console] Add proper role-based feature gating

Signed-off-by: Karakatiza666 <bulakh.96@gmail.com>
---
 crates/pipeline-manager/src/api/main.rs       |  29 ++
 crates/pipeline-manager/src/config.rs         |   1 +
 js-packages/web-console/AUTH_AND_TENANCY.md   | 150 +++++++
 .../src/lib/components/admin/AdminPage.svelte |   9 +-
 .../components/apiKey/NewApiKeyForm.svelte    |  15 +-
 .../lib/components/auth/ProfileButton.svelte  |  20 +-
 .../src/lib/components/auth/RBAC.svelte       |  43 ++
 .../lib/components/auth/RBAC.svelte.spec.ts   |  68 ++++
 .../lib/components/auth/RBACHarness.svelte    |  16 +
 .../components/dialogs/GenericDialog.svelte   |  33 +-
 .../dialogs/GenericDialog.svelte.spec.ts      |  10 +
 .../lib/components/dialogs/JSONDialog.svelte  |  17 +-
 .../dialogs/JSONDialog.svelte.spec.ts         |  31 ++
 .../lib/components/dialogs/JSONForm.svelte    |   5 +-
 .../components/dialogs/MultiJSONDialog.svelte |  14 +-
 .../dialogs/MultiJSONDialog.svelte.spec.ts    |  35 ++
 .../layout/pipelines/PipelineCodePanel.svelte |  12 +-
 .../PipelineConfigurationsPopup.svelte        |  18 +-
 .../pipelines/PipelineEditLayout.svelte       |  16 +-
 .../src/lib/components/other/DemoTile.svelte  |  15 +-
 .../components/other/DemoTile.svelte.spec.ts  |  72 ++++
 .../pipelines/CreatePipelineButton.svelte     |  58 +--
 .../CreatePipelineButton.svelte.spec.ts       |  48 +++
 .../pipelines/editor/CodeEditor.svelte        |   7 +-
 .../pipelines/editor/InteractionPanel.svelte  |  47 ++-
 .../editor/InteractionPanel.svelte.spec.ts    |  98 +++++
 .../pipelines/editor/MonitoringPanel.svelte   |  11 +-
 .../editor/MonitoringPanel.svelte.spec.ts     | 109 +++++
 .../editor/ReviewPipelineChangesDialog.svelte |  35 +-
 .../editor/StorageInUseBanner.svelte          |  12 +-
 .../editor/TabAdHocQuery.svelte.spec.ts       |   7 +
 .../pipelines/editor/TabPerformance.svelte    |   4 +-
 .../performance/CheckpointsIndicator.svelte   |   9 +-
 .../CheckpointsIndicator.svelte.spec.ts       |  52 ++-
 .../performance/CheckpointsStatus.svelte      |   4 +-
 .../CheckpointsStatus.svelte.spec.ts          |  43 ++
 .../components/pipelines/list/Actions.svelte  | 345 ++++++++--------
 .../pipelines/table/AvailableActions.svelte   |  14 +-
 .../table/PipelineVersionTooltip.svelte       |  11 +-
 .../components/pipelines/table/Tags.svelte    | 287 +++++++------
 .../pipelines/table/Tags.svelte.spec.ts       |  41 +-
 .../compositions/pipelines/useTryPipeline.ts  |   3 +
 .../lib/compositions/usePermission.svelte.ts  |  15 +
 .../src/lib/services/pipelineManager.ts       |   2 +-
 .../web-console/src/lib/services/rbac.spec.ts | 172 ++++++++
 .../web-console/src/lib/services/rbac.ts      |  92 +++++
 .../(system)/(authenticated)/admin/+page.ts   |   7 +-
 js-packages/web-console/src/routes/+layout.ts |  18 +-
 .../web-console/web-console-permissions.md    | 378 ++++++++++++++++++
 scripts/rbac_up.sh                            |  21 +-
 50 files changed, 2128 insertions(+), 451 deletions(-)
 create mode 100644 js-packages/web-console/AUTH_AND_TENANCY.md
 create mode 100644 js-packages/web-console/src/lib/components/auth/RBAC.svelte
 create mode 100644 js-packages/web-console/src/lib/components/auth/RBAC.svelte.spec.ts
 create mode 100644 js-packages/web-console/src/lib/components/auth/RBACHarness.svelte
 create mode 100644 js-packages/web-console/src/lib/components/dialogs/JSONDialog.svelte.spec.ts
 create mode 100644 js-packages/web-console/src/lib/components/dialogs/MultiJSONDialog.svelte.spec.ts
 create mode 100644 js-packages/web-console/src/lib/components/other/DemoTile.svelte.spec.ts
 create mode 100644 js-packages/web-console/src/lib/components/pipelines/CreatePipelineButton.svelte.spec.ts
 create mode 100644 js-packages/web-console/src/lib/components/pipelines/editor/InteractionPanel.svelte.spec.ts
 create mode 100644 js-packages/web-console/src/lib/compositions/usePermission.svelte.ts
 create mode 100644 js-packages/web-console/src/lib/services/rbac.spec.ts
 create mode 100644 js-packages/web-console/src/lib/services/rbac.ts
 create mode 100644 js-packages/web-console/web-console-permissions.md

diff --git a/crates/pipeline-manager/src/api/main.rs b/crates/pipeline-manager/src/api/main.rs
index 87b737544ba..ce94d2f7aaf 100644
--- a/crates/pipeline-manager/src/api/main.rs
+++ b/crates/pipeline-manager/src/api/main.rs
@@ -1376,6 +1376,35 @@ mod tests {
         );
     }
 
+    /// A JSON write (create/patch pipeline) carries `Content-Type:
+    /// application/json`, whose non-safelisted value forces the browser to
+    /// preflight and request the `content-type` header. If the server's CORS
+    /// allowlist drops `content-type`, actix-cors 400s the preflight and every
+    /// cross-origin write breaks while reads keep working.
+    #[actix_web::test]
+    async fn v0_preflight_allows_json_write_headers() {
+        let cfg = ApiServerConfig::test_config();
+        let app = test::init_service(build_app(&cfg, &None)).await;
+
+        let req = test::TestRequest::default()
+            .method(Method::OPTIONS)
+            .uri("/v0/pipelines")
+            .insert_header((header::ORIGIN, "http://example.com"))
+            .insert_header((header::ACCESS_CONTROL_REQUEST_METHOD, "POST"))
+            .insert_header((
+                header::ACCESS_CONTROL_REQUEST_HEADERS,
+                "authorization, content-type",
+            ))
+            .to_request();
+        let res = test::call_service(&app, req).await;
+
+        assert!(
+            res.status().is_success(),
+            "JSON-write preflight returned {} — cross-origin create/patch will be blocked",
+            res.status(),
+        );
+    }
+
     /// Guards the static-asset middleware's blast radius: GET responses on
     /// the credentialed-CORS routes (`/v0/*`, `/config/authentication`) must
     /// never carry the static-only `ACAO: *` or `Cache-Control: immutable`.
diff --git a/crates/pipeline-manager/src/config.rs b/crates/pipeline-manager/src/config.rs
index b9185cf9f3c..478d6ce6b1d 100644
--- a/crates/pipeline-manager/src/config.rs
+++ b/crates/pipeline-manager/src/config.rs
@@ -1116,6 +1116,7 @@ impl ApiServerConfig {
                 .allowed_headers(vec![
                     header::AUTHORIZATION,
                     header::ACCEPT,
+                    header::CONTENT_TYPE,
                     header::HeaderName::from_static(crate::auth::TENANT_HEADER),
                 ])
                 .supports_credentials()
diff --git a/js-packages/web-console/AUTH_AND_TENANCY.md b/js-packages/web-console/AUTH_AND_TENANCY.md
new file mode 100644
index 00000000000..cb0391511dd
--- /dev/null
+++ b/js-packages/web-console/AUTH_AND_TENANCY.md
@@ -0,0 +1,150 @@
+# Auth, RBAC and tenancy in web-console
+
+What the pipeline manager's RBAC / OIDC-trust / tenant-management system exposes,
+and how web-console sees and uses it today. Reference for gating UI on permissions.
+
+## Roles
+
+One ordered role scale. Declaration order is the privilege order; higher includes lower.
+
+| Role    | Rank | Held by                                                    |
+| ------- | ---- | ---------------------------------------------------------- |
+| `read`  | 0    | interactive login, API key, OIDC trust                     |
+| `write` | 1    | interactive login, API key, OIDC trust                     |
+| `admin` | 2    | interactive login, OIDC trust (not API keys)               |
+| `owner` | 3    | interactive login, platform-wide OIDC trust (not API keys) |
+
+Distinct role subsets exist for different principals:
+
+- `Role` (`read | write | admin | owner`): the full scale. A session's role, a member's role, an OIDC trust's role.
+- `MemberRole` (`read | write | admin`): assignable to a tenant member. `owner` is platform-wide, not a tenant membership, so it is never assigned as a member role. An owner resolved by the IdP can still appear in the member list and is shown read-only.
+- `MintableKeyRole` (`read | write`): an API key carries exactly one. `admin`/`owner` are never issuable as keys.
+
+`owner` is platform-wide (spans all tenants); `read`/`write`/`admin` are per-tenant.
+
+## How web-console sees the current user's permissions
+
+The role comes from the session payload, not the JWT. `GET /v0/config/session` returns `SessionInfo`:
+
+```
+SessionInfo { tenant_id, tenant_name, role }   // role: read | write | admin | owner
+```
+
+`src/routes/+layout.ts` reads it into `page.data.feldera`:
+
+| `page.data.feldera` field | Source                          | Use                             |
+| ------------------------- | ------------------------------- | ------------------------------- |
+| `role`                    | `roleOf(sessionConfig.role)`    | normalized role, default `read` |
+| `permissions`             | `permissionsOf(role)`           | the list UI gates read          |
+| `tenantId`, `tenantName`  | `sessionConfig.tenant_id/_name` | current acting tenant           |
+| `authorizedTenants?`      | JWT `tenants` claim (decoded)   | multi-tenant switch list        |
+
+`role` is the whole permission surface the backend sends: one ordered role,
+`read < write < admin < owner`, no separate capability list or resource-level
+ACLs. web-console does not gate on the role rank directly. At init `+layout.ts`
+materializes `permissions` from the role via the client role to permission map
+(see `web-console-permissions.md`), shaped as if the server had sent the list, so
+each UI gate names the permission it needs and reads `permissions` for it.
+
+`authorizedTenants` is the only value read from the token: the `tenants` claim
+(array, or comma-separated string) lists tenants a multi-tenant login may act in.
+An owner's token typically carries no `tenants` claim.
+
+## Tenancy and the acting tenant
+
+A request acts within one tenant, chosen by the `Feldera-Tenant` header.
+
+- Global selection: `getSelectedTenant()` / `setSelectedTenant()` (`src/lib/services/auth.ts`), persisted per session. `applyAuthToRequest` adds it as `Feldera-Tenant` on every call.
+- Per-call override: a request that already sets `Feldera-Tenant` wins over the global selection. This lets an owner inspect/manage one tenant on the admin page without moving the global selection.
+- Tenants resolve by name. A login lands in the tenant whose name the IdP asserts; `initial_provider` on a tenant is provenance only and does not steer routing.
+
+## API surface and minimum roles
+
+All new endpoints and the role they require:
+
+| Method + path                       | Min role | Purpose                                  |
+| ----------------------------------- | -------- | ---------------------------------------- |
+| `GET  /v0/tenant/users`             | admin    | list members of the acting tenant        |
+| `POST /v0/tenant/users`             | admin    | pre-provision a member by identity       |
+| `PUT  /v0/tenant/users/{user_id}`   | admin    | assign/change a member's role            |
+| `DELETE /v0/tenant/users/{user_id}` | admin    | remove a member from the acting tenant   |
+| `GET  /v0/oidc_trust`               | admin    | list OIDC trusts (tenant or `?platform`) |
+| `POST /v0/oidc_trust`               | admin    | create an OIDC trust                     |
+| `GET  /v0/oidc_trust/{name}`        | admin    | get one OIDC trust                       |
+| `DELETE /v0/oidc_trust/{name}`      | admin    | delete an OIDC trust                     |
+| `GET  /v0/tenants`                  | owner    | list all tenants in the installation     |
+| `POST /v0/tenants`                  | owner    | create a tenant                          |
+| `PATCH /v0/tenants/{tenant_id}`     | owner    | rename a tenant                          |
+| `DELETE /v0/tenants/{tenant_id}`    | owner    | delete an empty tenant                   |
+
+Existing API-key routes now require at least `write` (a read-only caller cannot
+even list keys). `POST /v0/api_keys` takes an optional `role` (`read`/`write`,
+default `read`).
+
+Role caps enforced server-side:
+
+- A member/key role is capped at the caller's own role and may never be `owner`.
+- Removing a member drops the role now, but if the IdP still grants access the
+  member is re-added at the default role on next login. Revoke at the provider for a durable block.
+
+### Service wrappers
+
+`src/lib/services/pipelineManager.ts` wraps the generated client. Each accepts an
+optional `tenant` (name or UUID) that sets the per-call `Feldera-Tenant` header:
+
+| Wrapper                                         | Endpoint                                |
+| ----------------------------------------------- | --------------------------------------- |
+| `getTenantUsers(tenant?)`                       | list members                            |
+| `addTenantUser({subject,email?,role}, tenant?)` | pre-provision member                    |
+| `setTenantUserRole(userId, role, tenant?)`      | assign role                             |
+| `removeTenantUser(userId, tenant?)`             | remove member                           |
+| `getOidcTrustList(tenant?, platform?)`          | list trusts (`platform` = owner trusts) |
+| `postOidcTrust(body, tenant?)`                  | create trust                            |
+| `deleteOidcTrust(name, tenant?, platform?)`     | delete trust                            |
+| `getTenants()`                                  | list tenants (owner)                    |
+| `createTenant(name)`                            | create tenant (owner)                   |
+| `renameTenant(id, name, displaceExisting?)`     | rename tenant (owner)                   |
+| `deleteTenant(id)`                              | delete tenant (owner)                   |
+| `postApiKey(name, role='read')`                 | create key with a role                  |
+
+The member's provider and a new tenant's provider are fixed server-side to the
+platform's single configured OIDC issuer; they are not caller-settable.
+
+## Key data shapes
+
+```
+TenantMember { user_id, provider, subject, role, email? }   // provider = OIDC issuer
+TenantInfo   { id, name, initial_provider }
+OidcTrustDescr { id, name, issuer, subject, role, audience?, description? }
+```
+
+OIDC trust matches a JWT by `issuer` (exact) plus `subject`/`audience` patterns
+where `*` matches any run of characters. A match grants the trust's `role`.
+
+## Admin dashboard
+
+Route `/admin` (`src/routes/(system)/(authenticated)/admin/+page.ts`). Gated in
+`load`: entry requires `role` of `admin` or `owner`; anyone else is redirected home.
+
+`AdminPage.svelte` composes:
+
+| Section                                 | Visible to | Component / action                                                                  |
+| --------------------------------------- | ---------- | ----------------------------------------------------------------------------------- |
+| Tenant switcher (view members of ...)   | owner      | picks a tenant UUID; scopes the members table only, not the global selection        |
+| Users & roles                           | admin+     | `UserRoleTable`: list members, add by subject/email/role, change role, remove       |
+| Owner access (platform-wide OIDC trust) | owner      | list/create/delete `?platform` trusts, role fixed to `owner`                        |
+| Tenants                                 | owner      | `TenantList`: list, create, rename (with `displace_existing`), delete empty tenants |
+
+Per-tenant OIDC trust (read/write/admin for CI and services) is managed from the
+"Manage OIDC trust" menu (`OidcTrustMenu.svelte`), not the admin page. The admin
+page's trust section is only the platform-wide owner trusts.
+
+## Where the UI already gates on role
+
+| Location               | Rule                                                                                                    |
+| ---------------------- | ------------------------------------------------------------------------------------------------------- |
+| `admin/+page.ts`       | redirect unless `admin` or `owner`                                                                      |
+| `ProfileButton.svelte` | "Admin" and "Manage OIDC trust" shown only to `admin`/`owner`; "Manage API keys" shown only to `write`+ |
+| `NewApiKeyForm.svelte` | `write` option offered only when caller is `write`+; otherwise `read` only                              |
+| `AdminPage.svelte`     | tenant switcher, read-only Platform owners and tenants sections behind `write:tenant`                   |
+| `UserRoleTable.svelte` | `owner` rows shown read-only (not assignable as a member role)                                          |
diff --git a/js-packages/web-console/src/lib/components/admin/AdminPage.svelte b/js-packages/web-console/src/lib/components/admin/AdminPage.svelte
index 4c2d563253c..5f85f37316d 100644
--- a/js-packages/web-console/src/lib/components/admin/AdminPage.svelte
+++ b/js-packages/web-console/src/lib/components/admin/AdminPage.svelte
@@ -4,10 +4,13 @@
   import { page } from '$app/state'
   import TenantList from '$lib/components/admin/TenantList.svelte'
   import UserRoleTable from '$lib/components/admin/UserRoleTable.svelte'
+  import { usePermission } from '$lib/compositions/usePermission.svelte'
   import { getConfiguredOwners, getTenants, type Tenant } from '$lib/services/pipelineManager'
   import type { Snippet } from '$lib/types/svelte'
 
-  const isOwner = $derived(page.data.feldera?.isOwner ?? false)
+  // Tenant management (switch/list/create) is owner-only; gate on the permission
+  // rather than the role directly, in line with the rest of the RBAC surface.
+  const manageTenants = usePermission('write:tenant')
   let errorMessage = $state('')
 
   // Owner-only: pick a tenant (by UUID) to inspect its members in place, without
@@ -50,7 +53,7 @@
     <div class="rounded preset-outlined-error-600-400 p-2 text-sm">{errorMessage}</div>
   {/if}
 
-  {#if isOwner}
+  {#if manageTenants.allowed}
     <!-- Owner-only tenant switcher for the members view below. Prominent so it
          is not mistaken for a minor control. -->
     <div
@@ -80,7 +83,7 @@
     usersBody
   )}
 
-  {#if isOwner}
+  {#if manageTenants.allowed}
     {#snippet ownersBody()}
       <div class="flex flex-col gap-3">
         <div class="flex flex-col gap-1">
diff --git a/js-packages/web-console/src/lib/components/apiKey/NewApiKeyForm.svelte b/js-packages/web-console/src/lib/components/apiKey/NewApiKeyForm.svelte
index 55dcee39e7f..ad0a67f1080 100644
--- a/js-packages/web-console/src/lib/components/apiKey/NewApiKeyForm.svelte
+++ b/js-packages/web-console/src/lib/components/apiKey/NewApiKeyForm.svelte
@@ -4,20 +4,13 @@
   import { setError, superForm } from 'sveltekit-superforms'
   import { valibot } from 'sveltekit-superforms/adapters'
   import * as va from 'valibot'
-  import { page } from '$app/state'
   import ClipboardCopyButton from '$lib/components/other/ClipboardCopyButton.svelte'
   import { usePipelineManager } from '$lib/compositions/usePipelineManager.svelte'
 
   const { onSubmit, onSuccess }: { onSubmit?: () => void; onSuccess?: () => void } = $props()
 
-  // A key can grant at most the caller's own role, and never above `write`
-  // (admin/owner are not mintable). So a read-only caller sees read only, and
-  // offering `write` to them (a guaranteed 403) is avoided.
-  const canGrantWrite = $derived(
-    ['write', 'admin', 'owner'].includes(page.data.feldera?.role ?? 'read')
-  )
-
-  // API keys may only grant read or write; admin/owner are not valid here.
+  // Reaching this form requires `write:api_key`, so the caller can always mint a
+  // `write` key. Keys may grant read or write only; admin/owner are not mintable.
   const schema = va.object({
     name: va.pipe(va.string(), va.minLength(1, 'Specify API key name')),
     role: va.picklist(['read', 'write'] as const)
@@ -78,9 +71,7 @@
             />
             <Select bind:value={$formData.role} class="w-28" aria-label="API key role">
               <option value="read">read</option>
-              {#if canGrantWrite}
-                <option value="write">write</option>
-              {/if}
+              <option value="write">write</option>
             </Select>
             <div class="">
               <button class="btn preset-filled-surface-50-950">Generate</button>
diff --git a/js-packages/web-console/src/lib/components/auth/ProfileButton.svelte b/js-packages/web-console/src/lib/components/auth/ProfileButton.svelte
index c49e4dddfeb..9454e9cbd67 100644
--- a/js-packages/web-console/src/lib/components/auth/ProfileButton.svelte
+++ b/js-packages/web-console/src/lib/components/auth/ProfileButton.svelte
@@ -2,6 +2,7 @@
   import { fade } from 'svelte/transition'
   import { page } from '$app/state'
   import CurrentTenant from '$lib/components/auth/CurrentTenant.svelte'
+  import RBAC from '$lib/components/auth/RBAC.svelte'
   import Popup from '$lib/components/common/Popup.svelte'
   import DarkModeSwitch from '$lib/components/layout/userPopup/DarkModeSwitch.svelte'
   import ApiKeyMenu from '$lib/components/other/ApiKeyMenu.svelte'
@@ -19,11 +20,6 @@
     healthStatus
   }: { compactBreakpoint?: string; healthStatus: ClusterHealthStatus } = $props()
   const auth = page.data.auth as AuthDetails | undefined
-  const role = $derived(page.data.feldera?.role)
-  const canAdminister = $derived(role === 'admin' || role === 'owner')
-  // Every /v0/api_keys route requires at least `write`, so a read-only caller
-  // cannot even list keys; hide the menu for them entirely.
-  const canManageApiKeys = $derived(role === 'write' || role === 'admin' || role === 'owner')
 
   const globalDialog = useGlobalDialog()
 
@@ -91,21 +87,19 @@
         {/snippet}
 
         {#if typeof auth === 'object' && 'logout' in auth}
-          {#if canAdminister}
+          <RBAC require="write:tenant_member">
             {@render profileItemButton('Admin', adminIcon, { href: resolve('/admin') })}
-          {/if}
-          {#if canManageApiKeys}
+          </RBAC>
+          <RBAC require="write:api_key">
             {@render profileItemButton('Manage API keys', apiKeysIcon, {
               onclick: () => (globalDialog.dialog = apiKeyDialog)
             })}
-          {/if}
-          <!-- OIDC trust management is admin-only (the endpoints require admin),
-               so only surface it when the caller can actually use it. -->
-          {#if canAdminister}
+          </RBAC>
+          <RBAC require="write:oidc_trust">
             {@render profileItemButton('Manage OIDC trust', oidcTrustIcon, {
               onclick: () => (globalDialog.dialog = oidcTrustDialog)
             })}
-          {/if}
+          </RBAC>
 
           <div class="hr"></div>
         {/if}
diff --git a/js-packages/web-console/src/lib/components/auth/RBAC.svelte b/js-packages/web-console/src/lib/components/auth/RBAC.svelte
new file mode 100644
index 00000000000..bb95d09a74e
--- /dev/null
+++ b/js-packages/web-console/src/lib/components/auth/RBAC.svelte
@@ -0,0 +1,43 @@
+<script lang="ts" module>
+  export type RBACState = {
+    allowed: boolean
+    // Spread onto the gated element to apply the read-only look when disallowed;
+    // empty object when allowed.
+    disabledProps: Record<string, unknown>
+  }
+</script>
+
+<script lang="ts">
+  import type { Snippet } from 'svelte'
+  import { page } from '$app/state'
+  import { hasPermissions, type Permission } from '$lib/services/rbac'
+
+  let {
+    require: permission,
+    mode = 'hide',
+    message = 'You have read-only access',
+    children
+  }: {
+    require: Permission
+    mode?: 'hide' | 'disable'
+    message?: string
+    children: Snippet<[RBACState]>
+  } = $props()
+
+  const allowed = $derived(hasPermissions(page.data.feldera, permission))
+  const state = $derived<RBACState>({
+    allowed,
+    disabledProps: allowed
+      ? {}
+      : {
+          disabled: true,
+          'aria-disabled': 'true',
+          title: message,
+          class: 'pointer-events-none opacity-50'
+        }
+  })
+</script>
+
+{#if mode === 'disable' || allowed}
+  {@render children(state)}
+{/if}
diff --git a/js-packages/web-console/src/lib/components/auth/RBAC.svelte.spec.ts b/js-packages/web-console/src/lib/components/auth/RBAC.svelte.spec.ts
new file mode 100644
index 00000000000..af672470abb
--- /dev/null
+++ b/js-packages/web-console/src/lib/components/auth/RBAC.svelte.spec.ts
@@ -0,0 +1,68 @@
+// Component tests for the RBAC gating wrapper: hide vs disable modes and the
+// disabledProps contract, across roles. The role comes from a mocked
+// `$app/state` page, read at render time.
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { page } from 'vitest/browser'
+import { render } from 'vitest-browser-svelte'
+import { permissionsOf } from '$lib/services/rbac'
+
+const roleState = vi.hoisted(() => ({ current: 'read' as 'read' | 'write' | 'admin' | 'owner' }))
+vi.mock('$app/state', () => ({
+  page: {
+    data: {
+      get feldera() {
+        return { role: roleState.current, permissions: permissionsOf(roleState.current) }
+      }
+    }
+  }
+}))
+
+import RBACHarness from './RBACHarness.svelte'
+
+afterEach(() => {
+  roleState.current = 'read'
+})
+
+describe('RBAC.svelte', () => {
+  describe('mode="hide" (default)', () => {
+    it('renders the child when the role grants the permission', async () => {
+      roleState.current = 'write'
+      await render(RBACHarness, { require: 'write:pipeline' })
+      await expect.element(page.getByTestId('child')).toBeInTheDocument()
+    })
+
+    it('omits the child when the role lacks the permission', async () => {
+      roleState.current = 'read'
+      await render(RBACHarness, { require: 'write:pipeline' })
+      await expect.element(page.getByTestId('child')).not.toBeInTheDocument()
+    })
+
+    it('always renders read-floor permissions', async () => {
+      roleState.current = 'read'
+      await render(RBACHarness, { require: 'read:pipeline' })
+      await expect.element(page.getByTestId('child')).toBeInTheDocument()
+    })
+  })
+
+  describe('mode="disable"', () => {
+    it('renders the child enabled and clean when allowed', async () => {
+      roleState.current = 'write'
+      await render(RBACHarness, { require: 'write:pipeline', mode: 'disable' })
+      const child = page.getByTestId('child')
+      await expect.element(child).toBeInTheDocument()
+      await expect.element(child).not.toBeDisabled()
+      await expect.element(child).toHaveAttribute('data-allowed', 'true')
+    })
+
+    it('renders the child but applies the read-only look when disallowed', async () => {
+      roleState.current = 'read'
+      await render(RBACHarness, { require: 'write:pipeline', mode: 'disable' })
+      const child = page.getByTestId('child')
+      await expect.element(child).toBeInTheDocument()
+      await expect.element(child).toBeDisabled()
+      await expect.element(child).toHaveAttribute('aria-disabled', 'true')
+      await expect.element(child).toHaveAttribute('data-allowed', 'false')
+    })
+  })
+})
diff --git a/js-packages/web-console/src/lib/components/auth/RBACHarness.svelte b/js-packages/web-console/src/lib/components/auth/RBACHarness.svelte
new file mode 100644
index 00000000000..ffa7e4aebf5
--- /dev/null
+++ b/js-packages/web-console/src/lib/components/auth/RBACHarness.svelte
@@ -0,0 +1,16 @@
+<script lang="ts">
+  // Test-only harness: renders RBAC with a snippet child that surfaces `allowed`
+  // and spreads `disabledProps`, so the spec can assert the wrapper's hide,
+  // disable, and disabledProps behavior. Not used by the app.
+  import RBAC from '$lib/components/auth/RBAC.svelte'
+  import type { Permission } from '$lib/services/rbac'
+
+  let { require: permission, mode = 'hide' }: { require: Permission; mode?: 'hide' | 'disable' } =
+    $props()
+</script>
+
+<RBAC require={permission} {mode}>
+  {#snippet children({ allowed, disabledProps })}
+    <button data-testid="child" data-allowed={allowed} {...disabledProps}>child</button>
+  {/snippet}
+</RBAC>
diff --git a/js-packages/web-console/src/lib/components/dialogs/GenericDialog.svelte b/js-packages/web-console/src/lib/components/dialogs/GenericDialog.svelte
index 6113549ef02..00f4791e82a 100644
--- a/js-packages/web-console/src/lib/components/dialogs/GenericDialog.svelte
+++ b/js-packages/web-console/src/lib/components/dialogs/GenericDialog.svelte
@@ -14,6 +14,7 @@
     swapActions,
     children
   }: {
+    /** If neither content.onSuccess nor content.onError are provided the footer is not rendered.  */
     content: GlobalDialogContent
     danger?: boolean
     disabled?: boolean
@@ -61,7 +62,7 @@
     {/if}
     {@render children?.()}
   </div>
-  {#if content.onSuccess}
+  {#if content.onSuccess || content.onCancel}
     <div
       class="flex w-full flex-col-reverse gap-4 sm:flex-row sm:justify-end"
       data-testid="box-dialog-actions"
@@ -74,20 +75,22 @@
       >
         {content.onCancel?.name ?? 'Cancel'}
       </button>
-      <div class:order-first={swapActions}>
-        <button
-          {disabled}
-          onclick={content.onSuccess.callback}
-          class="btn px-4 {danger
-            ? 'preset-filled-error-500 font-semibold'
-            : 'preset-filled-primary-500'}"
-          data-testid={content.onSuccess['data-testid']}
-        >
-          {content.onSuccess.name}
-        </button>
-      </div>
-      {#if disabled && content.onSuccess.disabledMessage}
-        <Tooltip class="z-20 w-64" placement="top">{content.onSuccess.disabledMessage}</Tooltip>
+      {#if content.onSuccess}
+        <div class:order-first={swapActions}>
+          <button
+            {disabled}
+            onclick={content.onSuccess.callback}
+            class="btn px-4 {danger
+              ? 'preset-filled-error-500 font-semibold'
+              : 'preset-filled-primary-500'}"
+            data-testid={content.onSuccess['data-testid']}
+          >
+            {content.onSuccess.name}
+          </button>
+        </div>
+        {#if disabled && content.onSuccess.disabledMessage}
+          <Tooltip class="z-20 w-64" placement="top">{content.onSuccess.disabledMessage}</Tooltip>
+        {/if}
       {/if}
     </div>
   {/if}
diff --git a/js-packages/web-console/src/lib/components/dialogs/GenericDialog.svelte.spec.ts b/js-packages/web-console/src/lib/components/dialogs/GenericDialog.svelte.spec.ts
index 5d343fde28c..40ccc63e3ec 100644
--- a/js-packages/web-console/src/lib/components/dialogs/GenericDialog.svelte.spec.ts
+++ b/js-packages/web-console/src/lib/components/dialogs/GenericDialog.svelte.spec.ts
@@ -109,6 +109,16 @@ describe('GenericDialog.svelte', () => {
       )
       await expect.element(page.getByTestId('button-confirm-apply')).toBeInTheDocument()
     })
+
+    it('renders a dismiss button without a success button when only onCancel is set', async () => {
+      // How a read-only editor dialog drops Apply: supply onCancel, omit
+      // onSuccess. Reverting the `onSuccess || onCancel` footer gate drops the
+      // whole footer (no dismiss button) and fails this.
+      await renderDialog(makeContent({ onCancel: { name: 'Close' } }))
+      await expect.element(page.getByTestId('box-dialog-actions')).toBeInTheDocument()
+      await expect.element(page.getByTestId('btn-dialog-cancel')).toHaveTextContent('Close')
+      await expect.element(page.getByTestId('btn-dialog-success')).not.toBeInTheDocument()
+    })
   })
 
   describe('C. Close button and noclose', () => {
diff --git a/js-packages/web-console/src/lib/components/dialogs/JSONDialog.svelte b/js-packages/web-console/src/lib/components/dialogs/JSONDialog.svelte
index 8eac475da64..1656702ba63 100644
--- a/js-packages/web-console/src/lib/components/dialogs/JSONDialog.svelte
+++ b/js-packages/web-console/src/lib/components/dialogs/JSONDialog.svelte
@@ -14,7 +14,7 @@
   }: {
     value: string
     filePath: string
-    onApply: (json: string) => Promise<void>
+    onApply?: (json: string) => Promise<void>
     title: string
     readOnlyMessage?: { value: string }
     disabled?: boolean
@@ -43,16 +43,25 @@
   })
 
   const submitHandler = async () => {
-    onApply(current)
+    onApply?.(current)
   }
 </script>
 
 <GenericDialog
-  content={{ title, onSuccess: { name: 'Apply', callback: submitHandler, disabledMessage } }}
+  content={{
+    title,
+    onSuccess: onApply ? { name: 'Apply', callback: submitHandler, disabledMessage } : undefined,
+    onCancel: onApply ? undefined : { name: 'Close' }
+  }}
   {disabled}
 >
   <div class="h-96">
-    <JsonForm {filePath} onSubmit={onApply} bind:value={current} {disabled} {readOnlyMessage}
+    <JsonForm
+      {filePath}
+      onSubmit={onApply}
+      bind:value={current}
+      disabled={disabled || !onApply}
+      {readOnlyMessage}
     ></JsonForm>
   </div>
 </GenericDialog>
diff --git a/js-packages/web-console/src/lib/components/dialogs/JSONDialog.svelte.spec.ts b/js-packages/web-console/src/lib/components/dialogs/JSONDialog.svelte.spec.ts
new file mode 100644
index 00000000000..92d86c17415
--- /dev/null
+++ b/js-packages/web-console/src/lib/components/dialogs/JSONDialog.svelte.spec.ts
@@ -0,0 +1,31 @@
+/**
+ * Read-only mode test for JSONDialog. Presence of `onApply` decides the shape:
+ * with it, an Apply button; without it, no Apply and a Close button in its place
+ * (plus a read-only editor). This lets the pipeline config dialog go read-only
+ * for a caller without `write:pipeline_config` while the JSON stays viewable.
+ */
+import { describe, expect, it, vi } from 'vitest'
+import { page } from 'vitest/browser'
+import { render } from 'vitest-browser-svelte'
+import JSONDialog from './JSONDialog.svelte'
+
+const baseProps = () => ({
+  value: '{\n  "a": 1\n}',
+  filePath: 'file://feldera/pipelines/test/runtimeConfig.json',
+  title: 'Configure test'
+})
+
+describe('JSONDialog.svelte', () => {
+  it('renders the Apply button when onApply is provided', async () => {
+    render(JSONDialog, { ...baseProps(), onApply: vi.fn(async () => {}) })
+    await expect.element(page.getByRole('button', { name: 'Apply' })).toBeInTheDocument()
+  })
+
+  it('drops Apply and shows a Close button when onApply is omitted', async () => {
+    render(JSONDialog, baseProps())
+    // Reverting the onApply-driven onSuccess/onCancel shaping renders Apply and
+    // fails this.
+    await expect.element(page.getByRole('button', { name: 'Apply' })).not.toBeInTheDocument()
+    await expect.element(page.getByTestId('btn-dialog-cancel')).toHaveTextContent('Close')
+  })
+})
diff --git a/js-packages/web-console/src/lib/components/dialogs/JSONForm.svelte b/js-packages/web-console/src/lib/components/dialogs/JSONForm.svelte
index bc86ce8810d..b3afe651635 100644
--- a/js-packages/web-console/src/lib/components/dialogs/JSONForm.svelte
+++ b/js-packages/web-console/src/lib/components/dialogs/JSONForm.svelte
@@ -17,7 +17,8 @@
     refreshOnChange = true
   }: {
     filePath: string
-    onSubmit: (json: string) => Promise<void>
+    // Absent for a read-only viewer; the Ctrl+S save shortcut then does nothing.
+    onSubmit?: (json: string) => Promise<void>
     value?: string
     readOnlyMessage?: { value: string }
     disabled?: boolean
@@ -72,7 +73,7 @@
       if (e.code === 'KeyS' && (e.ctrlKey || e.metaKey)) {
         const currentValue = currentModel.getValue()
         updateUpstream()
-        onSubmit(currentValue)
+        onSubmit?.(currentValue)
         e.preventDefault()
       }
     })
diff --git a/js-packages/web-console/src/lib/components/dialogs/MultiJSONDialog.svelte b/js-packages/web-console/src/lib/components/dialogs/MultiJSONDialog.svelte
index 940f81a5e40..462196de35e 100644
--- a/js-packages/web-console/src/lib/components/dialogs/MultiJSONDialog.svelte
+++ b/js-packages/web-console/src/lib/components/dialogs/MultiJSONDialog.svelte
@@ -16,7 +16,7 @@
       string,
       { title?: string; editorClass?: string; filePath?: string; readOnlyMessage?: string }
     >
-    onApply: (values: Record<string, string>) => Promise<void>
+    onApply?: (values: Record<string, string>) => Promise<void>
     title: string
     disabled?: boolean
     disabledMessage?: string
@@ -42,12 +42,16 @@
   }
 
   const submitResults = async () => {
-    onApply(current)
+    onApply?.(current)
   }
 </script>
 
 <GenericDialog
-  content={{ title, onSuccess: { name: 'Apply', callback: submitResults, disabledMessage } }}
+  content={{
+    title,
+    onSuccess: onApply ? { name: 'Apply', callback: submitResults, disabledMessage } : undefined,
+    onCancel: onApply ? undefined : { name: 'Close' }
+  }}
   {disabled}
 >
   {#each Object.keys(current) as key}
@@ -55,12 +59,12 @@
     <div class={metadata?.[key].editorClass}>
       <JsonForm
         filePath={metadata?.[key].filePath ?? key}
-        onSubmit={submitResults}
+        onSubmit={onApply ? submitResults : undefined}
         bind:value={current[key]}
         readOnlyMessage={metadata?.[key]?.readOnlyMessage
           ? { value: metadata[key].readOnlyMessage }
           : undefined}
-        {disabled}
+        disabled={disabled || !onApply}
       ></JsonForm>
     </div>
   {/each}
diff --git a/js-packages/web-console/src/lib/components/dialogs/MultiJSONDialog.svelte.spec.ts b/js-packages/web-console/src/lib/components/dialogs/MultiJSONDialog.svelte.spec.ts
new file mode 100644
index 00000000000..3f6731fc9c7
--- /dev/null
+++ b/js-packages/web-console/src/lib/components/dialogs/MultiJSONDialog.svelte.spec.ts
@@ -0,0 +1,35 @@
+/**
+ * Read-only mode test for MultiJSONDialog. Presence of `onApply` decides the
+ * shape: with it, an Apply button; without it, no Apply and a Close button in
+ * its place (plus read-only editors). This lets the pipeline configurations
+ * popup go read-only for a caller without `write:pipeline_config` while the JSON
+ * stays viewable.
+ */
+import { describe, expect, it, vi } from 'vitest'
+import { page } from 'vitest/browser'
+import { render } from 'vitest-browser-svelte'
+import MultiJSONDialog from './MultiJSONDialog.svelte'
+
+const baseProps = () => ({
+  values: { runtimeConfig: '{\n  "a": 1\n}', programConfig: '{}' },
+  metadata: {
+    runtimeConfig: { title: 'Runtime configuration', filePath: 'file://p/RuntimeConfig.json' },
+    programConfig: { title: 'Compilation configuration', filePath: 'file://p/ProgramConfig.json' }
+  },
+  title: 'Configure test'
+})
+
+describe('MultiJSONDialog.svelte', () => {
+  it('renders the Apply button when onApply is provided', async () => {
+    render(MultiJSONDialog, { ...baseProps(), onApply: vi.fn(async () => {}) })
+    await expect.element(page.getByRole('button', { name: 'Apply' })).toBeInTheDocument()
+  })
+
+  it('drops Apply and shows a Close button when onApply is omitted', async () => {
+    render(MultiJSONDialog, baseProps())
+    // Reverting the onApply-driven onSuccess/onCancel shaping renders Apply and
+    // fails this.
+    await expect.element(page.getByRole('button', { name: 'Apply' })).not.toBeInTheDocument()
+    await expect.element(page.getByTestId('btn-dialog-cancel')).toHaveTextContent('Close')
+  })
+})
diff --git a/js-packages/web-console/src/lib/components/layout/pipelines/PipelineCodePanel.svelte b/js-packages/web-console/src/lib/components/layout/pipelines/PipelineCodePanel.svelte
index 5dbec57d8dd..bd207130e09 100644
--- a/js-packages/web-console/src/lib/components/layout/pipelines/PipelineCodePanel.svelte
+++ b/js-packages/web-console/src/lib/components/layout/pipelines/PipelineCodePanel.svelte
@@ -14,6 +14,7 @@
   import { type PipelineAction } from '$lib/services/pipelineManager'
   import { useUpdatePipelineList } from '$lib/compositions/pipelines/usePipelineList.svelte'
   import { usePipelineActionCallbacks } from '$lib/compositions/pipelines/usePipelineActionCallbacks.svelte'
+  import { usePermission } from '$lib/compositions/usePermission.svelte'
   import CodeEditor, {
     disposeFile as disposeCodeEditorFile
   } from '$lib/components/pipelines/editor/CodeEditor.svelte'
@@ -53,6 +54,9 @@
     )
   )
 
+  // Status/upgrade reasons the code (and, downstream, the config) cannot be
+  // edited right now. Feeds `editConfigDisabled` for PipelineActions, which
+  // applies its own `write:pipeline_config` gate on top.
   let editCodeDisabled = $derived(
     !pipeline.current ||
       deleted ||
@@ -61,6 +65,11 @@
           isUpgradeRequired(pipeline.current, runtimeVersion)))
   )
 
+  // Editing pipeline code additionally needs write:pipeline_code. Kept separate
+  // from editCodeDisabled so the permission does not leak into config gating.
+  const codeEdit = usePermission('write:pipeline_code')
+  let codeReadOnly = $derived(editCodeDisabled || !codeEdit.allowed)
+
   const { updatePipelines } = useUpdatePipelineList()
 
   const pipelineActionCallbacks = usePipelineActionCallbacks()
@@ -333,7 +342,8 @@ example = "1.0"`
   bind:this={codeEditorRef}
   path={pipelineName}
   {files}
-  editDisabled={editCodeDisabled}
+  editDisabled={codeReadOnly}
+  readOnlyMessage={!codeEdit.allowed ? 'You have read-only access' : undefined}
   bind:currentFileName={currentPipelineFile[pipelineName]}
   bind:downstreamChanged
   bind:saveFile
diff --git a/js-packages/web-console/src/lib/components/layout/pipelines/PipelineConfigurationsPopup.svelte b/js-packages/web-console/src/lib/components/layout/pipelines/PipelineConfigurationsPopup.svelte
index 763312bcc54..33510ddf5ed 100644
--- a/js-packages/web-console/src/lib/components/layout/pipelines/PipelineConfigurationsPopup.svelte
+++ b/js-packages/web-console/src/lib/components/layout/pipelines/PipelineConfigurationsPopup.svelte
@@ -5,6 +5,7 @@
   import GenericDialog from '$lib/components/dialogs/GenericDialog.svelte'
   import MultiJSONDialog from '$lib/components/dialogs/MultiJSONDialog.svelte'
   import { useGlobalDialog } from '$lib/compositions/layout/useGlobalDialog.svelte'
+  import { usePermission } from '$lib/compositions/usePermission.svelte'
   import { getPipelineAction } from '$lib/compositions/usePipelineAction.svelte'
   import { useToast } from '$lib/compositions/useToastNotification'
   import type { WritablePipeline } from '$lib/compositions/useWritablePipeline.svelte'
@@ -22,6 +23,15 @@
   const { toastError } = useToast()
   const { postPipelineAction } = getPipelineAction()
 
+  // Read-only callers may still open the dialog to view the config, but the
+  // editors stay read-only and Apply is hidden (no `onApply`). Editing needs
+  // write:pipeline_config. When the caller can edit but the pipeline is busy,
+  // Apply shows disabled with the stop-the-pipeline hint.
+  const canEditConfig = usePermission('write:pipeline_config')
+  const configDisabledMessage = $derived(
+    canEditConfig.allowed ? 'Stop the pipeline to edit settings' : 'You have read-only access'
+  )
+
   const isStorageNotClearedError = (e: unknown): boolean =>
     e instanceof Error && e.message.includes('not allowed while storage is not cleared')
 
@@ -127,7 +137,7 @@
 {#snippet pipelineConfigurationsDialog()}
   <MultiJSONDialog
     disabled={pipelineBusy}
-    disabledMessage="Stop the pipeline to edit settings"
+    disabledMessage={configDisabledMessage}
     title={`Configure ${pipeline.current.name} pipeline`}
     refreshOnChange={!pendingJsonValues}
     values={pendingJsonValues ?? {
@@ -139,16 +149,16 @@
         title: `Runtime configuration`,
         editorClass: 'h-[40vh]',
         filePath: `file://pipelines/${pipeline.current.name}/RuntimeConfig.json`,
-        readOnlyMessage: 'Cannot edit config while pipeline is running'
+        readOnlyMessage: configDisabledMessage
       },
       programConfig: {
         title: `Compilation configuration`,
         editorClass: 'h-24',
         filePath: `file://pipelines/${pipeline.current.name}/ProgramConfig.json`,
-        readOnlyMessage: 'Cannot edit config while pipeline is running'
+        readOnlyMessage: configDisabledMessage
       }
     }}
-    onApply={applyConfig}
+    onApply={canEditConfig.allowed ? applyConfig : undefined}
   ></MultiJSONDialog>
 {/snippet}
 
diff --git a/js-packages/web-console/src/lib/components/layout/pipelines/PipelineEditLayout.svelte b/js-packages/web-console/src/lib/components/layout/pipelines/PipelineEditLayout.svelte
index 66e7e172d07..bd812c23752 100644
--- a/js-packages/web-console/src/lib/components/layout/pipelines/PipelineEditLayout.svelte
+++ b/js-packages/web-console/src/lib/components/layout/pipelines/PipelineEditLayout.svelte
@@ -29,6 +29,7 @@
   import { useLayoutSettings } from '$lib/compositions/layout/useLayoutSettings.svelte'
   import { usePipelineActionCallbacks } from '$lib/compositions/pipelines/usePipelineActionCallbacks.svelte'
   import { useAggregatePipelineStats } from '$lib/compositions/useAggregatePipelineStats.svelte'
+  import { usePermission } from '$lib/compositions/usePermission.svelte'
   import { getPipelineAction } from '$lib/compositions/usePipelineAction.svelte'
   import { usePipelineManager } from '$lib/compositions/usePipelineManager.svelte'
   import { useToast } from '$lib/compositions/useToastNotification'
@@ -61,8 +62,15 @@
     deleted?: boolean
   } = $props()
 
+  // Renaming needs write:pipeline_meta; without it the name stays visible but
+  // the double-click-to-edit affordance is inert.
+  const canRename = usePermission('write:pipeline_meta')
+  // Dismissing a deployment error acts on the pipeline, so it needs exec:pipeline.
+  const canDismissError = usePermission('exec:pipeline')
+
   let editNameDisabled = $derived(
-    !pipelineThumb ||
+    !canRename.allowed ||
+      !pipelineThumb ||
       deleted ||
       (nonNull(pipelineThumb.status) && !isPipelineCodeEditable(pipelineThumb.status))
   )
@@ -125,7 +133,9 @@
         header: `The last execution of the pipeline failed with the error code: ${pipelineThumb.deploymentError.error_code}`,
         message: pipelineThumb.deploymentError.message,
         style: 'error' as const,
-        onClose: () => pipelineThumb && api.dismissDeploymentError(pipelineThumb.name)
+        onClose: canDismissError.allowed
+          ? () => pipelineThumb && api.dismissDeploymentError(pipelineThumb.name)
+          : undefined
       }
     } else if (pipelineThumb.status === 'AwaitingApproval') {
       return {
@@ -260,6 +270,8 @@
               <Tooltip class="">
                 {#if deleted}
                   Cannot edit the deleted pipeline's name
+                {:else if !canRename.allowed}
+                  You have read-only access
                 {:else}
                   Cannot edit the pipeline's name while it's running
                 {/if}
diff --git a/js-packages/web-console/src/lib/components/other/DemoTile.svelte b/js-packages/web-console/src/lib/components/other/DemoTile.svelte
index 06b26d15f91..db276cf0c57 100644
--- a/js-packages/web-console/src/lib/components/other/DemoTile.svelte
+++ b/js-packages/web-console/src/lib/components/other/DemoTile.svelte
@@ -1,15 +1,28 @@
 <script lang="ts">
+  import { usePipelineList } from '$lib/compositions/pipelines/usePipelineList.svelte'
   import { useTryPipeline } from '$lib/compositions/pipelines/useTryPipeline'
+  import { usePermission } from '$lib/compositions/usePermission.svelte'
   import type { Demo } from '$lib/services/pipelineManager'
 
   let { demo, triggerLocation }: { demo: Demo | null; triggerLocation?: string } = $props()
   const tryPipeline = useTryPipeline()
+  const canCreate = usePermission('write:pipeline')
+  const list = usePipelineList()
+  // A read-only caller may open a demo only when its pipeline already exists
+  // (the tile then navigates to it); creating one from a demo needs write access.
+  const exists = $derived(!!demo && !!list.pipelines?.some((p) => p.name === demo.name))
+  const enabled = $derived(exists || canCreate.allowed)
 </script>
 
 {#if demo}
   <div class="flex flex-col card border border-surface-100-900 p-4">
     <div class="text-sm text-surface-700-300">{demo.type}</div>
-    <button class="text-left" onclick={() => tryPipeline(demo, triggerLocation)}>
+    <button
+      class="text-left disabled:pointer-events-none disabled:opacity-50"
+      disabled={!enabled}
+      title={enabled ? undefined : 'Creating a demo pipeline needs write access'}
+      onclick={() => tryPipeline(demo, triggerLocation)}
+    >
       <span class="py-2 font-semibold">{demo.title}</span>
       <!-- <span class="fd fd-arrow-right inline-block w-2 text-[20px]"></span> -->
     </button>
diff --git a/js-packages/web-console/src/lib/components/other/DemoTile.svelte.spec.ts b/js-packages/web-console/src/lib/components/other/DemoTile.svelte.spec.ts
new file mode 100644
index 00000000000..9fdfe36f998
--- /dev/null
+++ b/js-packages/web-console/src/lib/components/other/DemoTile.svelte.spec.ts
@@ -0,0 +1,72 @@
+// Component tests for the demo tile's conditional gate: a read-only caller may
+// open a demo only when its pipeline already exists; creating one needs
+// write:pipeline. Style is disable (the tile stays visible, inert when blocked).
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { page } from 'vitest/browser'
+import { render } from 'vitest-browser-svelte'
+import type { Demo } from '$lib/services/pipelineManager'
+import { permissionsOf } from '$lib/services/rbac'
+
+const roleState = vi.hoisted(() => ({ current: 'read' as 'read' | 'write' | 'admin' | 'owner' }))
+const listState = vi.hoisted(() => ({ current: [] as { name: string }[] }))
+
+vi.mock('$app/state', () => ({
+  page: {
+    data: {
+      get feldera() {
+        return { role: roleState.current, permissions: permissionsOf(roleState.current) }
+      }
+    }
+  }
+}))
+
+vi.mock('$lib/compositions/pipelines/usePipelineList.svelte', () => ({
+  usePipelineList: () => ({
+    get pipelines() {
+      return listState.current
+    }
+  })
+}))
+
+vi.mock('$lib/compositions/pipelines/useTryPipeline', () => ({
+  useTryPipeline: () => vi.fn()
+}))
+
+import DemoTile from './DemoTile.svelte'
+
+const demo = {
+  name: 'demo-1',
+  title: 'Demo One',
+  description: 'A demo',
+  type: 'Tutorial'
+} as unknown as Demo
+
+afterEach(() => {
+  roleState.current = 'read'
+  listState.current = []
+})
+
+describe('DemoTile.svelte', () => {
+  it('enables the tile for a read-only caller when the pipeline already exists', async () => {
+    roleState.current = 'read'
+    listState.current = [{ name: 'demo-1' }]
+    await render(DemoTile, { demo })
+    await expect.element(page.getByRole('button', { name: 'Demo One' })).not.toBeDisabled()
+  })
+
+  it('disables the tile for a read-only caller when the pipeline does not exist', async () => {
+    roleState.current = 'read'
+    listState.current = []
+    await render(DemoTile, { demo })
+    // Reverting the gate leaves the tile enabled for read, failing this.
+    await expect.element(page.getByRole('button', { name: 'Demo One' })).toBeDisabled()
+  })
+
+  it('enables the tile for a write caller even when the pipeline does not exist', async () => {
+    roleState.current = 'write'
+    listState.current = []
+    await render(DemoTile, { demo })
+    await expect.element(page.getByRole('button', { name: 'Demo One' })).not.toBeDisabled()
+  })
+})
diff --git a/js-packages/web-console/src/lib/components/pipelines/CreatePipelineButton.svelte b/js-packages/web-console/src/lib/components/pipelines/CreatePipelineButton.svelte
index 2f58f725184..3dba69a8c84 100644
--- a/js-packages/web-console/src/lib/components/pipelines/CreatePipelineButton.svelte
+++ b/js-packages/web-console/src/lib/components/pipelines/CreatePipelineButton.svelte
@@ -1,4 +1,5 @@
 <script lang="ts">
+  import RBAC from '$lib/components/auth/RBAC.svelte'
   import PipelineNameInput from '$lib/components/pipelines/PipelineNameInput.svelte'
 
   const {
@@ -8,29 +9,36 @@
   }: { class?: string; inputClass?: string; btnClass?: string; onSuccess?: () => void } = $props()
 </script>
 
-<PipelineNameInput inputClass="input h-9 {inputClass}" {onSuccess}>
-  {#snippet createButton(onclick)}
-    <div class="flex justify-center">
-      <button class="btn h-9 {btnClass}" {onclick}>
-        <span class="fd fd fd-plus text-2xl"></span>
-        New Pipeline
-      </button>
-    </div>
-  {/snippet}
+<!-- Creating a pipeline is the only thing this control does, so gate the whole
+     affordance. It is the sole caller of PipelineNameInput, so one gate here
+     covers every place the New Pipeline button appears. -->
+<RBAC require="write:pipeline">
+  <PipelineNameInput inputClass="input h-9 {inputClass}" {onSuccess}>
+    {#snippet createButton(onclick)}
+      <div class="flex justify-center">
+        <button class="btn h-9 {btnClass}" {onclick}>
+          <span class="fd fd fd-plus text-2xl"></span>
+          New Pipeline
+        </button>
+      </div>
+    {/snippet}
 
-  {#snippet afterInput(error)}
-    <div class="absolute top-10 z-20">
-      {#if error}
-        <div class="bg-white-dark bg-white-dark rounded-container px-2 py-2 text-error-500 shadow">
-          {error}
-        </div>
-      {:else}
-        <div
-          class="bg-white-dark rounded-container px-2 py-2 whitespace-pre text-surface-600-400 shadow"
-        >
-          Press Enter to create
-        </div>
-      {/if}
-    </div>
-  {/snippet}
-</PipelineNameInput>
+    {#snippet afterInput(error)}
+      <div class="absolute top-10 z-20">
+        {#if error}
+          <div
+            class="bg-white-dark bg-white-dark rounded-container px-2 py-2 text-error-500 shadow"
+          >
+            {error}
+          </div>
+        {:else}
+          <div
+            class="bg-white-dark rounded-container px-2 py-2 whitespace-pre text-surface-600-400 shadow"
+          >
+            Press Enter to create
+          </div>
+        {/if}
+      </div>
+    {/snippet}
+  </PipelineNameInput>
+</RBAC>
diff --git a/js-packages/web-console/src/lib/components/pipelines/CreatePipelineButton.svelte.spec.ts b/js-packages/web-console/src/lib/components/pipelines/CreatePipelineButton.svelte.spec.ts
new file mode 100644
index 00000000000..a767364a671
--- /dev/null
+++ b/js-packages/web-console/src/lib/components/pipelines/CreatePipelineButton.svelte.spec.ts
@@ -0,0 +1,48 @@
+// Component test for the create-pipeline affordance gate: hidden unless the
+// caller holds write:pipeline. This is the single New Pipeline control reused
+// across the app, so this one gate covers every call site.
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { page } from 'vitest/browser'
+import { render } from 'vitest-browser-svelte'
+import { permissionsOf } from '$lib/services/rbac'
+
+const roleState = vi.hoisted(() => ({ current: 'read' as 'read' | 'write' | 'admin' | 'owner' }))
+vi.mock('$app/state', () => ({
+  page: {
+    data: {
+      get feldera() {
+        return { role: roleState.current, permissions: permissionsOf(roleState.current) }
+      }
+    }
+  }
+}))
+
+vi.mock('$lib/compositions/usePipelineManager.svelte', () => ({
+  usePipelineManager: () => ({ postPipeline: vi.fn() })
+}))
+
+vi.mock('$lib/compositions/pipelines/usePipelineList.svelte', () => ({
+  useUpdatePipelineList: () => ({ updatePipelines: vi.fn() })
+}))
+
+import CreatePipelineButton from './CreatePipelineButton.svelte'
+
+afterEach(() => {
+  roleState.current = 'read'
+})
+
+describe('CreatePipelineButton.svelte', () => {
+  it('shows the New Pipeline button for a write caller', async () => {
+    roleState.current = 'write'
+    await render(CreatePipelineButton, {})
+    await expect.element(page.getByText('New Pipeline')).toBeInTheDocument()
+  })
+
+  it('hides the New Pipeline button for a read-only caller', async () => {
+    roleState.current = 'read'
+    await render(CreatePipelineButton, {})
+    // Reverting the gate renders the button for read, failing this.
+    await expect.element(page.getByText('New Pipeline')).not.toBeInTheDocument()
+  })
+})
diff --git a/js-packages/web-console/src/lib/components/pipelines/editor/CodeEditor.svelte b/js-packages/web-console/src/lib/components/pipelines/editor/CodeEditor.svelte
index e3c1a51cd38..81e0c84f589 100644
--- a/js-packages/web-console/src/lib/components/pipelines/editor/CodeEditor.svelte
+++ b/js-packages/web-console/src/lib/components/pipelines/editor/CodeEditor.svelte
@@ -67,6 +67,7 @@
     files,
     currentFileName = $bindable(),
     editDisabled,
+    readOnlyMessage,
     codeEditor,
     statusBarCenter,
     statusBarEnd,
@@ -88,6 +89,9 @@
     }[]
     currentFileName: string
     editDisabled?: boolean
+    // Overrides the generic read-only hint for a writable file, e.g. to explain
+    // a permission-driven read-only state. Ignored for compiler-generated files.
+    readOnlyMessage?: string
     codeEditor: Snippet<[textEditor: Snippet, statusBar: Snippet, isReadOnly: boolean]>
     statusBarCenter?: Snippet
     statusBarEnd?: Snippet<[downstreamChanged: boolean]>
@@ -383,7 +387,8 @@
             readOnlyMessage: {
               value: isReadOnlyFile
                 ? 'Cannot edit a compiler-generated file'
-                : 'Cannot edit code while the pipeline is running or its storage is in use'
+                : (readOnlyMessage ??
+                  'Cannot edit code while the pipeline is running or its storage is in use')
             },
             fontFamily: theme.config.monospaceFontFamily,
             fontSize: editorFontSize.value,
diff --git a/js-packages/web-console/src/lib/components/pipelines/editor/InteractionPanel.svelte b/js-packages/web-console/src/lib/components/pipelines/editor/InteractionPanel.svelte
index 32234878481..2ea842c3bd5 100644
--- a/js-packages/web-console/src/lib/components/pipelines/editor/InteractionPanel.svelte
+++ b/js-packages/web-console/src/lib/components/pipelines/editor/InteractionPanel.svelte
@@ -4,6 +4,7 @@
   import * as TabSamplyProfile from '$lib/components/pipelines/editor/TabSamplyProfile.svelte'
   import { useLayoutSettings } from '$lib/compositions/layout/useLayoutSettings.svelte'
   import { useLocalStorage } from '$lib/compositions/localStore.svelte'
+  import { usePermission } from '$lib/compositions/usePermission.svelte'
   import type { PipelineMetrics } from '$lib/functions/pipelineMetrics'
   import type { ExtendedPipeline } from '$lib/services/pipelineManager'
 
@@ -21,22 +22,28 @@
 
   const { showInteractionPanel } = useLayoutSettings()
 
-  const tabs = $derived([
-    {
-      id: 'Ad-Hoc Queries' as const,
-      label: TabControlAdhoc,
-      panel: PanelAdHocQuery,
-      keepAlive: false,
-      tabBarEnd: TabBarEndClose
-    },
-    {
-      id: 'Samply' as const,
-      label: TabSamplyProfile.Label,
-      panel: TabSamplyProfile.default,
-      keepAlive: false,
-      tabBarEnd: TabBarEndClose
-    }
-  ])
+  // Ad-Hoc Queries reads/queries live pipeline data; hidden without
+  // exec:pipeline_data. The reset below drops a saved selection pointing at it.
+  const canQueryData = usePermission('exec:pipeline_data')
+
+  const tabs = $derived(
+    [
+      {
+        id: 'Ad-Hoc Queries' as const,
+        label: TabControlAdhoc,
+        panel: PanelAdHocQuery,
+        keepAlive: false,
+        tabBarEnd: TabBarEndClose
+      },
+      {
+        id: 'Samply' as const,
+        label: TabSamplyProfile.Label,
+        panel: TabSamplyProfile.default,
+        keepAlive: false,
+        tabBarEnd: TabBarEndClose
+      }
+    ].filter((tab) => canQueryData.allowed || tab.id !== 'Ad-Hoc Queries')
+  )
 
   const currentTab = $derived(
     useLocalStorage<(typeof tabs)[number]['id']>(
@@ -45,6 +52,14 @@
     )
   )
 
+  $effect.pre(() => {
+    // A saved tab the caller can no longer reach (e.g. Ad-Hoc without
+    // exec:pipeline_data) falls back to the first visible tab.
+    if (!tabs.some((t) => t.id === currentTab.value)) {
+      currentTab.value = tabs[0].id
+    }
+  })
+
   $effect(() => {
     _currentTab = currentTab.value
     return () => {
diff --git a/js-packages/web-console/src/lib/components/pipelines/editor/InteractionPanel.svelte.spec.ts b/js-packages/web-console/src/lib/components/pipelines/editor/InteractionPanel.svelte.spec.ts
new file mode 100644
index 00000000000..e81c90e8dea
--- /dev/null
+++ b/js-packages/web-console/src/lib/components/pipelines/editor/InteractionPanel.svelte.spec.ts
@@ -0,0 +1,98 @@
+/**
+ * Gating tests for the right-hand Inspect panel. The Ad-Hoc Queries tab reads
+ * live pipeline data and is hidden without `exec:pipeline_data`; the Samply
+ * profiling tab stays. A saved selection pointing at the hidden Ad-Hoc tab is
+ * dropped to the first visible tab on init.
+ *
+ * Only the pipeline-manager network surface is mocked. A `Stopped` pipeline
+ * makes neither panel fetch on mount, so the render exercises the real tab
+ * wiring without any live requests.
+ */
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { render } from 'vitest-browser-svelte'
+import { permissionsOf } from '$lib/services/rbac'
+
+const roleState = vi.hoisted(() => ({ current: 'write' as 'read' | 'write' | 'admin' | 'owner' }))
+vi.mock('$app/state', () => ({
+  page: {
+    data: {
+      get feldera() {
+        return { role: roleState.current, permissions: permissionsOf(roleState.current) }
+      }
+    }
+  }
+}))
+
+vi.mock('$lib/compositions/usePipelineManager.svelte', () => ({
+  usePipelineManager: () => ({ adHocQuery: vi.fn() })
+}))
+
+// Imported AFTER vi.mock so the mocks take effect.
+import InteractionPanel from './InteractionPanel.svelte'
+
+let testCounter = 0
+const nextPipelineName = () => `interaction-gating-${++testCounter}`
+
+let mounted: { unmount: () => Promise<void> } | undefined
+let mountTarget: HTMLDivElement | undefined
+
+function mountPanel(opts: { role: 'read' | 'write'; seedTab?: string }) {
+  roleState.current = opts.role
+  const name = nextPipelineName()
+  if (opts.seedTab) {
+    localStorage.setItem(`pipelines/${name}/currentInteractionTab`, JSON.stringify(opts.seedTab))
+  }
+
+  mountTarget = document.createElement('div')
+  mountTarget.style.cssText = 'height: 600px; width: 800px; display: flex; flex-direction: column;'
+  document.body.appendChild(mountTarget)
+
+  mounted = render(InteractionPanel, {
+    target: mountTarget,
+    props: {
+      pipeline: { current: { name, status: 'Stopped' } },
+      metrics: { current: {} },
+      deleted: false,
+      currentTab: null
+    }
+  } as any)
+}
+
+const tabTexts = () =>
+  Array.from(document.querySelectorAll('[role="tab"]')).map((t) => t.textContent ?? '')
+
+describe('InteractionPanel — exec:pipeline_data tab gating', () => {
+  afterEach(async () => {
+    await mounted?.unmount()
+    mounted = undefined
+    mountTarget?.remove()
+    mountTarget = undefined
+    localStorage.clear()
+    roleState.current = 'write'
+    vi.clearAllMocks()
+  })
+
+  it('shows the Ad-Hoc Queries tab for a write caller', async () => {
+    mountPanel({ role: 'write' })
+    await expect.poll(() => tabTexts().length).toBeGreaterThan(0)
+    expect(tabTexts().some((t) => t.includes('Ad-Hoc'))).toBe(true)
+  })
+
+  it('hides the Ad-Hoc Queries tab for a read-only caller', async () => {
+    mountPanel({ role: 'read' })
+    await expect.poll(() => tabTexts().length).toBeGreaterThan(0)
+    // Reverting the gate (dropping the exec:pipeline_data filter) renders the
+    // Ad-Hoc trigger and fails this test.
+    expect(tabTexts().some((t) => t.includes('Ad-Hoc'))).toBe(false)
+    expect(tabTexts().some((t) => t.includes('CPU Profile'))).toBe(true)
+  })
+
+  it('drops a saved Ad-Hoc selection to the first visible tab for a read caller', async () => {
+    mountPanel({ role: 'read', seedTab: 'Ad-Hoc Queries' })
+    await expect.poll(() => tabTexts().length).toBeGreaterThan(0)
+    // Only Samply remains, and it is the active tab (a blank panel would mean the
+    // saved Ad-Hoc selection survived the reset).
+    expect(tabTexts().some((t) => t.includes('Ad-Hoc'))).toBe(false)
+    expect(tabTexts().some((t) => t.includes('CPU Profile'))).toBe(true)
+  })
+})
diff --git a/js-packages/web-console/src/lib/components/pipelines/editor/MonitoringPanel.svelte b/js-packages/web-console/src/lib/components/pipelines/editor/MonitoringPanel.svelte
index e2acfa7bd6d..3d5484c1cc8 100755
--- a/js-packages/web-console/src/lib/components/pipelines/editor/MonitoringPanel.svelte
+++ b/js-packages/web-console/src/lib/components/pipelines/editor/MonitoringPanel.svelte
@@ -25,6 +25,7 @@
   import type { PipelineMetrics } from '$lib/functions/pipelineMetrics'
   import { count } from '$lib/functions/common/array'
   import { untrack } from 'svelte'
+  import { usePermission } from '$lib/compositions/usePermission.svelte'
   import { usePipelineActionCallbacks } from '$lib/compositions/pipelines/usePipelineActionCallbacks.svelte'
   import ClipboardCopyButton from '$lib/components/other/ClipboardCopyButton.svelte'
   import { Tooltip } from 'common-ui'
@@ -52,6 +53,12 @@
   const pipelineName = $derived(pipeline.current.name)
   const layoutSettings = useLayoutSettings()
 
+  // Ad-Hoc Queries and Changes Stream read/stream live pipeline data; both are
+  // hidden without exec:pipeline_data. `$effect.pre` below then drops a saved
+  // selection that points at a now-hidden tab back to the first visible tab.
+  const canQueryData = usePermission('exec:pipeline_data')
+  const dataTabs: MonitoringTabs[] = ['Ad-Hoc Queries', 'Changes Stream']
+
   let tabs = $derived(
     [
       {
@@ -103,7 +110,9 @@
         keepAlive: true,
         tabBarEnd: TabBarEndLogs
       }
-    ].filter((tab) => !hiddenTabs.includes(tab.id))
+    ].filter(
+      (tab) => !hiddenTabs.includes(tab.id) && (canQueryData.allowed || !dataTabs.includes(tab.id))
+    )
   )
   const currentTabStorage = $derived(
     useLocalStorage<MonitoringTabs>('pipelines/' + pipelineName + '/currentMonitoringTab', 'Errors')
diff --git a/js-packages/web-console/src/lib/components/pipelines/editor/MonitoringPanel.svelte.spec.ts b/js-packages/web-console/src/lib/components/pipelines/editor/MonitoringPanel.svelte.spec.ts
index e9585222518..1d993607ba0 100644
--- a/js-packages/web-console/src/lib/components/pipelines/editor/MonitoringPanel.svelte.spec.ts
+++ b/js-packages/web-console/src/lib/components/pipelines/editor/MonitoringPanel.svelte.spec.ts
@@ -15,6 +15,23 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { page, userEvent } from 'vitest/browser'
 import { render } from 'vitest-browser-svelte'
+import { permissionsOf } from '$lib/services/rbac'
+
+// The Ad-Hoc Queries and Changes Stream tabs are gated on `exec:pipeline_data`.
+// Default the mocked role to `write` so the log-search tests (which already hide
+// those tabs) are unaffected; the gating tests below flip it to `read`. The
+// `feldera` getter is read at render time, so setting `roleState.current` before
+// each render selects the role under test.
+const roleState = vi.hoisted(() => ({ current: 'write' as 'read' | 'write' | 'admin' | 'owner' }))
+vi.mock('$app/state', () => ({
+  page: {
+    data: {
+      get feldera() {
+        return { role: roleState.current, permissions: permissionsOf(roleState.current) }
+      }
+    }
+  }
+}))
 
 // --- Mock the pipeline manager's log-stream fetch ----------------------------
 // Each call returns a fresh ReadableStream that emits all 1 000 lines as a single
@@ -210,3 +227,95 @@ describe('MonitoringPanel — log-search wiring', () => {
     await expectRowMounted(499)
   })
 })
+
+// --- exec:pipeline_data tab gating ------------------------------------------
+//
+// Ad-Hoc Queries and Changes Stream read/stream live pipeline data and must not
+// be reachable without `exec:pipeline_data`. Their tab triggers are hidden, and
+// a saved selection pointing at one of them is dropped to the first visible tab
+// on init (so a `read` caller never lands on a blank panel).
+
+// Mount MonitoringPanel with an explicit role and, optionally, a pre-seeded
+// saved-tab in localStorage. Returns once the Logs tab has rendered a row, which
+// proves a visible tab is active.
+async function mountGatingPanel(opts: {
+  role: 'read' | 'write'
+  hiddenTabs: string[]
+  currentTab: 'Logs' | null
+  seedTab?: string
+}) {
+  roleState.current = opts.role
+  pipelineLogsStreamMock.mockImplementation(async () => buildFakeLogsStream())
+
+  const name = nextPipelineName()
+  if (opts.seedTab) {
+    localStorage.setItem(`pipelines/${name}/currentMonitoringTab`, JSON.stringify(opts.seedTab))
+  }
+
+  mountTarget = document.createElement('div')
+  mountTarget.style.cssText = 'height: 800px; width: 1200px; display: flex; flex-direction: column;'
+  document.body.appendChild(mountTarget)
+
+  mounted = render(MonitoringPanel, {
+    target: mountTarget,
+    props: {
+      pipeline: pipelineProp(name),
+      // The Performance tab label counts connector problems, so `inputs`/`outputs`
+      // must be iterable even when empty.
+      metrics: { current: { inputs: [], outputs: [] } } as any,
+      deleted: false,
+      hiddenTabs: opts.hiddenTabs,
+      currentTab: opts.currentTab
+    }
+  } as any)
+}
+
+const tabTexts = () =>
+  Array.from(document.querySelectorAll('[role="tab"]')).map((t) => t.textContent ?? '')
+
+describe('MonitoringPanel — exec:pipeline_data tab gating', () => {
+  afterEach(async () => {
+    await mounted?.unmount()
+    mounted = undefined
+    mountTarget?.remove()
+    mountTarget = undefined
+    localStorage.clear()
+    roleState.current = 'write'
+    vi.clearAllMocks()
+  })
+
+  it('shows the Ad-Hoc Queries and Changes Stream tabs for a write caller', async () => {
+    await mountGatingPanel({ role: 'write', hiddenTabs: [], currentTab: 'Logs' })
+    await expectRowMounted(0)
+
+    const labels = tabTexts()
+    expect(labels.some((t) => t.includes('Ad-Hoc'))).toBe(true)
+    expect(labels.some((t) => t.includes('Change'))).toBe(true)
+  })
+
+  it('hides both tabs for a read-only caller', async () => {
+    await mountGatingPanel({ role: 'read', hiddenTabs: [], currentTab: 'Logs' })
+    await expectRowMounted(0)
+
+    // Reverting the gate (dropping the exec:pipeline_data check in the tabs
+    // filter) renders these triggers and fails this test.
+    const labels = tabTexts()
+    expect(labels.some((t) => t.includes('Ad-Hoc'))).toBe(false)
+    expect(labels.some((t) => t.includes('Change'))).toBe(false)
+  })
+
+  it('switches away from a saved forbidden tab to the first visible tab', async () => {
+    // A caller who once had access saved 'Ad-Hoc Queries'; on init as `read`, all
+    // other tabs but Logs are hidden, so the panel must land on Logs, not blank.
+    await mountGatingPanel({
+      role: 'read',
+      hiddenTabs: ['Errors', 'Performance', 'Samply', 'Health'],
+      currentTab: null,
+      seedTab: 'Ad-Hoc Queries'
+    })
+
+    // Logs rows render → the saved 'Ad-Hoc Queries' was replaced by a visible tab.
+    await expectRowMounted(0)
+    expect(tabTexts().some((t) => t.includes('Ad-Hoc'))).toBe(false)
+  })
+})
diff --git a/js-packages/web-console/src/lib/components/pipelines/editor/ReviewPipelineChangesDialog.svelte b/js-packages/web-console/src/lib/components/pipelines/editor/ReviewPipelineChangesDialog.svelte
index d3c0e38d40a..8fad324bed4 100644
--- a/js-packages/web-console/src/lib/components/pipelines/editor/ReviewPipelineChangesDialog.svelte
+++ b/js-packages/web-console/src/lib/components/pipelines/editor/ReviewPipelineChangesDialog.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
   import { slide } from 'svelte/transition'
   import IconLoader from '$assets/icons/generic/loader-alt.svg?component'
+  import RBAC from '$lib/components/auth/RBAC.svelte'
   import InlineDropdown from '$lib/components/common/InlineDropdown.svelte'
   // import type { PipelineDiff } from '$lib/services/manager'
   import type { PipelineDiff } from '$lib/types/pipelineManager'
@@ -324,21 +325,25 @@
 {/if}
 <div class="bg-white-dark sticky bottom-0">
   <div class="flex justify-start gap-4 py-4 md:gap-6 md:py-4">
-    {#await approvingPromise}
-      <button class="pointer-events-none btn preset-filled-primary-500 pr-8">
-        <IconLoader class="mr-4 h-5 flex-none animate-spin fill-surface-50"></IconLoader>
-        Approving...
-      </button>
-    {:then _}
-      <button
-        class="btn preset-filled-primary-500"
-        onclick={() => {
-          approvingPromise = onApprove().then(() => onCancel())
-        }}
-      >
-        Approve and Continue
-      </button>
-    {/await}
+    <!-- Approving resumes a running pipeline, so gate it on exec:pipeline.
+         The change review itself stays visible; only the apply action is gated. -->
+    <RBAC require="exec:pipeline">
+      {#await approvingPromise}
+        <button class="pointer-events-none btn preset-filled-primary-500 pr-8">
+          <IconLoader class="mr-4 h-5 flex-none animate-spin fill-surface-50"></IconLoader>
+          Approving...
+        </button>
+      {:then _}
+        <button
+          class="btn preset-filled-primary-500"
+          onclick={() => {
+            approvingPromise = onApprove().then(() => onCancel())
+          }}
+        >
+          Approve and Continue
+        </button>
+      {/await}
+    </RBAC>
     <button
       class="btn preset-tonal-surface"
       onclick={() => {
diff --git a/js-packages/web-console/src/lib/components/pipelines/editor/StorageInUseBanner.svelte b/js-packages/web-console/src/lib/components/pipelines/editor/StorageInUseBanner.svelte
index f58155cc5fc..36080c01aa1 100644
--- a/js-packages/web-console/src/lib/components/pipelines/editor/StorageInUseBanner.svelte
+++ b/js-packages/web-console/src/lib/components/pipelines/editor/StorageInUseBanner.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
   import { page } from '$app/state'
+  import RBAC from '$lib/components/auth/RBAC.svelte'
   import { usePipelineManager } from '$lib/compositions/usePipelineManager.svelte'
 
   const {
@@ -24,9 +25,14 @@
       A new runtime version {page.data.feldera!.version} is available. Update the runtime to edit the
       pipeline.
     </span>
-    <button class="btn h-7 border-0 preset-filled-primary-500 py-0 text-sm" onclick={handleUpgrade}>
-      Update
-    </button>
+    <RBAC require="exec:runtime_upgrade">
+      <button
+        class="btn h-7 border-0 preset-filled-primary-500 py-0 text-sm"
+        onclick={handleUpgrade}
+      >
+        Update
+      </button>
+    </RBAC>
   {:else}
     <span>
       Editing a pipeline with existing state in storage — changes will take effect when the pipeline
diff --git a/js-packages/web-console/src/lib/components/pipelines/editor/TabAdHocQuery.svelte.spec.ts b/js-packages/web-console/src/lib/components/pipelines/editor/TabAdHocQuery.svelte.spec.ts
index 46824661197..c9a0d7fcc7d 100644
--- a/js-packages/web-console/src/lib/components/pipelines/editor/TabAdHocQuery.svelte.spec.ts
+++ b/js-packages/web-console/src/lib/components/pipelines/editor/TabAdHocQuery.svelte.spec.ts
@@ -51,6 +51,13 @@ vi.mock('$lib/compositions/usePipelineManager.svelte', () => ({
   usePipelineManager: () => ({ adHocQuery: adHocQueryMock })
 }))
 
+// The editor components TabAdHocQuery pulls in read `$app/state`; provide a
+// minimal page so they mount. Tab-level gating (exec:pipeline_data) lives in the
+// panels that host this tab, not here, so no role is needed.
+vi.mock('$app/state', () => ({
+  page: { data: { feldera: {} } }
+}))
+
 // Imported AFTER vi.mock so the mock takes effect.
 import TabAdHocQuery from './TabAdHocQuery.svelte'
 
diff --git a/js-packages/web-console/src/lib/components/pipelines/editor/TabPerformance.svelte b/js-packages/web-console/src/lib/components/pipelines/editor/TabPerformance.svelte
index e7bc00130e3..7a7560adcc3 100644
--- a/js-packages/web-console/src/lib/components/pipelines/editor/TabPerformance.svelte
+++ b/js-packages/web-console/src/lib/components/pipelines/editor/TabPerformance.svelte
@@ -90,7 +90,9 @@
   // When metrics are temporarily unavailable ('missing'), freeze graphs and stats until the pipeline is reachable again.
   const metricsDesired = $derived(metricsStatus === 'yes' || metricsStatus === 'missing')
   // Show the reconnect banner only after a live stream has dropped, never during the first connect.
-  const metricsStreamInterrupted = $derived(metricsAvailable && metricsStreamState === 'interrupted')
+  const metricsStreamInterrupted = $derived(
+    metricsAvailable && metricsStreamState === 'interrupted'
+  )
 
   // Keep reconnecting to time_series_stream for as long as the tab is mounted and metrics are desired
   // Reconnect on end-of-stream immediately, or with 1s backoff on mid-stream or stream-open errors
diff --git a/js-packages/web-console/src/lib/components/pipelines/editor/performance/CheckpointsIndicator.svelte b/js-packages/web-console/src/lib/components/pipelines/editor/performance/CheckpointsIndicator.svelte
index 2831a2e3e52..b81c376dccc 100644
--- a/js-packages/web-console/src/lib/components/pipelines/editor/performance/CheckpointsIndicator.svelte
+++ b/js-packages/web-console/src/lib/components/pipelines/editor/performance/CheckpointsIndicator.svelte
@@ -3,6 +3,7 @@
   import ClickFeedback from '$lib/components/common/ClickFeedback.svelte'
   import { useElapsedTime } from '$lib/compositions/common/useElapsedTime'
   import { useGlobalDialog } from '$lib/compositions/layout/useGlobalDialog.svelte'
+  import { usePermission } from '$lib/compositions/usePermission.svelte'
   import { usePipelineManager } from '$lib/compositions/usePipelineManager.svelte'
   import { usePremiumFeatures } from '$lib/compositions/usePremiumFeatures.svelte'
   import { uuidV7Timestamp } from '$lib/functions/common/date'
@@ -33,6 +34,7 @@
 
   const api = usePipelineManager()
   const isEnterprise = usePremiumFeatures()
+  const canCheckpoint = usePermission('exec:checkpoint')
   const { formatElapsedTime } = useElapsedTime()
   const globalDialog = useGlobalDialog()
 
@@ -88,7 +90,10 @@
   <div class="hr"></div>
 {/snippet}
 
-{#if activityVisible || last || isEnterprise.value}
+<!-- The "create first checkpoint" branch is the only affordance gated on
+     `exec:checkpoint`. Fold the permission into the outer condition too, so a
+     read-only caller with no activity or prior checkpoint sees no empty bar. -->
+{#if activityVisible || last || (isEnterprise.value && canCheckpoint.allowed)}
   <div class="flex min-h-16 w-full flex-wrap items-center gap-x-8 gap-y-2" transition:slide>
     {#if activityVisible}
       <div class="hr"></div>
@@ -146,7 +151,7 @@
         </div>
       </div>
       {@render allCheckpoints()}
-    {:else if isEnterprise.value}
+    {:else if isEnterprise.value && canCheckpoint.allowed}
       <div class="hr"></div>
       <ClickFeedback
         active={metrics.current.checkpoint_activity.status !== 'idle'}
diff --git a/js-packages/web-console/src/lib/components/pipelines/editor/performance/CheckpointsIndicator.svelte.spec.ts b/js-packages/web-console/src/lib/components/pipelines/editor/performance/CheckpointsIndicator.svelte.spec.ts
index a42657c00d5..e478623266a 100644
--- a/js-packages/web-console/src/lib/components/pipelines/editor/performance/CheckpointsIndicator.svelte.spec.ts
+++ b/js-packages/web-console/src/lib/components/pipelines/editor/performance/CheckpointsIndicator.svelte.spec.ts
@@ -1,8 +1,25 @@
-import { describe, expect, it, vi } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 import { page } from 'vitest/browser'
 import { render } from 'vitest-browser-svelte'
 import type { PipelineMetrics } from '$lib/functions/pipelineMetrics'
 import type { CheckpointMetadata } from '$lib/services/manager'
+import { permissionsOf } from '$lib/services/rbac'
+
+// The "create first checkpoint" affordance requires enterprise AND the
+// `exec:checkpoint` permission. Both are driven by hoisted vars so a test can
+// select them before rendering.
+const roleState = vi.hoisted(() => ({ current: 'write' as 'read' | 'write' | 'admin' | 'owner' }))
+const premiumState = vi.hoisted(() => ({ enabled: false }))
+
+vi.mock('$app/state', () => ({
+  page: {
+    data: {
+      get feldera() {
+        return { role: roleState.current, permissions: permissionsOf(roleState.current) }
+      }
+    }
+  }
+}))
 
 vi.mock('$lib/compositions/usePipelineManager.svelte', () => ({
   usePipelineManager: () => ({ checkpointPipeline: vi.fn() })
@@ -11,7 +28,7 @@ vi.mock('$lib/compositions/usePipelineManager.svelte', () => ({
 vi.mock('$lib/compositions/usePremiumFeatures.svelte', () => ({
   usePremiumFeatures: () => ({
     get value() {
-      return false
+      return premiumState.enabled
     }
   })
 }))
@@ -46,6 +63,11 @@ function makeCheckpoint(): CheckpointMetadata {
   return { uuid: '01900000-0000-7000-8000-000000000000', fingerprint: 0 }
 }
 
+afterEach(() => {
+  roleState.current = 'write'
+  premiumState.enabled = false
+})
+
 describe('CheckpointsIndicator.svelte', () => {
   it('shows elapsed time derived from the checkpoint UUID timestamp', async () => {
     await render(CheckpointsIndicator, {
@@ -57,4 +79,30 @@ describe('CheckpointsIndicator.svelte', () => {
     })
     await expect.element(page.getByText(/Last checkpoint:.*ago/)).toBeInTheDocument()
   })
+
+  describe('exec:checkpoint gating of "create first checkpoint"', () => {
+    const renderEnterpriseNoCheckpoints = () =>
+      render(CheckpointsIndicator, {
+        pipelineName: 'test',
+        checkpoints: [],
+        metrics: makeMetrics(),
+        checkpointStatus: null,
+        onShowCheckpoints: vi.fn()
+      })
+
+    it('shows the button for a write caller on enterprise', async () => {
+      premiumState.enabled = true
+      roleState.current = 'write'
+      await renderEnterpriseNoCheckpoints()
+      await expect.element(page.getByText('Create first checkpoint')).toBeInTheDocument()
+    })
+
+    it('hides the button for a read-only caller on enterprise', async () => {
+      premiumState.enabled = true
+      roleState.current = 'read'
+      await renderEnterpriseNoCheckpoints()
+      // Reverting the gate renders the button for `read`, failing this.
+      await expect.element(page.getByText('Create first checkpoint')).not.toBeInTheDocument()
+    })
+  })
 })
diff --git a/js-packages/web-console/src/lib/components/pipelines/editor/performance/CheckpointsStatus.svelte b/js-packages/web-console/src/lib/components/pipelines/editor/performance/CheckpointsStatus.svelte
index f5756ae9dbe..2deab0dc6c9 100644
--- a/js-packages/web-console/src/lib/components/pipelines/editor/performance/CheckpointsStatus.svelte
+++ b/js-packages/web-console/src/lib/components/pipelines/editor/performance/CheckpointsStatus.svelte
@@ -4,6 +4,7 @@
   import InlineDropdown from '$lib/components/common/InlineDropdown.svelte'
   import { useElapsedTime } from '$lib/compositions/common/useElapsedTime'
   import { useGlobalDialog } from '$lib/compositions/layout/useGlobalDialog.svelte'
+  import { usePermission } from '$lib/compositions/usePermission.svelte'
   import { uuidV7Timestamp } from '$lib/functions/common/date'
   import { humanSize } from '$lib/functions/common/string'
   import { formatDateTime } from '$lib/functions/format'
@@ -23,6 +24,7 @@
   } = $props()
 
   const globalDialog = useGlobalDialog()
+  const canCheckpoint = usePermission('exec:checkpoint')
   const elapsed = useElapsedTime()
 
   let clickFeedback = $state<() => void>()
@@ -92,7 +94,7 @@
       {/each}
     {/if}
   </div>
-  {#if onCheckpoint}
+  {#if onCheckpoint && canCheckpoint.allowed}
     <ClickFeedback active={checkpointInProgress} bind:clickFeedback>
       {#snippet children({ active })}
         <button
diff --git a/js-packages/web-console/src/lib/components/pipelines/editor/performance/CheckpointsStatus.svelte.spec.ts b/js-packages/web-console/src/lib/components/pipelines/editor/performance/CheckpointsStatus.svelte.spec.ts
index 9a5fcd8a12c..a735f327c61 100644
--- a/js-packages/web-console/src/lib/components/pipelines/editor/performance/CheckpointsStatus.svelte.spec.ts
+++ b/js-packages/web-console/src/lib/components/pipelines/editor/performance/CheckpointsStatus.svelte.spec.ts
@@ -2,9 +2,25 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { page } from 'vitest/browser'
 import { render } from 'vitest-browser-svelte'
 import type { CheckpointMetadata } from '$lib/services/manager'
+import { permissionsOf } from '$lib/services/rbac'
 
 const setDialogMock = vi.fn()
 
+// The create-checkpoint button is gated on `exec:checkpoint`. Default the mocked
+// role to `write` so the existing button assertions hold; the read-only cases
+// set it to `read`. The `feldera` getter is read at render time, so setting
+// `roleState.current` before each render selects the role under test.
+const roleState = vi.hoisted(() => ({ current: 'write' as 'read' | 'write' | 'admin' | 'owner' }))
+vi.mock('$app/state', () => ({
+  page: {
+    data: {
+      get feldera() {
+        return { role: roleState.current, permissions: permissionsOf(roleState.current) }
+      }
+    }
+  }
+}))
+
 vi.mock('$lib/compositions/layout/useGlobalDialog.svelte', () => ({
   useGlobalDialog: () => ({
     get dialog() {
@@ -31,7 +47,34 @@ function makeCheckpoint(overrides?: Partial<CheckpointMetadata>): CheckpointMeta
   }
 }
 
+afterEach(() => {
+  roleState.current = 'write'
+})
+
 describe('CheckpointsStatus.svelte', () => {
+  describe('exec:checkpoint gating', () => {
+    it('hides the create button for a read-only caller even when onCheckpoint is provided', async () => {
+      roleState.current = 'read'
+      await render(CheckpointsStatus, {
+        checkpoints: [],
+        onClose: vi.fn(),
+        onCheckpoint: vi.fn()
+      })
+      // Reverting the gate (rendering the button for `read`) makes this fail.
+      await expect.element(page.getByTestId('btn-make-checkpoint')).not.toBeInTheDocument()
+    })
+
+    it('shows the create button for a write caller', async () => {
+      roleState.current = 'write'
+      await render(CheckpointsStatus, {
+        checkpoints: [],
+        onClose: vi.fn(),
+        onCheckpoint: vi.fn()
+      })
+      await expect.element(page.getByTestId('btn-make-checkpoint')).toBeInTheDocument()
+    })
+  })
+
   describe('A. Empty state', () => {
     it('shows "No checkpoints" when list is empty', async () => {
       await render(CheckpointsStatus, { checkpoints: [], onClose: vi.fn() })
diff --git a/js-packages/web-console/src/lib/components/pipelines/list/Actions.svelte b/js-packages/web-console/src/lib/components/pipelines/list/Actions.svelte
index e6bb4238965..3274b080554 100644
--- a/js-packages/web-console/src/lib/components/pipelines/list/Actions.svelte
+++ b/js-packages/web-console/src/lib/components/pipelines/list/Actions.svelte
@@ -41,13 +41,11 @@ groups related actions into multi-action dropdowns when multiple options are ava
 <script lang="ts">
   import { Popover, Tooltip } from 'common-ui'
   import { slide } from 'svelte/transition'
-  import JSONbig from 'true-json-bigint'
   import { match, P } from 'ts-pattern'
   import { goto } from '$app/navigation'
   import IconLoader from '$assets/icons/generic/loader-alt.svg?component'
   import Popup from '$lib/components/common/Popup.svelte'
   import DeleteDialog, { deleteDialogProps } from '$lib/components/dialogs/DeleteDialog.svelte'
-  import JSONDialog from '$lib/components/dialogs/JSONDialog.svelte'
   import PipelineConfigurationsPopup from '$lib/components/layout/pipelines/PipelineConfigurationsPopup.svelte'
   import { duplicatePipeline, duplicatePipelineTooltip } from '$lib/compositions/duplicatePipeline'
   import { useGlobalDialog } from '$lib/compositions/layout/useGlobalDialog.svelte'
@@ -57,6 +55,7 @@ groups related actions into multi-action dropdowns when multiple options are ava
     usePipelineList,
     useUpdatePipelineList
   } from '$lib/compositions/pipelines/usePipelineList.svelte'
+  import { usePermission } from '$lib/compositions/usePermission.svelte'
   import { getPipelineAction } from '$lib/compositions/usePipelineAction.svelte'
   import { usePipelineManager } from '$lib/compositions/usePipelineManager.svelte'
   import { usePremiumFeatures } from '$lib/compositions/usePremiumFeatures.svelte'
@@ -142,8 +141,6 @@ groups related actions into multi-action dropdowns when multiple options are ava
     _spinner,
     _status_spinner,
     _configurations,
-    _configureProgram,
-    _configureResources,
     _saveFile,
     _unschedule,
     _storage_indicator
@@ -151,140 +148,179 @@ groups related actions into multi-action dropdowns when multiple options are ava
 
   const isPremium = usePremiumFeatures()
 
+  const canExec = usePermission('exec:pipeline')
+  const canWrite = usePermission('write:pipeline')
+  const canWriteCode = usePermission('write:pipeline_code')
+  // Gates the settings tooltip: a read-only caller sees a view-only hint instead
+  // of "stop the pipeline to edit", which they could never act on.
+  const canWriteConfig = usePermission('write:pipeline_config')
+
+  // Action-menu entries hidden without the matching permission. Lifecycle
+  // controls need `exec:pipeline`; the "More" menu holds only delete/duplicate,
+  // both `write:pipeline`; saving the file writes pipeline code, so it needs
+  // `write:pipeline_code`. Status, configuration and storage-state entries stay
+  // visible for read-only callers; the storage clear button inside
+  // `_storage_indicator` is gated on its own below.
+  const EXEC_ACTIONS = new Set<keyof typeof actions>([
+    '_start',
+    '_start_paused',
+    '_resume',
+    '_standby',
+    '_activate',
+    '_pause',
+    '_kill',
+    '_kill_short',
+    '_stop',
+    '_start_pending',
+    '_start_error',
+    '_unschedule'
+  ])
+  const WRITE_ACTIONS = new Set<keyof typeof actions>(['_more'])
+  const CODE_ACTIONS = new Set<keyof typeof actions>(['_saveFile'])
+  const filterByPermission = (list: (keyof typeof actions)[]) =>
+    list.filter(
+      (action) =>
+        (EXEC_ACTIONS.has(action) ? canExec.allowed : true) &&
+        (WRITE_ACTIONS.has(action) ? canWrite.allowed : true) &&
+        (CODE_ACTIONS.has(action) ? canWriteCode.allowed : true)
+    )
+
   const stopButtons = isPremium.value
     ? (['_stop', '_kill'] as const)
     : (['_kill', '_stop'] as const)
 
   // Helper function to get raw actions for current pipeline status
   const getRawActions = (status: typeof pipeline.current.status) => {
-    return match(status)
-      .returnType<(keyof typeof actions)[]>()
-      .with('Stopped', () => [
-        '_start',
-        '_start_paused',
-        '_standby',
-        '_saveFile',
-        '_configurations',
-        '_storage_indicator',
-        '_more'
-      ])
-      .with('Preparing', 'Provisioning', 'Initializing', () => [
-        '_kill',
-        '_spinner',
-        '_saveFile',
-        '_configurations',
-        '_storage_indicator',
-        '_more'
-      ])
-      .with('Pausing', 'Resuming', () => [
-        ...stopButtons,
-        '_spinner',
-        '_saveFile',
-        '_configurations',
-        '_storage_indicator',
-        '_more'
-      ])
-      .with('Unavailable', () => [
-        ...stopButtons,
-        '_spacer_long',
-        '_saveFile',
-        '_configurations',
-        '_storage_indicator',
-        '_more'
-      ])
-      .with('Running', 'ConcurrentBootstrapping', () => [
-        ...stopButtons,
-        '_pause',
-        '_saveFile',
-        '_configurations',
-        '_storage_indicator',
-        '_more'
-      ])
-      .with('Paused', () => [
-        ...stopButtons,
-        '_resume',
-        '_saveFile',
-        '_configurations',
-        '_storage_indicator',
-        '_more'
-      ])
-      .with('Suspending', () => [
-        '_kill',
-        '_spinner',
-        '_saveFile',
-        '_configurations',
-        '_storage_indicator',
-        '_more'
-      ])
-      .with('Suspended', () => [
-        '_spinner',
-        '_kill',
-        '_saveFile',
-        '_configurations',
-        '_storage_indicator',
-        '_more'
-      ])
-      .with('Standby', () => [
-        '_kill',
-        '_activate',
-        '_saveFile',
-        '_configurations',
-        '_storage_indicator',
-        '_more'
-      ])
-      .with('Bootstrapping', () => [
-        '_kill',
-        '_spinner',
-        '_saveFile',
-        '_configurations',
-        '_storage_indicator',
-        '_more'
-      ])
-      .with('Replaying', 'Synchronizing', () => [
-        '_kill',
-        '_spinner',
-        '_saveFile',
-        '_configurations',
-        '_storage_indicator',
-        '_more'
-      ])
-      .with('AwaitingApproval', () => [
-        '_kill',
-        '_saveFile',
-        '_configurations',
-        '_storage_indicator',
-        '_more'
-      ])
-      .with('Stopping', () => [
-        '_kill',
-        '_spinner',
-        '_saveFile',
-        '_configurations',
-        '_storage_indicator',
-        '_more'
-      ])
-      .with(
-        { Queued: P.any },
-        { CompilingSql: P.any },
-        { SqlCompiled: P.any },
-        { CompilingRust: P.any },
-        (cause) => [
-          ...(Object.values(cause)[0].cause === 'upgrade' ? ['_unschedule' as const] : []),
-          '_start_pending',
+    return filterByPermission(
+      match(status)
+        .returnType<(keyof typeof actions)[]>()
+        .with('Stopped', () => [
+          '_start',
+          '_start_paused',
+          '_standby',
           '_saveFile',
           '_configurations',
           '_storage_indicator',
           '_more'
-        ]
-      )
-      .with('SqlError', 'RustError', 'SystemError', () => [
-        '_start_error',
-        '_saveFile',
-        '_configurations',
-        '_storage_indicator',
-        '_more'
-      ])
-      .exhaustive()
+        ])
+        .with('Preparing', 'Provisioning', 'Initializing', () => [
+          '_kill',
+          '_spinner',
+          '_saveFile',
+          '_configurations',
+          '_storage_indicator',
+          '_more'
+        ])
+        .with('Pausing', 'Resuming', () => [
+          ...stopButtons,
+          '_spinner',
+          '_saveFile',
+          '_configurations',
+          '_storage_indicator',
+          '_more'
+        ])
+        .with('Unavailable', () => [
+          ...stopButtons,
+          '_spacer_long',
+          '_saveFile',
+          '_configurations',
+          '_storage_indicator',
+          '_more'
+        ])
+        .with('Running', 'ConcurrentBootstrapping', () => [
+          ...stopButtons,
+          '_pause',
+          '_saveFile',
+          '_configurations',
+          '_storage_indicator',
+          '_more'
+        ])
+        .with('Paused', () => [
+          ...stopButtons,
+          '_resume',
+          '_saveFile',
+          '_configurations',
+          '_storage_indicator',
+          '_more'
+        ])
+        .with('Suspending', () => [
+          '_kill',
+          '_spinner',
+          '_saveFile',
+          '_configurations',
+          '_storage_indicator',
+          '_more'
+        ])
+        .with('Suspended', () => [
+          '_spinner',
+          '_kill',
+          '_saveFile',
+          '_configurations',
+          '_storage_indicator',
+          '_more'
+        ])
+        .with('Standby', () => [
+          '_kill',
+          '_activate',
+          '_saveFile',
+          '_configurations',
+          '_storage_indicator',
+          '_more'
+        ])
+        .with('Bootstrapping', () => [
+          '_kill',
+          '_spinner',
+          '_saveFile',
+          '_configurations',
+          '_storage_indicator',
+          '_more'
+        ])
+        .with('Replaying', 'Synchronizing', () => [
+          '_kill',
+          '_spinner',
+          '_saveFile',
+          '_configurations',
+          '_storage_indicator',
+          '_more'
+        ])
+        .with('AwaitingApproval', () => [
+          '_kill',
+          '_saveFile',
+          '_configurations',
+          '_storage_indicator',
+          '_more'
+        ])
+        .with('Stopping', () => [
+          '_kill',
+          '_spinner',
+          '_saveFile',
+          '_configurations',
+          '_storage_indicator',
+          '_more'
+        ])
+        .with(
+          { Queued: P.any },
+          { CompilingSql: P.any },
+          { SqlCompiled: P.any },
+          { CompilingRust: P.any },
+          (cause) => [
+            ...(Object.values(cause)[0].cause === 'upgrade' ? ['_unschedule' as const] : []),
+            '_start_pending',
+            '_saveFile',
+            '_configurations',
+            '_storage_indicator',
+            '_more'
+          ]
+        )
+        .with('SqlError', 'RustError', 'SystemError', () => [
+          '_start_error',
+          '_saveFile',
+          '_configurations',
+          '_storage_indicator',
+          '_more'
+        ])
+        .exhaustive()
+    )
   }
 
   // Define groupable actions
@@ -920,55 +956,12 @@ groups related actions into multi-action dropdowns when multiple options are ava
   </Tooltip>
 {/snippet}
 
-{#snippet pipelineResourcesDialog(dialogTitle: string, field: keyof typeof pipeline.current)}
-  <JSONDialog
-    disabled={editConfigDisabled}
-    title={dialogTitle}
-    value={JSONbig.stringify(pipeline.current[field], undefined, '  ')}
-    filePath="file://feldera/pipelines/{pipeline.current.name}/{field}.json"
-    onApply={async (json) => {
-      await pipeline.patch({
-        [field]: JSONbig.parse(json)
-      })
-    }}
-  ></JSONDialog>
-{/snippet}
-{#snippet resourcesDialog()}
-  {@render pipelineResourcesDialog(
-    `Configure ${pipeline.current.name} runtime resources`,
-    'runtimeConfig'
-  )}
-{/snippet}
-{#snippet compilationDialog()}
-  {@render pipelineResourcesDialog(
-    `Configure ${pipeline.current.name} compilation profile`,
-    'programConfig'
-  )}
-{/snippet}
-{#snippet _configureResources()}
-  <button
-    onclick={() => (globalDialog.dialog = resourcesDialog)}
-    class="{buttonClass} {shortClass} {shortColor} fd fd-sliders-horizontal {basicBtnColor} {iconClass}"
-  >
-  </button>
-  {#if editConfigDisabled}
-    <Tooltip placement="top">Stop the pipeline to edit settings</Tooltip>
-  {/if}
-{/snippet}
-{#snippet _configureProgram()}
-  <button
-    onclick={() => (globalDialog.dialog = compilationDialog)}
-    class="{buttonClass} {shortClass} {shortColor} fd fd-settings {basicBtnColor} {iconClass}"
-  >
-  </button>
-  {#if editConfigDisabled}
-    <Tooltip placement="top">Stop the pipeline to edit settings</Tooltip>
-  {/if}
-{/snippet}
 {#snippet _configurations()}
   <PipelineConfigurationsPopup {pipeline} pipelineBusy={editConfigDisabled}
   ></PipelineConfigurationsPopup>
-  {#if editConfigDisabled}
+  {#if !canWriteConfig.allowed}
+    <Tooltip placement="top">You have read-only access to the configuration</Tooltip>
+  {:else if editConfigDisabled}
     <Tooltip placement="top">Stop the pipeline to edit settings</Tooltip>
   {:else}
     <Tooltip placement="top">Compilation and runtime configuration</Tooltip>
@@ -1030,7 +1023,7 @@ groups related actions into multi-action dropdowns when multiple options are ava
           Cleared
         {/if}
       </div>
-      {#if storageStatus === 'InUse'}
+      {#if storageStatus === 'InUse' && canExec.allowed}
         <button
           class="fd fd-eraser btn-icon rounded p-2 text-[20px] {isShutdown &&
           storageStatus === 'InUse'
@@ -1049,6 +1042,8 @@ groups related actions into multi-action dropdowns when multiple options are ava
     >
       {#if storageStatus === 'Cleared'}
         There are no checkpoints available.
+      {:else if !canExec.allowed}
+        Pipeline storage is in use.
       {:else if isShutdown}
         Pipeline storage is in use. Click to clear it.
       {:else}
diff --git a/js-packages/web-console/src/lib/components/pipelines/table/AvailableActions.svelte b/js-packages/web-console/src/lib/components/pipelines/table/AvailableActions.svelte
index cff302961bc..337445a940d 100644
--- a/js-packages/web-console/src/lib/components/pipelines/table/AvailableActions.svelte
+++ b/js-packages/web-console/src/lib/components/pipelines/table/AvailableActions.svelte
@@ -5,6 +5,7 @@
   import { duplicatePipeline, duplicatePipelineTooltip } from '$lib/compositions/duplicatePipeline'
   import { useGlobalDialog } from '$lib/compositions/layout/useGlobalDialog.svelte'
   import { useUpdatePipelineList } from '$lib/compositions/pipelines/usePipelineList.svelte'
+  import { usePermission } from '$lib/compositions/usePermission.svelte'
   import { getPipelineAction } from '$lib/compositions/usePipelineAction.svelte'
   import { usePipelineManager } from '$lib/compositions/usePipelineManager.svelte'
   import { usePremiumFeatures } from '$lib/compositions/usePremiumFeatures.svelte'
@@ -30,6 +31,17 @@
   ]
   type AvailableAction = (typeof availableActions)[number]
   type StatusAction = Exclude<AvailableAction, 'duplicate'>
+
+  // Bulk lifecycle actions need `exec:pipeline`; duplicate/delete need
+  // `write:pipeline`. A caller lacking a permission never sees the button.
+  const canExec = usePermission('exec:pipeline')
+  const canWrite = usePermission('write:pipeline')
+  const EXEC_BULK = new Set<AvailableAction>(['start', 'resume', 'pause', 'stop', 'kill', 'clear'])
+  const WRITE_BULK = new Set<AvailableAction>(['duplicate', 'delete'])
+  const permittedAction = (action: AvailableAction) =>
+    (EXEC_BULK.has(action) ? canExec.allowed : true) &&
+    (WRITE_BULK.has(action) ? canWrite.allowed : true)
+
   const isPremium = usePremiumFeatures()
   const stop = isPremium.value ? ['stop' as const] : []
   const statusActions = ({ status, storageStatus }: (typeof selected)[number]) => {
@@ -87,7 +99,7 @@
       supportedByAny.add('duplicate')
     }
     return availableActions
-      .filter((action) => supportedByAny.has(action))
+      .filter((action) => supportedByAny.has(action) && permittedAction(action))
       .map((action) =>
         match(action)
           .with('duplicate', () => btnDuplicate)
diff --git a/js-packages/web-console/src/lib/components/pipelines/table/PipelineVersionTooltip.svelte b/js-packages/web-console/src/lib/components/pipelines/table/PipelineVersionTooltip.svelte
index e73179ab48c..818ff2d11ae 100644
--- a/js-packages/web-console/src/lib/components/pipelines/table/PipelineVersionTooltip.svelte
+++ b/js-packages/web-console/src/lib/components/pipelines/table/PipelineVersionTooltip.svelte
@@ -10,6 +10,7 @@
   } = $props()
 
   import { Popover, Tooltip } from 'common-ui'
+  import RBAC from '$lib/components/auth/RBAC.svelte'
   import { usePipelineManager } from '$lib/compositions/usePipelineManager.svelte'
   import { normalizeRuntimeVersion } from '$lib/functions/pipelines/runtimeVersion'
 
@@ -19,10 +20,12 @@
 {#if status === 'update_available'}
   <Popover placement="bottom-end" strategy="fixed">
     <div>A new runtime version {normalizeRuntimeVersion(baseRuntimeVersion)} is available.</div>
-    <button
-      class="mt-2 btn h-6 preset-filled-primary-500"
-      onclick={() => api.postUpdateRuntime(pipelineName)}>Update</button
-    >
+    <RBAC require="exec:runtime_upgrade">
+      <button
+        class="mt-2 btn h-6 preset-filled-primary-500"
+        onclick={() => api.postUpdateRuntime(pipelineName)}>Update</button
+      >
+    </RBAC>
   </Popover>
 {:else if status === 'custom'}
   <Tooltip placement="bottom-end" strategy="fixed">
diff --git a/js-packages/web-console/src/lib/components/pipelines/table/Tags.svelte b/js-packages/web-console/src/lib/components/pipelines/table/Tags.svelte
index 8d8ef0c5dd9..63168e39879 100644
--- a/js-packages/web-console/src/lib/components/pipelines/table/Tags.svelte
+++ b/js-packages/web-console/src/lib/components/pipelines/table/Tags.svelte
@@ -7,6 +7,7 @@
     usePipelineList,
     useUpdatePipelineList
   } from '$lib/compositions/pipelines/usePipelineList.svelte'
+  import { usePermission } from '$lib/compositions/usePermission.svelte'
   import type { PipelineManagerApi } from '$lib/compositions/usePipelineManager.svelte'
   import { useToast } from '$lib/compositions/useToastNotification'
   import { partition } from '$lib/functions/common/array'
@@ -51,6 +52,8 @@
   const pipelineList = usePipelineList()
   const { toastError } = useToast()
 
+  const canEditTags = usePermission('write:pipeline_meta')
+
   // Sort the edited tags to store them in the backend,
   // cache that same order optimistically, and return it as the patch body.
   // This is the one place the client orders tags; readers trust the result.
@@ -280,145 +283,177 @@
   }
 </script>
 
-<Popup>
-  {#snippet trigger(toggle)}
-    {@const open = () => {
-      closeForm()
-      if (knownTags.size === 0) {
-        openCreate('')
-      }
-      toggle()
-    }}
-    <div class="flex flex-nowrap items-center gap-1">
-      {#each inlineTags as tag (tag)}
-        {@render chip(tag, open)}
-      {/each}
-      {#if overflowCount > 0}
-        <button
-          class="px-1 text-sm text-surface-600-400 hover:text-surface-950-50"
-          onclick={open}
-          aria-label="Show all tags"
-        >
-          +{overflowCount}
-        </button>
-        <Tooltip placement="top" class="max-w-[240px] text-wrap"
-          >{tags.map(tagDisplayName).join(', ')}</Tooltip
-        >
-      {/if}
-      {#if tags.length === 0}
+{#if canEditTags.allowed}
+  <Popup>
+    {#snippet trigger(toggle)}
+      {@const open = () => {
+        closeForm()
+        if (knownTags.size === 0) {
+          openCreate('')
+        }
+        toggle()
+      }}
+      {@render inlineTagRow(open)}
+    {/snippet}
+    {#snippet content()}
+      <div
+        transition:slide={{ duration: 100 }}
+        class="bg-white-dark absolute top-8 left-0 z-30 flex w-[304px] flex-col overflow-hidden rounded shadow-md"
+      >
+        <SlidingPanels
+          current={page}
+          width={280}
+          pages={[
+            { key: 'list', content: listPage },
+            { key: 'create', content: createPage },
+            { key: 'edit', content: editPage },
+            { key: 'delete', content: deletePage }
+          ]}
+        />
+      </div>
+
+      {#snippet listPage()}
+        {#if knownTags.size > 0}
+          <div class="p-2">
+            <input
+              class="input h-9 w-full"
+              type="search"
+              placeholder="Search"
+              bind:value={search}
+            />
+          </div>
+        {/if}
+        <div class="scrollbar flex max-h-[280px] flex-col overflow-y-auto pb-1">
+          {#each selectedTags as tag (tag)}
+            {@render tagRow(tag, true)}
+          {/each}
+          {#each unselectedTags as tag (tag)}
+            {@render tagRow(tag, false)}
+          {/each}
+        </div>
         <button
-          class="flex h-5 items-center gap-1 rounded border border-dashed border-surface-500 px-2 text-sm text-surface-800-200 hover:border-surface-950-50 hover:text-surface-950-50"
-          onclick={open}
+          class="flex items-center gap-2 border-t border-surface-100-900 px-3 py-2 text-left text-sm hover:bg-surface-50-950"
+          onclick={() => openCreate(search)}
         >
           <span class="fd fd-plus text-[16px]"></span>
-          Tag
+          Create a new tag
         </button>
-      {/if}
-    </div>
-  {/snippet}
-  {#snippet content()}
-    <div
-      transition:slide={{ duration: 100 }}
-      class="bg-white-dark absolute top-8 left-0 z-30 flex w-[304px] flex-col overflow-hidden rounded shadow-md"
-    >
-      <SlidingPanels
-        current={page}
-        width={280}
-        pages={[
-          { key: 'list', content: listPage },
-          { key: 'create', content: createPage },
-          { key: 'edit', content: editPage },
-          { key: 'delete', content: deletePage }
-        ]}
-      />
-    </div>
+      {/snippet}
+
+      {#snippet createPage()}
+        {@render tagForm({
+          title: 'Create a new tag',
+          submitLabel: candidateExists ? 'Assign' : 'Create',
+          submitDisabled: !newTagName.trim() || candidateError !== null,
+          lockedColor: createLockedColor,
+          validationError: candidateError,
+          onSubmit: submitCreate
+        })}
+      {/snippet}
 
-    {#snippet listPage()}
-      {#if knownTags.size > 0}
-        <div class="p-2">
-          <input class="input h-9 w-full" type="search" placeholder="Search" bind:value={search} />
+      {#snippet editPage()}
+        {@render tagForm({
+          title: 'Edit tag',
+          submitLabel: 'Save',
+          submitDisabled: !newTagName.trim() || candidateError !== null,
+          validationError: candidateError,
+          onSubmit: submitEdit,
+          onDelete: () => (page = 'delete')
+        })}
+      {/snippet}
+
+      {#snippet deletePage()}
+        <div class="flex items-center gap-2 px-2 py-2">
+          <button
+            class="btn-icon h-7 w-7"
+            onclick={() => (page = 'edit')}
+            aria-label="Back"
+            title="Back"
+          >
+            <span class="fd fd-chevron-left text-[20px]"></span>
+          </button>
+          <span class="text-sm font-medium">Delete tag</span>
         </div>
+        <div class="flex flex-col gap-3 px-3 pb-3">
+          <p class="">
+            The tag “{tagDisplayName(editingTag ?? '')}” will be removed from
+            {editingTagUsageCount}
+            {editingTagUsageCount === 1 ? 'pipeline' : 'pipelines'} it's currently assigned to.
+            <br />
+            This cannot be undone.
+          </p>
+          <div class="flex gap-2">
+            <button class="btn flex-1 preset-tonal-surface" onclick={() => (page = 'edit')}>
+              Cancel
+            </button>
+            <button class="btn flex-1 preset-filled-error-500" onclick={submitDelete}>
+              Delete
+            </button>
+          </div>
+        </div>
+      {/snippet}
+    {/snippet}
+  </Popup>
+{:else}
+  <!-- Read-only: tags stay visible as static chips, no editing affordances. -->
+  {@render inlineTagRow()}
+{/if}
+
+<!-- The inline tag row shared by the editable and read-only views. `open` wires
+  the editing affordances (chips, the "+N" overflow, and the empty-state add
+  button all open the popup); without it the row is static display only. -->
+{#snippet inlineTagRow(open?: () => void)}
+  <div class="flex flex-nowrap items-center gap-1">
+    {#each inlineTags as tag (tag)}
+      {@render chip(tag, open)}
+    {/each}
+    {#if overflowCount > 0}
+      {@const allTags = tags.map(tagDisplayName).join(', ')}
+      {@const base = 'px-1 text-sm text-surface-600-400'}
+      <!-- Editable: a button that opens the popup, with a hover tooltip. Read-only:
+        the same "+N" as a static span whose native title shows the full list. -->
+      {#if open}
+        <button class="{base} hover:text-surface-950-50" onclick={open} aria-label="Show all tags">
+          +{overflowCount}
+        </button>
+        <Tooltip placement="top" class="max-w-[240px] text-wrap">{allTags}</Tooltip>
+      {:else}
+        <span class={base} title={allTags}>
+          +{overflowCount}
+        </span>
       {/if}
-      <div class="scrollbar flex max-h-[280px] flex-col overflow-y-auto pb-1">
-        {#each selectedTags as tag (tag)}
-          {@render tagRow(tag, true)}
-        {/each}
-        {#each unselectedTags as tag (tag)}
-          {@render tagRow(tag, false)}
-        {/each}
-      </div>
+    {/if}
+    {#if open && tags.length === 0}
       <button
-        class="flex items-center gap-2 border-t border-surface-100-900 px-3 py-2 text-left text-sm hover:bg-surface-50-950"
-        onclick={() => openCreate(search)}
+        class="flex h-5 items-center gap-1 rounded border border-dashed border-surface-500 px-2 text-sm text-surface-800-200 hover:border-surface-950-50 hover:text-surface-950-50"
+        onclick={open}
       >
         <span class="fd fd-plus text-[16px]"></span>
-        Create a new tag
+        Tag
       </button>
-    {/snippet}
-
-    {#snippet createPage()}
-      {@render tagForm({
-        title: 'Create a new tag',
-        submitLabel: candidateExists ? 'Assign' : 'Create',
-        submitDisabled: !newTagName.trim() || candidateError !== null,
-        lockedColor: createLockedColor,
-        validationError: candidateError,
-        onSubmit: submitCreate
-      })}
-    {/snippet}
-
-    {#snippet editPage()}
-      {@render tagForm({
-        title: 'Edit tag',
-        submitLabel: 'Save',
-        submitDisabled: !newTagName.trim() || candidateError !== null,
-        validationError: candidateError,
-        onSubmit: submitEdit,
-        onDelete: () => (page = 'delete')
-      })}
-    {/snippet}
+    {/if}
+  </div>
+{/snippet}
 
-    {#snippet deletePage()}
-      <div class="flex items-center gap-2 px-2 py-2">
-        <button
-          class="btn-icon h-7 w-7"
-          onclick={() => (page = 'edit')}
-          aria-label="Back"
-          title="Back"
-        >
-          <span class="fd fd-chevron-left text-[20px]"></span>
-        </button>
-        <span class="text-sm font-medium">Delete tag</span>
-      </div>
-      <div class="flex flex-col gap-3 px-3 pb-3">
-        <p class="">
-          The tag “{tagDisplayName(editingTag ?? '')}” will be removed from
-          {editingTagUsageCount}
-          {editingTagUsageCount === 1 ? 'pipeline' : 'pipelines'} it's currently assigned to.
-          <br />
-          This cannot be undone.
-        </p>
-        <div class="flex gap-2">
-          <button class="btn flex-1 preset-tonal-surface" onclick={() => (page = 'edit')}>
-            Cancel
-          </button>
-          <button class="btn flex-1 preset-filled-error-500" onclick={submitDelete}>
-            Delete
-          </button>
-        </div>
-      </div>
-    {/snippet}
-  {/snippet}
-</Popup>
+<!-- A chip is a button that opens the popup when editable and a static label when
+  read-only; both share the same body and base class. -->
+{#snippet chip(tag: string, open?: () => void)}
+  {@const base =
+    'flex h-5 items-center gap-1.5 rounded border border-surface-200-800 px-2 text-sm whitespace-nowrap'}
+  {#if open}
+    <button class="{base} hover:bg-surface-50-950" onclick={open}>
+      {@render chipContent(tag)}
+    </button>
+  {:else}
+    <span class={base}>
+      {@render chipContent(tag)}
+    </span>
+  {/if}
+{/snippet}
 
-{#snippet chip(tag: string, open: () => void)}
-  <button
-    class="flex h-5 items-center gap-1.5 rounded border border-surface-200-800 px-2 text-sm whitespace-nowrap hover:bg-surface-50-950"
-    onclick={open}
-  >
-    <span class="h-2 w-2 rounded-full" style="background-color: {tagColorOf(tag)}"></span>
-    {tagDisplayName(tag)}
-  </button>
+{#snippet chipContent(tag: string)}
+  <span class="h-2 w-2 rounded-full" style="background-color: {tagColorOf(tag)}"></span>
+  {tagDisplayName(tag)}
 {/snippet}
 
 {#snippet tagRow(tag: string, selected: boolean)}
diff --git a/js-packages/web-console/src/lib/components/pipelines/table/Tags.svelte.spec.ts b/js-packages/web-console/src/lib/components/pipelines/table/Tags.svelte.spec.ts
index 7391ec20ad2..9646f65c518 100644
--- a/js-packages/web-console/src/lib/components/pipelines/table/Tags.svelte.spec.ts
+++ b/js-packages/web-console/src/lib/components/pipelines/table/Tags.svelte.spec.ts
@@ -1,7 +1,23 @@
-import { describe, expect, it, vi } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 import { page, userEvent } from 'vitest/browser'
 import { render } from 'vitest-browser-svelte'
 import type { PipelineManagerApi } from '$lib/compositions/usePipelineManager.svelte'
+import { permissionsOf } from '$lib/services/rbac'
+
+// Tag mutation (assign/unassign/create/edit/delete) is gated on
+// write:pipeline_meta. Default the mocked role to `write` so the existing
+// interactive assertions hold; the read-only case sets it to `read`.
+const roleState = vi.hoisted(() => ({ current: 'write' as 'read' | 'write' | 'admin' | 'owner' }))
+vi.mock('$app/state', () => ({
+  page: {
+    data: {
+      get feldera() {
+        return { role: roleState.current, permissions: permissionsOf(roleState.current) }
+      }
+    }
+  }
+}))
+
 import Tags from './Tags.svelte'
 
 // A stub Pipeline Manager client: only `patchPipeline` is exercised by the
@@ -23,7 +39,30 @@ const renderTags = (props: { tags: string[]; knownTags?: string[] }) => {
   return { ...result, patchPipeline }
 }
 
+afterEach(() => {
+  roleState.current = 'write'
+})
+
 describe('Tags.svelte', () => {
+  describe('write:pipeline_meta gating', () => {
+    it('shows tags but no editing affordance for a read-only caller', async () => {
+      roleState.current = 'read'
+      renderTags({ tags: ['dev', 'prod|ef4444'] })
+      // Tags stay visible as static chips.
+      await expect.element(page.getByText('dev')).toBeVisible()
+      await expect.element(page.getByText('prod')).toBeVisible()
+      // No mutation affordances. Reverting the gate renders these for read.
+      expect(page.getByRole('button', { name: 'dev' }).elements()).toHaveLength(0)
+      expect(page.getByRole('button', { name: 'Show all tags' }).elements()).toHaveLength(0)
+    })
+
+    it('shows no add-tag affordance for a read-only caller with no tags', async () => {
+      roleState.current = 'read'
+      renderTags({ tags: [] })
+      expect(page.getByRole('button', { name: 'Tag' }).elements()).toHaveLength(0)
+    })
+  })
+
   describe('chips', () => {
     it('renders each assigned tag as a chip by display name, stripping the color', async () => {
       renderTags({ tags: ['dev', 'prod|ef4444'] })
diff --git a/js-packages/web-console/src/lib/compositions/pipelines/useTryPipeline.ts b/js-packages/web-console/src/lib/compositions/pipelines/useTryPipeline.ts
index bb0a3d395bd..869fde0d80b 100644
--- a/js-packages/web-console/src/lib/compositions/pipelines/useTryPipeline.ts
+++ b/js-packages/web-console/src/lib/compositions/pipelines/useTryPipeline.ts
@@ -13,6 +13,9 @@ export const useTryPipeline = () => {
   const pipelineList = usePipelineList()
   const api = usePipelineManager()
   return async (pipeline: Omit<Demo, 'title'>, trigger_location?: string) => {
+    // When the demo's pipeline already exists, just open it. This lets a
+    // read-only caller follow a demo tile without a create call (a 403), and
+    // spares a write caller from clobbering an existing pipeline.
     const already_created = (pipelineList.pipelines ?? []).some((p) => p.name === pipeline.name)
     captureEvent('demo_opened', {
       demo: pipeline.name,
diff --git a/js-packages/web-console/src/lib/compositions/usePermission.svelte.ts b/js-packages/web-console/src/lib/compositions/usePermission.svelte.ts
new file mode 100644
index 00000000000..17437dd21d2
--- /dev/null
+++ b/js-packages/web-console/src/lib/compositions/usePermission.svelte.ts
@@ -0,0 +1,15 @@
+import { page } from '$app/state'
+import { hasPermissions, type Permission } from '$lib/services/rbac'
+
+// Reactive single-permission check for gates that feed a boolean into existing
+// plumbing rather than wrapping markup, e.g. Monaco's `editDisabled`. Reads the
+// permission list materialized into `page.data.feldera` at init (see
+// +layout.ts). For markup gates prefer the `<RBAC>` wrapper.
+export const usePermission = (permission: Permission) => {
+  const allowed = $derived(hasPermissions(page.data.feldera, permission))
+  return {
+    get allowed() {
+      return allowed
+    }
+  }
+}
diff --git a/js-packages/web-console/src/lib/services/pipelineManager.ts b/js-packages/web-console/src/lib/services/pipelineManager.ts
index 7960413b56b..68ff699da13 100644
--- a/js-packages/web-console/src/lib/services/pipelineManager.ts
+++ b/js-packages/web-console/src/lib/services/pipelineManager.ts
@@ -4,10 +4,10 @@ import {
   type CombinedStatus as _CombinedStatus,
   checkpointPipeline as _checkpointPipeline,
   createTenant as _createTenant,
-  deleteTenant as _deleteTenant,
   deleteApiKey as _deleteApiKey,
   deleteOidcTrust as _deleteOidcTrust,
   deletePipeline as _deletePipeline,
+  deleteTenant as _deleteTenant,
   deleteTenantUser as _deleteTenantUser,
   getCheckpointStatus as _getCheckpointStatus,
   getCheckpointSyncStatus as _getCheckpointSyncStatus,
diff --git a/js-packages/web-console/src/lib/services/rbac.spec.ts b/js-packages/web-console/src/lib/services/rbac.spec.ts
new file mode 100644
index 00000000000..89f7344b749
--- /dev/null
+++ b/js-packages/web-console/src/lib/services/rbac.spec.ts
@@ -0,0 +1,172 @@
+// Unit tests for the client RBAC map plus a drift guard against the backend.
+//
+// The map in `rbac.ts` mirrors the backend's per-route minimum roles, which the
+// API exposes only as prose ("Required role: `write` or higher.") in
+// `openapi.json`. The drift guard parses those phrases and asserts the backend
+// uses no role the client fails to model, catching the one silent way this
+// mirror can rot: a new backend role.
+
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { describe, expect, it } from 'vitest'
+import {
+  DEFAULT_PERMISSIONS,
+  hasPermission,
+  hasPermissions,
+  type Permission,
+  permissionsOf,
+  ROLES,
+  type Role,
+  roleOf
+} from './rbac'
+
+// Cumulative expectation, stated independently of the map's internal wiring so a
+// bug in the precompute cannot pass by matching itself.
+const EXPECTED: Record<Role, Permission[]> = {
+  read: ['read:pipeline', 'read:pipeline_code', 'read:pipeline_config', 'read:support_bundle'],
+  write: [
+    'read:pipeline',
+    'read:pipeline_code',
+    'read:pipeline_config',
+    'read:support_bundle',
+    'write:pipeline',
+    'write:pipeline_code',
+    'write:pipeline_config',
+    'write:pipeline_meta',
+    'exec:pipeline',
+    'exec:checkpoint',
+    'exec:runtime_upgrade',
+    'exec:pipeline_data',
+    'write:api_key'
+  ],
+  admin: [], // filled below (write + admin adds)
+  owner: [] // filled below (admin + owner adds)
+}
+EXPECTED.admin = [...EXPECTED.write, 'write:tenant_member', 'write:oidc_trust']
+EXPECTED.owner = [...EXPECTED.admin, 'write:tenant', 'write:owner_trust']
+
+const ALL_PERMISSIONS = EXPECTED.owner
+
+describe('hasPermission', () => {
+  it('grants each role exactly its cumulative permission set', () => {
+    for (const role of ROLES) {
+      const granted = ALL_PERMISSIONS.filter((p) => hasPermission(role, p))
+      expect(new Set(granted)).toEqual(new Set(EXPECTED[role]))
+    }
+  })
+
+  it('is monotonic: a higher role never loses a lower role permission', () => {
+    for (let i = 1; i < ROLES.length; i++) {
+      const lower = ROLES[i - 1]
+      const higher = ROLES[i]
+      for (const p of ALL_PERMISSIONS) {
+        if (hasPermission(lower, p)) {
+          expect(hasPermission(higher, p)).toBe(true)
+        }
+      }
+    }
+  })
+
+  it('denies write and admin permissions to read', () => {
+    expect(hasPermission('read', 'write:pipeline')).toBe(false)
+    expect(hasPermission('read', 'exec:pipeline')).toBe(false)
+    expect(hasPermission('read', 'write:api_key')).toBe(false)
+    expect(hasPermission('read', 'write:tenant_member')).toBe(false)
+  })
+
+  it('reserves tenant and owner-trust management for owner', () => {
+    expect(hasPermission('admin', 'write:tenant')).toBe(false)
+    expect(hasPermission('admin', 'write:owner_trust')).toBe(false)
+    expect(hasPermission('owner', 'write:tenant')).toBe(true)
+    expect(hasPermission('owner', 'write:owner_trust')).toBe(true)
+  })
+})
+
+describe('permissionsOf', () => {
+  it('returns the cumulative permission set for each role', () => {
+    for (const role of ROLES) {
+      expect(new Set(permissionsOf(role))).toEqual(new Set(EXPECTED[role]))
+    }
+  })
+
+  it('agrees with hasPermission for every role and permission', () => {
+    for (const role of ROLES) {
+      const set = new Set(permissionsOf(role))
+      for (const p of ALL_PERMISSIONS) {
+        expect(set.has(p)).toBe(hasPermission(role, p))
+      }
+    }
+  })
+
+  it('returns a fresh array each call so a caller cannot corrupt the map', () => {
+    const first = permissionsOf('read')
+    first.push('write:pipeline')
+    expect(permissionsOf('read')).not.toContain('write:pipeline')
+  })
+})
+
+describe('hasPermissions (session-facing)', () => {
+  it('reads the granted list off the session feldera data', () => {
+    const write = { permissions: permissionsOf('write') }
+    expect(hasPermissions(write, 'write:pipeline')).toBe(true)
+    expect(hasPermissions({ permissions: permissionsOf('read') }, 'write:pipeline')).toBe(false)
+  })
+
+  it('falls back to the read floor when the session is absent', () => {
+    // A rendered app shell with no session config (config-load error): reads are
+    // permitted, writes denied, and nothing throws.
+    expect(hasPermissions(undefined, 'read:pipeline')).toBe(true)
+    expect(hasPermissions(undefined, 'write:pipeline')).toBe(false)
+    expect(hasPermissions(undefined, 'write:tenant_member')).toBe(false)
+  })
+})
+
+describe('DEFAULT_PERMISSIONS', () => {
+  it('equals the read role grant', () => {
+    expect(new Set(DEFAULT_PERMISSIONS)).toEqual(new Set(permissionsOf('read')))
+  })
+
+  it('is frozen so a consumer reading the shared default cannot mutate it', () => {
+    expect(Object.isFrozen(DEFAULT_PERMISSIONS)).toBe(true)
+  })
+})
+
+describe('roleOf', () => {
+  it('passes through every known role', () => {
+    for (const role of ROLES) {
+      expect(roleOf(role)).toBe(role)
+    }
+  })
+
+  it('defaults unknown or missing input to the least-privileged role', () => {
+    expect(roleOf(undefined)).toBe('read')
+    expect(roleOf('')).toBe('read')
+    expect(roleOf('superuser')).toBe('read')
+  })
+})
+
+// Locate the repo-root openapi.json by walking up from this file, so the guard
+// survives a move of the package within the tree.
+const findOpenapi = (): string => {
+  let dir = path.dirname(fileURLToPath(import.meta.url))
+  for (let i = 0; i < 8; i++) {
+    const candidate = path.join(dir, 'openapi.json')
+    if (fs.existsSync(candidate)) {
+      return candidate
+    }
+    dir = path.dirname(dir)
+  }
+  throw new Error('openapi.json not found walking up from rbac.spec.ts')
+}
+
+describe('drift guard against openapi.json', () => {
+  it('models every role the backend requires on a route', () => {
+    const spec = fs.readFileSync(findOpenapi(), 'utf8')
+    const backendRoles = new Set([...spec.matchAll(/Required role: `([a-z]+)`/g)].map((m) => m[1]))
+
+    expect(backendRoles.size).toBeGreaterThan(0)
+    const unmodeled = [...backendRoles].filter((r) => !(ROLES as string[]).includes(r))
+    expect(unmodeled).toEqual([])
+  })
+})
diff --git a/js-packages/web-console/src/lib/services/rbac.ts b/js-packages/web-console/src/lib/services/rbac.ts
new file mode 100644
index 00000000000..f706ffe185d
--- /dev/null
+++ b/js-packages/web-console/src/lib/services/rbac.ts
@@ -0,0 +1,92 @@
+// Client-side RBAC: the role to permission map that web-console gates UI on.
+//
+// The backend enforces a single ordered role per route (read < write < admin <
+// owner). It exposes only the caller's own role (via the session payload, see
+// AUTH_AND_TENANCY.md), never a route to role table, so the client cannot
+// re-derive per-feature authorization from the API. Instead it keeps this
+// hardcoded map. A gate then reads as "this feature needs `exec:runtime_upgrade`"
+// and the role that grants it is one lookup, not a rank comparison at the call
+// site. The map mirrors the backend today; `rbac.spec.ts` guards against the
+// backend introducing a role the client does not model.
+
+export type Role = 'read' | 'write' | 'admin' | 'owner'
+
+export type Permission =
+  | 'read:pipeline'
+  | 'read:pipeline_code'
+  | 'read:pipeline_config'
+  | 'read:support_bundle'
+  | 'write:pipeline'
+  | 'write:pipeline_code'
+  | 'write:pipeline_config'
+  | 'write:pipeline_meta'
+  | 'exec:pipeline'
+  | 'exec:checkpoint'
+  | 'exec:runtime_upgrade'
+  | 'exec:pipeline_data'
+  | 'write:api_key'
+  | 'write:tenant_member'
+  | 'write:oidc_trust'
+  | 'write:tenant'
+  | 'write:owner_trust'
+
+// Ordered low to high. A role grants everything the roles before it grant.
+export const ROLES: Role[] = ['read', 'write', 'admin', 'owner']
+
+// What each role adds on top of the role below it (cumulative, see below).
+const GRANTS: Record<Role, Permission[]> = {
+  read: ['read:pipeline', 'read:pipeline_code', 'read:pipeline_config', 'read:support_bundle'],
+  write: [
+    'write:pipeline',
+    'write:pipeline_code',
+    'write:pipeline_config',
+    'write:pipeline_meta',
+    'exec:pipeline',
+    'exec:checkpoint',
+    'exec:runtime_upgrade',
+    'exec:pipeline_data',
+    'write:api_key'
+  ],
+  admin: ['write:tenant_member', 'write:oidc_trust'],
+  owner: ['write:tenant', 'write:owner_trust']
+}
+
+// Precompute the cumulative permission set per role once.
+const PERMISSIONS: Record<Role, ReadonlySet<Permission>> = (() => {
+  const acc: Permission[] = []
+  const out = {} as Record<Role, Set<Permission>>
+  for (const role of ROLES) {
+    acc.push(...GRANTS[role])
+    out[role] = new Set(acc)
+  }
+  return out
+})()
+
+export const hasPermission = (role: Role, permission: Permission): boolean =>
+  PERMISSIONS[role].has(permission)
+
+// The permissions a role grants, as a plain array. `+layout.ts` materializes
+// this into `page.data.feldera.permissions` at session-config init, so UI gates
+// read a data field (as if the server sent it) instead of applying the map at
+// every call site.
+export const permissionsOf = (role: Role): Permission[] => [...PERMISSIONS[role]]
+
+// Default to the least-privileged role when the session payload lacks one, so a
+// missing role never silently unlocks a feature.
+export const roleOf = (role: string | undefined): Role =>
+  (ROLES as string[]).includes(role ?? '') ? (role as Role) : 'read'
+
+// Fallback for a session whose config is not present yet (boot, unauthenticated,
+// or a config-load error that still renders the app shell). Frozen so a consumer
+// cannot mutate the shared default.
+export const DEFAULT_PERMISSIONS: readonly Permission[] = Object.freeze(permissionsOf('read'))
+
+// Whether the session grants a permission. Reads the permission list
+// materialized into `page.data.feldera` (see +layout.ts) and falls back to the
+// read floor when `feldera` is absent, so gates never crash and never leak write
+// access before the session loads. This is the session-facing check; the
+// role-facing `hasPermission` above is used at init and in tests.
+export const hasPermissions = (
+  feldera: { permissions: readonly Permission[] } | undefined,
+  permission: Permission
+): boolean => (feldera?.permissions ?? DEFAULT_PERMISSIONS).includes(permission)
diff --git a/js-packages/web-console/src/routes/(system)/(authenticated)/admin/+page.ts b/js-packages/web-console/src/routes/(system)/(authenticated)/admin/+page.ts
index 8a6fe282d7b..31b96882e84 100644
--- a/js-packages/web-console/src/routes/(system)/(authenticated)/admin/+page.ts
+++ b/js-packages/web-console/src/routes/(system)/(authenticated)/admin/+page.ts
@@ -1,12 +1,13 @@
 import type { LoadEvent } from '@sveltejs/kit'
 import { redirect } from '@sveltejs/kit'
 import { resolve } from '$lib/functions/svelte'
+import { hasPermissions } from '$lib/services/rbac'
 
-// Gate the admin area: only admins and owners may enter; everyone else goes home.
+// Gate the admin area on the lowest permission any admin section needs
+// (`write:tenant_member`); everyone below admin goes home.
 export const load = async ({ parent }: LoadEvent) => {
   const data = await parent()
-  const role = data.feldera?.role
-  if (role !== 'admin' && role !== 'owner') {
+  if (!hasPermissions(data.feldera, 'write:tenant_member')) {
     throw redirect(307, resolve('/'))
   }
   return {}
diff --git a/js-packages/web-console/src/routes/+layout.ts b/js-packages/web-console/src/routes/+layout.ts
index c7273aa2c95..68465336116 100644
--- a/js-packages/web-console/src/routes/+layout.ts
+++ b/js-packages/web-console/src/routes/+layout.ts
@@ -31,6 +31,7 @@ import type { Configuration, SessionInfo } from '$lib/services/manager'
 import { client } from '$lib/services/manager/client.gen'
 import { initPosthog } from '$lib/services/posthog'
 import { initProductFruits } from '$lib/services/productFruits'
+import { type Permission, permissionsOf, type Role, roleOf } from '$lib/services/rbac'
 import type { AuthDetails } from '$lib/types/auth'
 import type { LayoutLoad } from './$types'
 
@@ -102,11 +103,12 @@ export type LayoutData = {
         /**
          * Caller's RBAC role in the current tenant: read < write < admin < owner.
          */
-        role: 'read' | 'write' | 'admin' | 'owner'
+        role: Role
         /**
-         * True when the caller owns the tenant (gates owner-only admin UI).
+         * Permissions the role grants, materialized from the client role→permission
+         * map at init.
          */
-        isOwner: boolean
+        permissions: Permission[]
         /**
          * Only available if authenticated and using multi-tenant authorization
          */
@@ -402,6 +404,7 @@ function buildFelderaData(
   config: Configuration,
   sessionConfig: SessionInfo | undefined
 ) {
+  const role = roleOf(sessionConfig?.role)
   return {
     version: config.version,
     edition: config.edition,
@@ -417,10 +420,11 @@ function buildFelderaData(
     tenantId: sessionConfig?.tenant_id || '',
     tenantName: sessionConfig?.tenant_name || '',
     // `role` is added by the RBAC backend; the SDK type lags, so read it off the
-    // session payload and default to the least-privileged role. `owner` is the
-    // top role, so ownership is just that value.
-    role: sessionConfig?.role || 'read',
-    isOwner: sessionConfig?.role === 'owner',
+    // session payload and normalize any unexpected value to the least-privileged
+    // role. Permissions are materialized here once from the client
+    // role→permission map; owner-only UI gates on `write:tenant` (owner-only).
+    role,
+    permissions: permissionsOf(role),
     authorizedTenants: computeAuthorizedTenants(auth),
     unstableFeatures: config.unstable_features?.split(',').map((f: string) => f.trim()) || [],
     config
diff --git a/js-packages/web-console/web-console-permissions.md b/js-packages/web-console/web-console-permissions.md
new file mode 100644
index 00000000000..59e2a831fde
--- /dev/null
+++ b/js-packages/web-console/web-console-permissions.md
@@ -0,0 +1,378 @@
+# web-console permissions and UI gating plan
+
+Plan for gating interactive UI on the caller's role. Builds on the role model in
+`AUTH_AND_TENANCY.md`; read that for where the role comes from
+(`page.data.feldera.role`).
+
+## 1. Model
+
+web-console gates on named permissions, not on the role directly. A permission is
+`verb:resource`. Three verbs, kept deliberately few:
+
+| Verb    | Meaning                                                            |
+| ------- | ------------------------------------------------------------------ |
+| `read`  | view a resource                                                    |
+| `write` | change a resource's definition or data (create, edit, delete)      |
+| `exec`  | run an operation against a running pipeline (no definition change) |
+
+`delete` is `write` for now.
+
+The backend still enforces a single ordered role (`read < write < admin < owner`)
+and gates each route at one minimum role. web-console does not re-derive that by
+rank. Instead it keeps its own hardcoded role→permission map (§3). The map happens
+to mirror the backend today, but stating it explicitly means a gate reads as "this
+feature needs `exec:runtime_upgrade`", and the role that grants it is one lookup,
+not a rank comparison scattered across call sites.
+
+## 2. Permission catalog
+
+| Permission              | Feature group                                                                 |
+| ----------------------- | ----------------------------------------------------------------------------- |
+| `read:pipeline`         | list/view pipelines, status, stats, logs, metrics, dataflow graph             |
+| `read:pipeline_code`    | view SQL / UDF code                                                           |
+| `read:pipeline_config`  | view runtime / program config, resources                                      |
+| `read:support_bundle`   | download support bundle, collect heap/samply/circuit profiles, diff           |
+| `write:pipeline`        | create, duplicate, import demo, delete                                        |
+| `write:pipeline_code`   | edit SQL / UDF Rust / UDF TOML                                                |
+| `write:pipeline_config` | edit runtime config, compilation profile, resources                           |
+| `write:pipeline_meta`   | rename, tags                                                                  |
+| `exec:pipeline`         | start/stop/pause/resume/standby/activate, kill, clear, approve, dismiss error |
+| `exec:checkpoint`       | checkpoint now, sync to object store                                          |
+| `exec:runtime_upgrade`  | recompile / update runtime version                                            |
+| `exec:pipeline_data`    | ad-hoc SQL, data ingress                                                      |
+| `write:api_key`         | list / create / delete API keys                                               |
+| `write:tenant_member`   | list / add / set-role / remove tenant members                                 |
+| `write:oidc_trust`      | per-tenant OIDC trust CRUD                                                    |
+| `write:tenant`          | list / create / rename / delete tenants                                       |
+| `write:owner_trust`     | platform-wide owner OIDC trust CRUD                                           |
+
+## 3. Role → permission map (hardcoded, cumulative)
+
+Each role grants everything the previous role grants, plus the rows below. This is
+the source of truth in `src/lib/services/rbac.ts` (§5.1).
+
+| Role    | Adds                                                                                                                                                                                       |
+| ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `read`  | `read:pipeline`, `read:pipeline_code`, `read:pipeline_config`, `read:support_bundle`                                                                                                       |
+| `write` | `write:pipeline`, `write:pipeline_code`, `write:pipeline_config`, `write:pipeline_meta`, `exec:pipeline`, `exec:checkpoint`, `exec:runtime_upgrade`, `exec:pipeline_data`, `write:api_key` |
+| `admin` | `write:tenant_member`, `write:oidc_trust`                                                                                                                                                  |
+| `owner` | `write:tenant`, `write:owner_trust`                                                                                                                                                        |
+
+Consequences for `read`:
+
+- Sees every pipeline, its code, config, stats, logs. Reads are the floor, never gated.
+- Downloads support bundles and collects profiling data (all `read`-role on the backend).
+- No pipeline actions, no editing, no ad-hoc query, no API keys, no admin.
+
+## 4. Features to gate, by file
+
+Style: `hide` renders only when permitted; `disable` keeps the control inert with
+a read-only hint; `readonly` puts an editor in read-only mode. Read features are
+omitted here; they are ungated.
+
+### 4.1 Pipeline lifecycle and creation
+
+| File                                                                                                | Control                                                                          | Permission                                           | Style |
+| --------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | ---------------------------------------------------- | ----- |
+| `pipelines/PipelineNameInput.svelte`, `pipelines/CreatePipelineButton.svelte`                       | name input + New Pipeline                                                        | `write:pipeline`                                     | hide  |
+| `pipelines/list/Actions.svelte`                                                                     | start / start-paused / resume / standby / activate / pause / stop / kill / clear | `exec:pipeline`                                      | hide  |
+| `pipelines/list/Actions.svelte`                                                                     | More menu: delete, duplicate                                                     | `write:pipeline`                                     | hide  |
+| `pipelines/table/AvailableActions.svelte`                                                           | bulk start/resume/pause/stop/kill/clear; delete; duplicate                       | `exec:pipeline` (delete/duplicate: `write:pipeline`) | hide  |
+| `pipelines/editor/performance/{CheckpointsIndicator,CheckpointsStatus,CheckpointDialog}.svelte`     | create checkpoint                                                                | `exec:checkpoint`                                    | hide  |
+| `layout/pipelines/PipelineEditLayout.svelte`, `pipelines/editor/ReviewPipelineChangesDialog.svelte` | dismiss deployment error; approve changes                                        | `exec:pipeline`                                      | hide  |
+
+Preference applied: pipeline actions are hidden for `read`, not shown-disabled.
+Existing disable reasons inside these controls (Enterprise-only stop via
+`usePremiumFeatures`, unsaved-changes) stay; they run only for `write`+ who now
+see the control at all.
+
+### 4.2 Editing
+
+| File                                                                              | Control                                             | Permission              | Style                 |
+| --------------------------------------------------------------------------------- | --------------------------------------------------- | ----------------------- | --------------------- |
+| `layout/pipelines/PipelineCodePanel.svelte`, `pipelines/editor/CodeEditor.svelte` | Monaco SQL / UDF editors, save, conflict-resolution | `write:pipeline_code`   | readonly              |
+| `pipelines/list/Actions.svelte` (`_saveFile`)                                     | save-file button / "File saved" indicator           | `write:pipeline_code`   | hide                  |
+| `layout/pipelines/PipelineConfigurationsPopup.svelte`                             | runtime / compilation config JSON editors, Apply    | `write:pipeline_config` | readonly + hide Apply |
+| `layout/pipelines/PipelineEditLayout.svelte` (`DoubleClickInput`)                 | rename pipeline                                     | `write:pipeline_meta`   | hide                  |
+| `pipelines/table/Tags.svelte`                                                     | assign/unassign, create / edit / delete tag         | `write:pipeline_meta`   | hide                  |
+
+`EditorOptionsPopup.svelte` (autosave, minimap, font size) is a local preference,
+not gated.
+
+### 4.3 Data and runtime
+
+| File                                                                                          | Control                                | Permission             | Style    |
+| --------------------------------------------------------------------------------------------- | -------------------------------------- | ---------------------- | -------- |
+| `pipelines/editor/MonitoringPanel.svelte`, `pipelines/editor/InteractionPanel.svelte`         | Ad-Hoc Queries and Changes Stream tabs | `exec:pipeline_data`   | hide tab |
+| `pipelines/editor/StorageInUseBanner.svelte`, `pipelines/table/PipelineVersionTooltip.svelte` | Update runtime version                 | `exec:runtime_upgrade` | hide     |
+
+The Ad-Hoc Queries and Changes Stream tabs both read/stream live pipeline data,
+so the whole tab is hidden rather than made read-only. Each panel drops a saved
+tab selection that points at a now-hidden tab back to the first visible tab on
+init, so a `read` caller never lands on a blank panel. Because the tab is hidden,
+`TabAdHocQuery.svelte` / `adhoc/Query.svelte` carry no in-tab gate of their own.
+
+### 4.4 Demos (conditional for `read`)
+
+| File                                                                                                                      | Behavior                                                                                                                                                                                                       |
+| ------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `other/DemoTile.svelte`, `compositions/pipelines/useTryPipeline.ts`, `routes/(system)/(authenticated)/demos/+page.svelte` | Enabled when a pipeline with the demo's name already exists (clicking navigates to it, allowed for `read`) OR the caller has `write:pipeline` (clicking creates it). Disable the tile only when neither holds. |
+
+This is the one gate that is not a plain permission check: `enabled = pipelineExists || has('write:pipeline')`. The header Create Pipeline button stays a plain `write:pipeline` hide.
+
+### 4.5 API keys and admin (mostly shipped)
+
+| File                                                                                  | Permission            | Min role | Status                                                               |
+| ------------------------------------------------------------------------------------- | --------------------- | -------- | -------------------------------------------------------------------- |
+| `auth/ProfileButton.svelte`, `other/ApiKeyMenu.svelte`, `apiKey/NewApiKeyForm.svelte` | `write:api_key`       | write    | menu already gated; migrate its ad-hoc role check to `write:api_key` |
+| `routes/(system)/(authenticated)/admin/+page.ts`                                      | `write:tenant_member` | admin    | already redirects; express via permission                            |
+| `admin/UserRoleTable.svelte`                                                          | `write:tenant_member` | admin    | in admin area                                                        |
+| `other/OidcTrustMenu.svelte`, `oidcTrust/NewOidcTrustForm.svelte`                     | `write:oidc_trust`    | admin    | in gated menu                                                        |
+| `admin/TenantList.svelte`, `admin/AdminPage.svelte` (tenant switcher, Platform owners, Tenants) | `write:tenant`        | owner    | gated on `write:tenant`; owner-trust CRUD removed (owner is deploy-time config, shown read-only) |
+
+Within `NewApiKeyForm.svelte`, both `read` and `write` key options stay offered:
+everyone who can open the menu already holds `write:api_key`, so the old
+`canGrantWrite` branch collapses.
+
+### 4.6 Not gated (account / session / UI-local)
+
+`auth/CurrentTenant.svelte` (tenant switch), `auth/ProfileButton.svelte` Sign Out,
+`other/AuthErrorToast.svelte` (re-auth), `layout/userPopup/DarkModeSwitch.svelte`,
+`layout/pipelines/EditorOptionsPopup.svelte`, `layout/{Drawer,InlineDrawer}.svelte`,
+`profile-viewer/+page.svelte`, `version/**`, `health/**`.
+
+## 5. Technical design
+
+No `canWrite` / `isOwner` booleans. Every gate names the permission it needs; the
+role→permission map is the only place roles appear.
+
+### 5.1 `rbac.ts`: the map and the check
+
+Pure module, no runes, unit-testable.
+
+`src/lib/services/rbac.ts`
+
+```ts
+export type Role = 'read' | 'write' | 'admin' | 'owner'
+
+export type Permission =
+  | 'read:pipeline'
+  | 'read:pipeline_code'
+  | 'read:pipeline_config'
+  | 'read:support_bundle'
+  | 'write:pipeline'
+  | 'write:pipeline_code'
+  | 'write:pipeline_config'
+  | 'write:pipeline_meta'
+  | 'exec:pipeline'
+  | 'exec:checkpoint'
+  | 'exec:runtime_upgrade'
+  | 'exec:pipeline_data'
+  | 'write:api_key'
+  | 'write:tenant_member'
+  | 'write:oidc_trust'
+  | 'write:tenant'
+  | 'write:owner_trust'
+
+// Ordered low to high. Each role adds to the ones before it.
+const ROLES: Role[] = ['read', 'write', 'admin', 'owner']
+
+const GRANTS: Record<Role, Permission[]> = {
+  read: ['read:pipeline', 'read:pipeline_code', 'read:pipeline_config', 'read:support_bundle'],
+  write: [
+    'write:pipeline',
+    'write:pipeline_code',
+    'write:pipeline_config',
+    'write:pipeline_meta',
+    'exec:pipeline',
+    'exec:checkpoint',
+    'exec:runtime_upgrade',
+    'exec:pipeline_data',
+    'write:api_key'
+  ],
+  admin: ['write:tenant_member', 'write:oidc_trust'],
+  owner: ['write:tenant', 'write:owner_trust']
+}
+
+// Precompute the cumulative set per role once.
+const PERMISSIONS: Record<Role, ReadonlySet<Permission>> = (() => {
+  const acc: Permission[] = []
+  const out = {} as Record<Role, Set<Permission>>
+  for (const role of ROLES) {
+    acc.push(...GRANTS[role])
+    out[role] = new Set(acc)
+  }
+  return out
+})()
+
+export const hasPermission = (role: Role, permission: Permission): boolean =>
+  PERMISSIONS[role].has(permission)
+
+// The permissions a role grants, as a plain array. `+layout.ts` materializes
+// this into `page.data.feldera.permissions` at session-config init.
+export const permissionsOf = (role: Role): Permission[] => [...PERMISSIONS[role]]
+
+// Fallback for a session whose config is not present yet.
+export const DEFAULT_PERMISSIONS: readonly Permission[] = Object.freeze(permissionsOf('read'))
+
+// Session-facing check: reads the materialized list off `page.data.feldera` and
+// falls back to the read floor when it is absent, so gates never crash and never
+// leak write access before the session loads.
+export const hasPermissions = (
+  feldera: { permissions: readonly Permission[] } | undefined,
+  permission: Permission
+): boolean => (feldera?.permissions ?? DEFAULT_PERMISSIONS).includes(permission)
+```
+
+`+layout.ts` normalizes the role once with `roleOf` and injects the granted
+permissions, so the role to permission map is applied at the single boundary
+where session data enters, and every gate reads a data field:
+
+```ts
+const role = roleOf(sessionConfig?.role)
+// ...page.data.feldera:
+role,
+permissions: permissionsOf(role)
+```
+
+### 5.2 `<RBAC>`: the gating wrapper
+
+One component covers the common markup gates. It reads the role reactively from
+`page` (the Svelte 5 replacement for `let:` is the snippet parameter, so the child
+snippet receives an `RBACState`).
+
+`src/lib/components/auth/RBAC.svelte`
+
+```svelte
+<script lang="ts" module>
+  export type RBACState = {
+    allowed: boolean
+    // Spread onto the gated element to apply the read-only look when disallowed;
+    // empty object when allowed.
+    disabledProps: Record<string, unknown>
+  }
+</script>
+
+<script lang="ts">
+  import type { Snippet } from 'svelte'
+  import { page } from '$app/state'
+  import { hasPermissions, type Permission } from '$lib/services/rbac'
+
+  let {
+    require: permission,
+    mode = 'hide',
+    message = 'You have read-only access',
+    children
+  }: {
+    require: Permission
+    mode?: 'hide' | 'disable'
+    message?: string
+    children: Snippet<[RBACState]>
+  } = $props()
+
+  const allowed = $derived(hasPermissions(page.data.feldera, permission))
+  const state = $derived<RBACState>({
+    allowed,
+    disabledProps: allowed
+      ? {}
+      : {
+          disabled: true,
+          'aria-disabled': 'true',
+          title: message,
+          class: 'pointer-events-none opacity-50'
+        }
+  })
+</script>
+
+{#if mode === 'disable' || allowed}
+  {@render children(state)}
+{/if}
+```
+
+Three ways to use it, in ascending manual control:
+
+```svelte
+<!-- hide: control vanishes for those without the permission -->
+<RBAC require="write:pipeline">
+  <CreatePipelineButton />
+</RBAC>
+
+<!-- disable: control stays, spread the ready-made attrs+class -->
+<RBAC require="exec:runtime_upgrade" mode="disable">
+  {#snippet children({ disabledProps })}
+    <button {...disabledProps} onclick={update}>Update</button>
+  {/snippet}
+</RBAC>
+
+<!-- manual: use the boolean yourself for anything the spread can't express -->
+<RBAC require="write:pipeline_meta" mode="disable">
+  {#snippet children({ allowed })}
+    <TagChip editable={allowed} />
+  {/snippet}
+</RBAC>
+```
+
+`disabledProps` carries the disabled attribute, `aria-disabled`, a native `title`
+tooltip and the read-only Tailwind classes, so the look and the reason stay
+identical everywhere without each call site restating them. Swap `title` for a
+common-ui `Popover` if a richer hint is wanted; keep it inside `RBAC` so it stays
+consistent.
+
+### 5.3 `usePermission`: for non-markup gates
+
+Some gates feed a boolean into existing plumbing rather than wrapping markup, e.g.
+Monaco's `editDisabled`. A one-permission composition serves those without a
+generic capability flag.
+
+`src/lib/compositions/usePermission.svelte.ts`
+
+```ts
+import { page } from '$app/state'
+import { hasPermissions, type Permission } from '$lib/services/rbac'
+
+export const usePermission = (permission: Permission) => {
+  const allowed = $derived(hasPermissions(page.data.feldera, permission))
+  return {
+    get allowed() {
+      return allowed
+    }
+  }
+}
+```
+
+The code editor already OR-chains its disable reasons at
+`layout/pipelines/PipelineCodePanel.svelte:56` and passes `editDisabled` into
+`pipelines/editor/CodeEditor.svelte`; add the permission as one more term:
+
+```ts
+const codeEdit = usePermission('write:pipeline_code')
+let editCodeDisabled = $derived(
+  !codeEdit.allowed || !pipeline.current || deleted || /* status, upgrade */ ...
+)
+```
+
+Monaco already shows a `readOnlyMessage` (see `CodeEditor.svelte:383`); route the
+read-only reason through it.
+
+### 5.4 Where common-ui fits
+
+`page.data.feldera` is web-console-only, so `rbac.ts`, `RBAC.svelte` and
+`usePermission` live in web-console. common-ui supplies presentation only:
+`Tooltip`/`Popover` for a richer read-only hint, and `MonacoEditor`'s `readOnly`
+option, already threaded through `CodeEditor.svelte`. Lift only presentation into
+common-ui if reused; never the role logic.
+
+### 5.5 Conventions
+
+- Name the permission at the gate; never branch on the role or a `canX` flag.
+- Gate the affordance, not just the request, so a `read` user never hits a 403.
+- Compose, do not replace, existing disable predicates (premium, unsaved, status).
+- Server stays authoritative; UI gating is UX.
+
+### 5.6 Testing
+
+Per `web-console-test-file-conventions`, `.spec.ts` unit tests mount each gated
+component under a mocked `page.data.feldera.role` and assert hidden / `disabled` /
+read-only across `read`, `write`, and `admin`/`owner` where relevant. Unit-test
+`hasPermission` directly against the map. Confirm a gate's test catches regressions
+by removing the gate and watching it fail.
diff --git a/scripts/rbac_up.sh b/scripts/rbac_up.sh
index 31b2e63ea75..0f9952b6b2a 100755
--- a/scripts/rbac_up.sh
+++ b/scripts/rbac_up.sh
@@ -7,9 +7,11 @@
 # Everything lives under an isolated demo directory, so it never touches your
 # real ~/.feldera data. Stop with Ctrl-C.
 #
-# Usage:  scripts/rbac_up.sh [--rebuild] [--keep-db]
-#   --rebuild   cargo build the manager first (otherwise uses target/debug)
-#   --keep-db   keep the demo database between runs (default: wipe for a clean slate)
+# Usage:  scripts/rbac_up.sh [--rebuild] [--enterprise] [--keep-db] [--dev]
+#   --rebuild     cargo build the manager first (otherwise uses target/debug)
+#   --enterprise  build with the feldera-enterprise feature (only meaningful with --rebuild)
+#   --keep-db     keep the demo database between runs (default: wipe for a clean slate)
+#   --dev         start the manager with --dev-mode (permissive CORS, cross-origin access)
 set -euo pipefail
 cd "$(dirname "$0")/.."
 
@@ -17,17 +19,27 @@ DEMO="${FELDERA_RBAC_DEMO_DIR:-/tmp/feldera-rbac-demo}"
 BIN="target/debug/pipeline-manager"
 KEEP_DB=0
 REBUILD=0
+ENTERPRISE=0
+DEV=0
 for a in "$@"; do
   case "$a" in
     --keep-db) KEEP_DB=1 ;;
     --rebuild) REBUILD=1 ;;
+    --enterprise) ENTERPRISE=1 ;;
+    --dev) DEV=1 ;;
     *) echo "unknown arg: $a"; exit 1 ;;
   esac
 done
 
+# Extra manager args toggled by flags above.
+MGR_ARGS=()
+[ "$DEV" = 1 ] && MGR_ARGS+=(--dev-mode)
+
 if [ "$REBUILD" = 1 ] || [ ! -x "$BIN" ]; then
   echo "== building pipeline-manager (debug, with web console) =="
-  PATH="$HOME/.bun/bin:$PATH" cargo build -p pipeline-manager --features feldera-enterprise
+  FEATURES=()
+  [ "$ENTERPRISE" = 1 ] && FEATURES=(--features feldera-enterprise)
+  PATH="$HOME/.bun/bin:$PATH" cargo build -p pipeline-manager "${FEATURES[@]}"
 fi
 
 [ "$KEEP_DB" = 1 ] || rm -rf "$DEMO/pg"
@@ -61,6 +73,7 @@ FELDERA_UNSTABLE_FEATURES='runtime_version,testing' \
     --pg-embed-working-directory="$DEMO/pg" \
     --runner-working-directory="$DEMO/runner" \
     --compiler-working-directory="$DEMO/compiler" \
+    "${MGR_ARGS[@]}" \
     >"$DEMO/manager.log" 2>&1 &
 MGR_PID=$!
 

From 7dc8c06179d6cf7139f06170695ed5f7221e91e5 Mon Sep 17 00:00:00 2001
From: Karakatiza666 <bulakh.96@gmail.com>
Date: Wed, 29 Jul 2026 19:35:50 +0000
Subject: [PATCH 36/55] [web-console] Update UI of Admin dashboard and OIDC
 trust popup

Signed-off-by: Karakatiza666 <bulakh.96@gmail.com>
---
 .../assets/fonts/feldera-material-icons.css   | 147 ++--
 .../assets/fonts/feldera-material-icons.svg   | 660 +++++++++---------
 .../assets/fonts/feldera-material-icons.ttf   | Bin 20832 -> 21704 bytes
 .../assets/fonts/feldera-material-icons.woff  | Bin 10116 -> 10524 bytes
 .../assets/fonts/feldera-material-icons.woff2 | Bin 8196 -> 8548 bytes
 .../src/assets/fonts/generic-icons.css        |  10 +-
 .../src/assets/fonts/generic-icons.svg        |  30 +-
 .../src/assets/fonts/generic-icons.ttf        | Bin 3728 -> 3728 bytes
 .../src/assets/fonts/generic-icons.woff       | Bin 2140 -> 2152 bytes
 .../src/assets/fonts/generic-icons.woff2      | Bin 1676 -> 1696 bytes
 .../icons/feldera-material-icons/shield.svg   |   1 +
 .../src/lib/components/admin/AdminPage.svelte |  99 ++-
 .../components/admin/AdminPage.svelte.spec.ts | 119 ++++
 .../lib/components/admin/TenantList.svelte    | 173 ++---
 .../admin/TenantList.svelte.spec.ts           | 125 ++++
 .../lib/components/admin/UserRoleTable.svelte |  30 +-
 .../lib/components/auth/ProfileButton.svelte  |   2 +-
 .../components/dialogs/GenericDialog.svelte   |   7 +-
 .../components/input/DoubleClickInput.svelte  |   6 +-
 .../pipelines/PipelineEditLayout.svelte       |   1 +
 .../oidcTrust/NewOidcTrustForm.svelte         |  67 +-
 .../lib/components/other/ApiKeyMenu.svelte    |   2 +-
 .../lib/components/other/OidcTrustMenu.svelte | 154 ++--
 .../other/OidcTrustMenu.svelte.spec.ts        | 101 +++
 js-packages/web-console/vite.config.ts        |   3 +
 .../web-console/web-console-permissions.md    |  12 +-
 26 files changed, 1096 insertions(+), 653 deletions(-)
 create mode 100755 js-packages/web-console/src/assets/icons/feldera-material-icons/shield.svg
 create mode 100644 js-packages/web-console/src/lib/components/admin/AdminPage.svelte.spec.ts
 create mode 100644 js-packages/web-console/src/lib/components/admin/TenantList.svelte.spec.ts
 create mode 100644 js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte.spec.ts

diff --git a/js-packages/web-console/src/assets/fonts/feldera-material-icons.css b/js-packages/web-console/src/assets/fonts/feldera-material-icons.css
index 22b32d51e98..0c79e323ee6 100644
--- a/js-packages/web-console/src/assets/fonts/feldera-material-icons.css
+++ b/js-packages/web-console/src/assets/fonts/feldera-material-icons.css
@@ -2,8 +2,8 @@
   font-family: "feldera-material-icons";
   font-display: block;
   src:
-    url("feldera-material-icons.woff2?06f8372fd6db29f5f189dc16b2f9c8af") format("woff2"),
-    url("feldera-material-icons.woff?06f8372fd6db29f5f189dc16b2f9c8af") format("woff");
+    url("feldera-material-icons.woff2?028c8f1549adb69a6c451cd7da1efef6") format("woff2"),
+    url("feldera-material-icons.woff?028c8f1549adb69a6c451cd7da1efef6") format("woff");
 }
 
 .fd {
@@ -17,204 +17,213 @@
   vertical-align: top;
 }
 
-.fd-chevron-down:before {
+.fd-construction:before {
   content: "\f101";
 }
-.fd-square:before {
+.fd-lightbulb:before {
   content: "\f102";
 }
-.fd-wine:before {
+.fd-server-off:before {
   content: "\f103";
 }
-.fd-trash-2:before {
+.fd-circle-check-big:before {
   content: "\f104";
 }
-.fd-book-open:before {
+.fd-panel-right:before {
   content: "\f105";
 }
-.fd-moon:before {
+.fd-wine:before {
   content: "\f106";
 }
-.fd-circle-x:before {
+.fd-book-open:before {
   content: "\f107";
 }
-.fd-mic-off:before {
+.fd-info:before {
   content: "\f108";
 }
-.fd-plus:before {
+.fd-more_horiz:before {
   content: "\f109";
 }
-.fd-circle-play:before {
+.fd-panel-left:before {
   content: "\f10a";
 }
-.fd-chevron-left:before {
+.fd-heart-crack:before {
   content: "\f10b";
 }
-.fd-triangle-alert:before {
+.fd-menu:before {
   content: "\f10c";
 }
-.fd-paintbrush:before {
+.fd-circle-slash:before {
   content: "\f10d";
 }
-.fd-circle-stop:before {
+.fd-layout-panel-left:before {
   content: "\f10e";
 }
-.fd-chevron-right:before {
+.fd-server-cog:before {
   content: "\f10f";
 }
-.fd-mic:before {
+.fd-server:before {
   content: "\f110";
 }
-.fd-square-power:before {
+.fd-arrow-right:before {
   content: "\f111";
 }
-.fd-circle-check-big:before {
+.fd-message-circle-question:before {
   content: "\f112";
 }
-.fd-circle-dot:before {
+.fd-x:before {
   content: "\f113";
 }
-.fd-panel-right:before {
+.fd-circle-pause:before {
   content: "\f114";
 }
-.fd-user:before {
+.fd-file-text:before {
   content: "\f115";
 }
-.fd-circle-stop-locked:before {
+.fd-chevron-left:before {
   content: "\f116";
 }
-.fd-sliders-horizontal:before {
+.fd-copy-plus:before {
   content: "\f117";
 }
-.fd-panel-left:before {
+.fd-pause:before {
   content: "\f118";
 }
-.fd-pencil-line:before {
+.fd-book-marked:before {
   content: "\f119";
 }
-.fd-info:before {
+.fd-moon:before {
   content: "\f11a";
 }
-.fd-database-off:before {
+.fd-network:before {
   content: "\f11b";
 }
-.fd-sun:before {
+.fd-plus:before {
   content: "\f11c";
 }
-.fd-file-text:before {
+.fd-triangle-alert:before {
   content: "\f11d";
 }
-.fd-panel-bottom:before {
+.fd-settings:before {
   content: "\f11e";
 }
-.fd-x:before {
+.fd-chevron-down:before {
   content: "\f11f";
 }
-.fd-layout-panel-top:before {
+.fd-circle-dot:before {
   content: "\f120";
 }
-.fd-settings:before {
+.fd-trash-2:before {
   content: "\f121";
 }
-.fd-play:before {
+.fd-mic:before {
   content: "\f122";
 }
-.fd-rocket:before {
+.fd-circle-stop-locked:before {
   content: "\f123";
 }
-.fd-server:before {
+.fd-shield:before {
   content: "\f124";
 }
-.fd-circle-plus:before {
+.fd-user:before {
   content: "\f125";
 }
-.fd-more_horiz:before {
+.fd-mic-off:before {
   content: "\f126";
 }
-.fd-key:before {
+.fd-rocket:before {
   content: "\f127";
 }
-.fd-copy:before {
+.fd-paintbrush:before {
   content: "\f128";
 }
-.fd-arrow-down:before {
+.fd-circle-plus:before {
   content: "\f129";
 }
-.fd-circle-pause:before {
+.fd-circle-divide:before {
   content: "\f12a";
 }
-.fd-menu:before {
+.fd-copy:before {
   content: "\f12b";
 }
-.fd-lightbulb:before {
+.fd-circle-help:before {
   content: "\f12c";
 }
-.fd-server-cog:before {
+.fd-circle-play:before {
   content: "\f12d";
 }
-.fd-save:before {
+.fd-receipt-text:before {
   content: "\f12e";
 }
-.fd-database:before {
+.fd-eraser:before {
   content: "\f12f";
 }
-.fd-lock-open:before {
+.fd-dot:before {
   content: "\f130";
 }
-.fd-log-out:before {
+.fd-square-power:before {
   content: "\f131";
 }
-.fd-layout-panel-left:before {
+.fd-panel-bottom:before {
   content: "\f132";
 }
-.fd-server-off:before {
+.fd-chevron-right:before {
   content: "\f133";
 }
-.fd-circle-slash:before {
+.fd-arrow-down:before {
   content: "\f134";
 }
-.fd-arrow-right:before {
+.fd-circle-user:before {
   content: "\f135";
 }
-.fd-construction:before {
+.fd-check:before {
   content: "\f136";
 }
-.fd-file-down:before {
+.fd-database-off:before {
   content: "\f137";
 }
-.fd-circle-divide:before {
+.fd-log-out:before {
   content: "\f138";
 }
-.fd-network:before {
+.fd-key:before {
   content: "\f139";
 }
-.fd-pause:before {
+.fd-circle-stop:before {
   content: "\f13a";
 }
-.fd-copy-plus:before {
+.fd-file-down:before {
   content: "\f13b";
 }
-.fd-book-marked:before {
+.fd-layout-panel-top:before {
   content: "\f13c";
 }
-.fd-dot:before {
+.fd-save:before {
   content: "\f13d";
 }
-.fd-circle-user:before {
+.fd-database:before {
   content: "\f13e";
 }
-.fd-circle-alert:before {
+.fd-sliders-horizontal:before {
   content: "\f13f";
 }
-.fd-message-circle-question:before {
+.fd-circle-alert:before {
   content: "\f140";
 }
-.fd-receipt-text:before {
+.fd-pencil-line:before {
   content: "\f141";
 }
-.fd-eraser:before {
+.fd-play:before {
   content: "\f142";
 }
-.fd-check:before {
+.fd-lock-open:before {
   content: "\f143";
 }
+.fd-square:before {
+  content: "\f144";
+}
+.fd-circle-x:before {
+  content: "\f145";
+}
+.fd-sun:before {
+  content: "\f146";
+}
diff --git a/js-packages/web-console/src/assets/fonts/feldera-material-icons.svg b/js-packages/web-console/src/assets/fonts/feldera-material-icons.svg
index 88d9035756f..eafb42fc9f1 100644
--- a/js-packages/web-console/src/assets/fonts/feldera-material-icons.svg
+++ b/js-packages/web-console/src/assets/fonts/feldera-material-icons.svg
@@ -7,408 +7,426 @@
       units-per-em="128" ascent="128"
       descent="0" />
     <missing-glyph horiz-adv-x="0" />
-    <glyph glyph-name="chevron-down"
+    <glyph glyph-name="construction"
       unicode="&#xF101;"
-      horiz-adv-x="128" d="M29.9573333333333 84.816C28.944 84.3786666666667 27.7066666666667 83.1893333333333 27.28 82.24C26.8106666666667 81.2106666666667 26.752 79.008 27.1733333333333 78.0053333333333C27.8933333333333 76.2826666666667 60.2773333333333 43.8933333333333 62 43.1786666666667C62.9066666666667 42.7946666666667 65.0933333333333 42.7946666666667 66 43.1786666666667C67.7653333333333 43.9146666666667 100.112 76.288 100.848 78.0586666666667C101.3173333333333 79.184 101.248 81.008 100.688 82.2026666666667C99.8026666666667 84.0906666666667 98.08 85.12 95.808 85.12C93.5733333333333 85.12 94.2933333333333 85.76 76 67.5306666666667L64 55.5733333333333L52.32 67.216C36.6453333333333 82.832 34.7786666666667 84.6133333333334 33.7706666666667 84.8906666666667C32.6613333333333 85.2 30.752 85.1626666666667 29.9573333333333 84.816" />
-    <glyph glyph-name="chevron-down-1"
-      unicode="&#x63;&#x68;&#x65;&#x76;&#x72;&#x6F;&#x6E;&#x2D;&#x64;&#x6F;&#x77;&#x6E;"
-      horiz-adv-x="128" d="M29.9573333333333 84.816C28.944 84.3786666666667 27.7066666666667 83.1893333333333 27.28 82.24C26.8106666666667 81.2106666666667 26.752 79.008 27.1733333333333 78.0053333333333C27.8933333333333 76.2826666666667 60.2773333333333 43.8933333333333 62 43.1786666666667C62.9066666666667 42.7946666666667 65.0933333333333 42.7946666666667 66 43.1786666666667C67.7653333333333 43.9146666666667 100.112 76.288 100.848 78.0586666666667C101.3173333333333 79.184 101.248 81.008 100.688 82.2026666666667C99.8026666666667 84.0906666666667 98.08 85.12 95.808 85.12C93.5733333333333 85.12 94.2933333333333 85.76 76 67.5306666666667L64 55.5733333333333L52.32 67.216C36.6453333333333 82.832 34.7786666666667 84.6133333333334 33.7706666666667 84.8906666666667C32.6613333333333 85.2 30.752 85.1626666666667 29.9573333333333 84.816" />
-    <glyph glyph-name="square"
+      horiz-adv-x="128" d="M36.2666666666667 117.136C34.704 116.816 33.392 115.792 32.5653333333333 114.2453333333333C32.1333333333333 113.4346666666667 32.1066666666667 113.04 32.0373333333333 107.36L31.9626666666667 101.3333333333333L23.9306666666667 101.328C19.5093333333333 101.328 15.2213333333333 101.2266666666667 14.4 101.1093333333333C9.888 100.464 6.2026666666667 96.7786666666667 5.5573333333333 92.2666666666667C5.2693333333333 90.272 5.2693333333333 59.0613333333333 5.5573333333333 57.0666666666667C6.2026666666667 52.5546666666667 9.888 48.8693333333333 14.4 48.224C15.2213333333333 48.1066666666667 19.5146666666667 48.0053333333333 23.9413333333333 48.0053333333333L31.984 48L32.048 31.3066666666667C32.1066666666667 14.6933333333333 32.1066666666667 14.608 32.5653333333333 13.7546666666667C33.6106666666667 11.8026666666667 35.2106666666667 10.816 37.3333333333333 10.816C39.456 10.816 41.056 11.8026666666667 42.1013333333333 13.7546666666667C42.56 14.608 42.56 14.6933333333333 42.6186666666667 31.3066666666667L42.6826666666667 48L64 48L85.3173333333333 48L85.3813333333333 31.3066666666667C85.44 14.6933333333333 85.44 14.608 85.8986666666667 13.7546666666667C86.944 11.8026666666667 88.544 10.816 90.6666666666667 10.816C92.7893333333333 10.816 94.3893333333333 11.8026666666667 95.4346666666667 13.7546666666667C95.8933333333333 14.608 95.8933333333333 14.6933333333333 95.952 31.3066666666667L96.016 48L104.0586666666667 48.0053333333333C108.4853333333333 48.0053333333333 112.7786666666667 48.1066666666667 113.6 48.224C118.112 48.8693333333333 121.7973333333333 52.5546666666667 122.4426666666667 57.0666666666667C122.7306666666667 59.0613333333333 122.7306666666667 90.272 122.4426666666667 92.2666666666667C121.7973333333333 96.7786666666667 118.112 100.464 113.6 101.1093333333333C112.7786666666667 101.2266666666667 108.4906666666667 101.328 104.0693333333333 101.328L96.0373333333333 101.3333333333333L95.9626666666667 107.36C95.8933333333333 113.04 95.8666666666667 113.4346666666667 95.4346666666667 114.2453333333333C94.3893333333333 116.1973333333333 92.7893333333333 117.184 90.6666666666667 117.184C88.544 117.184 86.944 116.1973333333333 85.8986666666667 114.2453333333333C85.4666666666667 113.4346666666667 85.44 113.04 85.3706666666667 107.36L85.296 101.3333333333333L64 101.3333333333333L42.704 101.3333333333333L42.6293333333333 107.36C42.56 113.04 42.5333333333333 113.4346666666667 42.1013333333333 114.2453333333333C40.9226666666667 116.4533333333333 38.5813333333333 117.6106666666667 36.2666666666667 117.136M56.4266666666667 74.6666666666667L72.4266666666667 58.6666666666667L64 58.6666666666667L55.5733333333333 58.6666666666667L39.5733333333333 74.6666666666667L23.5733333333333 90.6666666666667L32 90.6666666666667L40.4266666666667 90.6666666666667L56.4266666666667 74.6666666666667M88.4266666666667 74.6666666666667L104.4266666666667 58.6666666666667L96 58.6666666666667L87.5733333333333 58.6666666666667L71.5733333333333 74.6666666666667L55.5733333333333 90.6666666666667L64 90.6666666666667L72.4266666666667 90.6666666666667L88.4266666666667 74.6666666666667M112 78.5066666666667C112 71.8186666666667 111.9733333333333 66.3466666666667 111.9466666666667 66.3466666666667C111.9146666666667 66.3466666666667 106.4213333333333 71.8186666666667 99.7333333333333 78.5066666666667L87.5733333333333 90.6666666666667L99.7866666666667 90.6666666666667L112 90.6666666666667L112 78.5066666666667M28.2666666666667 70.8266666666667L40.4266666666667 58.6666666666667L28.2133333333333 58.6666666666667L16 58.6666666666667L16 70.8266666666667C16 77.5146666666667 16.0266666666667 82.9866666666667 16.0533333333333 82.9866666666667C16.0853333333333 82.9866666666667 21.5786666666667 77.5146666666667 28.2666666666667 70.8266666666667" />
+    <glyph glyph-name="construction-1"
+      unicode="&#x63;&#x6F;&#x6E;&#x73;&#x74;&#x72;&#x75;&#x63;&#x74;&#x69;&#x6F;&#x6E;"
+      horiz-adv-x="128" d="M36.2666666666667 117.136C34.704 116.816 33.392 115.792 32.5653333333333 114.2453333333333C32.1333333333333 113.4346666666667 32.1066666666667 113.04 32.0373333333333 107.36L31.9626666666667 101.3333333333333L23.9306666666667 101.328C19.5093333333333 101.328 15.2213333333333 101.2266666666667 14.4 101.1093333333333C9.888 100.464 6.2026666666667 96.7786666666667 5.5573333333333 92.2666666666667C5.2693333333333 90.272 5.2693333333333 59.0613333333333 5.5573333333333 57.0666666666667C6.2026666666667 52.5546666666667 9.888 48.8693333333333 14.4 48.224C15.2213333333333 48.1066666666667 19.5146666666667 48.0053333333333 23.9413333333333 48.0053333333333L31.984 48L32.048 31.3066666666667C32.1066666666667 14.6933333333333 32.1066666666667 14.608 32.5653333333333 13.7546666666667C33.6106666666667 11.8026666666667 35.2106666666667 10.816 37.3333333333333 10.816C39.456 10.816 41.056 11.8026666666667 42.1013333333333 13.7546666666667C42.56 14.608 42.56 14.6933333333333 42.6186666666667 31.3066666666667L42.6826666666667 48L64 48L85.3173333333333 48L85.3813333333333 31.3066666666667C85.44 14.6933333333333 85.44 14.608 85.8986666666667 13.7546666666667C86.944 11.8026666666667 88.544 10.816 90.6666666666667 10.816C92.7893333333333 10.816 94.3893333333333 11.8026666666667 95.4346666666667 13.7546666666667C95.8933333333333 14.608 95.8933333333333 14.6933333333333 95.952 31.3066666666667L96.016 48L104.0586666666667 48.0053333333333C108.4853333333333 48.0053333333333 112.7786666666667 48.1066666666667 113.6 48.224C118.112 48.8693333333333 121.7973333333333 52.5546666666667 122.4426666666667 57.0666666666667C122.7306666666667 59.0613333333333 122.7306666666667 90.272 122.4426666666667 92.2666666666667C121.7973333333333 96.7786666666667 118.112 100.464 113.6 101.1093333333333C112.7786666666667 101.2266666666667 108.4906666666667 101.328 104.0693333333333 101.328L96.0373333333333 101.3333333333333L95.9626666666667 107.36C95.8933333333333 113.04 95.8666666666667 113.4346666666667 95.4346666666667 114.2453333333333C94.3893333333333 116.1973333333333 92.7893333333333 117.184 90.6666666666667 117.184C88.544 117.184 86.944 116.1973333333333 85.8986666666667 114.2453333333333C85.4666666666667 113.4346666666667 85.44 113.04 85.3706666666667 107.36L85.296 101.3333333333333L64 101.3333333333333L42.704 101.3333333333333L42.6293333333333 107.36C42.56 113.04 42.5333333333333 113.4346666666667 42.1013333333333 114.2453333333333C40.9226666666667 116.4533333333333 38.5813333333333 117.6106666666667 36.2666666666667 117.136M56.4266666666667 74.6666666666667L72.4266666666667 58.6666666666667L64 58.6666666666667L55.5733333333333 58.6666666666667L39.5733333333333 74.6666666666667L23.5733333333333 90.6666666666667L32 90.6666666666667L40.4266666666667 90.6666666666667L56.4266666666667 74.6666666666667M88.4266666666667 74.6666666666667L104.4266666666667 58.6666666666667L96 58.6666666666667L87.5733333333333 58.6666666666667L71.5733333333333 74.6666666666667L55.5733333333333 90.6666666666667L64 90.6666666666667L72.4266666666667 90.6666666666667L88.4266666666667 74.6666666666667M112 78.5066666666667C112 71.8186666666667 111.9733333333333 66.3466666666667 111.9466666666667 66.3466666666667C111.9146666666667 66.3466666666667 106.4213333333333 71.8186666666667 99.7333333333333 78.5066666666667L87.5733333333333 90.6666666666667L99.7866666666667 90.6666666666667L112 90.6666666666667L112 78.5066666666667M28.2666666666667 70.8266666666667L40.4266666666667 58.6666666666667L28.2133333333333 58.6666666666667L16 58.6666666666667L16 70.8266666666667C16 77.5146666666667 16.0266666666667 82.9866666666667 16.0533333333333 82.9866666666667C16.0853333333333 82.9866666666667 21.5786666666667 77.5146666666667 28.2666666666667 70.8266666666667" />
+    <glyph glyph-name="lightbulb"
       unicode="&#xF102;"
-      horiz-adv-x="128" d="M22.848 116.7893333333333C19.0346666666667 115.9626666666667 14.5706666666667 112.4853333333333 12.6133333333333 108.8213333333333C12.2613333333333 108.1546666666667 11.6746666666667 106.704 11.3173333333333 105.6L10.6666666666667 103.5893333333333L10.6666666666667 64L10.6666666666667 24.4106666666667L11.3173333333333 22.4C12.448 18.9066666666667 13.9253333333333 16.6933333333333 16.6666666666667 14.3626666666667C18.3146666666667 12.9653333333333 19.872 12.1386666666667 22.4 11.3173333333333L24.4106666666667 10.6666666666667L64 10.6666666666667L103.5893333333333 10.6666666666667L105.6 11.3173333333333C108.128 12.1386666666667 109.6213333333333 12.9333333333333 111.28 14.352C114.096 16.7573333333333 115.5573333333333 18.928 116.6826666666667 22.4L117.3333333333333 24.4106666666667L117.3333333333333 64L117.3333333333333 103.5893333333333L116.6826666666667 105.6C115.5413333333334 109.12 114.1493333333333 111.1946666666667 111.28 113.648C109.7706666666667 114.9386666666667 108.2666666666667 115.776 106.0693333333333 116.5653333333333L104.5066666666667 117.12L64.3626666666667 117.104C30.9653333333333 117.088 23.984 117.0346666666667 22.848 116.7893333333333M103.36 106.2666666666667C104.6186666666667 105.696 105.504 104.864 106.064 103.728L106.56 102.72L106.6186666666667 66.7733333333333C106.656 47.0026666666667 106.6026666666667 29.4133333333333 106.5013333333333 27.68C106.3306666666667 24.672 106.2933333333333 24.496 105.6853333333333 23.6266666666667C105.3386666666667 23.1306666666667 104.528 22.4053333333333 103.8933333333333 22.0266666666667L102.7413333333333 21.3333333333333L65.0773333333333 21.3386666666667C44.3573333333333 21.344 26.752 21.4346666666667 25.9413333333333 21.536C24.1386666666667 21.7706666666667 23.0133333333333 22.4853333333333 22.0853333333333 23.9893333333334L21.44 25.0346666666667L21.44 63.8773333333333L21.44 102.72L21.936 103.728C22.496 104.864 23.3813333333333 105.696 24.64 106.2666666666667C25.456 106.64 27.1893333333333 106.656 64 106.656C100.8106666666667 106.656 102.544 106.64 103.36 106.2666666666667" />
-    <glyph glyph-name="square-1"
-      unicode="&#x73;&#x71;&#x75;&#x61;&#x72;&#x65;"
-      horiz-adv-x="128" d="M22.848 116.7893333333333C19.0346666666667 115.9626666666667 14.5706666666667 112.4853333333333 12.6133333333333 108.8213333333333C12.2613333333333 108.1546666666667 11.6746666666667 106.704 11.3173333333333 105.6L10.6666666666667 103.5893333333333L10.6666666666667 64L10.6666666666667 24.4106666666667L11.3173333333333 22.4C12.448 18.9066666666667 13.9253333333333 16.6933333333333 16.6666666666667 14.3626666666667C18.3146666666667 12.9653333333333 19.872 12.1386666666667 22.4 11.3173333333333L24.4106666666667 10.6666666666667L64 10.6666666666667L103.5893333333333 10.6666666666667L105.6 11.3173333333333C108.128 12.1386666666667 109.6213333333333 12.9333333333333 111.28 14.352C114.096 16.7573333333333 115.5573333333333 18.928 116.6826666666667 22.4L117.3333333333333 24.4106666666667L117.3333333333333 64L117.3333333333333 103.5893333333333L116.6826666666667 105.6C115.5413333333334 109.12 114.1493333333333 111.1946666666667 111.28 113.648C109.7706666666667 114.9386666666667 108.2666666666667 115.776 106.0693333333333 116.5653333333333L104.5066666666667 117.12L64.3626666666667 117.104C30.9653333333333 117.088 23.984 117.0346666666667 22.848 116.7893333333333M103.36 106.2666666666667C104.6186666666667 105.696 105.504 104.864 106.064 103.728L106.56 102.72L106.6186666666667 66.7733333333333C106.656 47.0026666666667 106.6026666666667 29.4133333333333 106.5013333333333 27.68C106.3306666666667 24.672 106.2933333333333 24.496 105.6853333333333 23.6266666666667C105.3386666666667 23.1306666666667 104.528 22.4053333333333 103.8933333333333 22.0266666666667L102.7413333333333 21.3333333333333L65.0773333333333 21.3386666666667C44.3573333333333 21.344 26.752 21.4346666666667 25.9413333333333 21.536C24.1386666666667 21.7706666666667 23.0133333333333 22.4853333333333 22.0853333333333 23.9893333333334L21.44 25.0346666666667L21.44 63.8773333333333L21.44 102.72L21.936 103.728C22.496 104.864 23.3813333333333 105.696 24.64 106.2666666666667C25.456 106.64 27.1893333333333 106.656 64 106.656C100.8106666666667 106.656 102.544 106.64 103.36 106.2666666666667" />
-    <glyph glyph-name="wine"
+      horiz-adv-x="128" d="M58.5493333333333 122.1226666666667C52.992 121.312 47.936 119.3333333333333 42.9653333333333 116.0266666666667C39.76 113.8933333333333 35.44 109.5733333333333 33.3066666666667 106.368C28.8426666666667 99.664 26.88 93.248 26.88 85.4133333333333C26.8853333333333 79.8826666666667 27.8133333333333 75.712 29.9893333333333 71.4666666666667C31.36 68.8 33.0346666666667 66.5066666666667 36.1493333333333 63.04C40.272 58.4533333333334 41.2053333333333 57.0026666666667 42.656 52.912C43.9306666666667 49.3386666666667 45.184 48.2293333333333 47.952 48.2186666666667C49.52 48.2133333333333 50.3893333333333 48.528 51.5146666666667 49.52C53.3386666666667 51.12 53.6053333333333 53.424 52.384 57.0773333333333C50.848 61.6693333333333 48.912 64.7146666666667 44.2506666666667 69.8666666666667C40.5386666666667 73.9733333333333 38.8 76.7573333333333 37.9306666666667 79.9733333333333C37.344 82.1493333333334 37.296 87.7173333333333 37.84 90.512C39.6053333333333 99.6053333333333 46.3733333333333 107.4186666666667 55.1466666666667 110.5066666666667C58.1546666666667 111.5626666666667 59.7333333333333 111.7866666666667 64.2026666666667 111.7866666666667C67.7226666666667 111.7866666666667 68.4533333333333 111.7226666666667 70.2133333333333 111.28C74.24 110.256 77.376 108.6933333333333 80.6346666666667 106.0853333333333C86.3573333333333 101.5093333333333 89.7386666666667 95.2533333333333 90.4693333333333 87.8933333333334C91.024 82.2986666666667 89.7653333333333 77.2906666666667 86.8533333333333 73.4933333333333C86.3146666666667 72.7893333333333 84.8746666666667 71.1093333333333 83.6533333333333 69.76C79.3226666666667 64.976 78.048 63.1733333333334 76.5653333333333 59.7333333333333C74.3626666666667 54.6293333333333 74.3413333333333 51.4026666666667 76.4853333333333 49.52C77.5786666666667 48.5546666666667 78.576 48.1706666666667 79.9946666666667 48.1546666666667C82.592 48.1333333333333 84.256 49.552 85.216 52.5973333333333C86.5333333333333 56.7733333333333 87.5253333333333 58.368 91.4026666666667 62.5066666666667C96.0053333333333 67.4186666666667 98.0213333333333 70.5973333333333 99.6213333333333 75.472C100.8693333333333 79.28 101.1946666666667 81.8506666666667 101.056 86.72C100.8906666666667 92.4746666666667 100.0053333333333 96.2133333333333 97.5893333333333 101.2853333333333C95.5413333333333 105.5946666666667 93.104 108.9493333333333 89.5626666666667 112.32C84.9653333333333 116.704 79.1253333333333 119.8933333333333 72.7626666666667 121.4986666666667C69.0933333333333 122.4266666666667 62.5653333333333 122.7146666666667 58.5493333333333 122.1226666666667M50.9866666666667 37.1413333333333C45.5946666666667 36.9973333333333 45.4186666666667 36.9546666666667 44.0746666666667 35.3813333333333C43.1893333333333 34.3466666666667 42.8853333333333 33.4293333333333 42.88 31.8346666666667C42.88 29.872 43.904 28.24 45.76 27.232L46.6133333333333 26.7733333333333L64 26.7733333333333L81.3866666666667 26.7733333333333L82.24 27.232C83.344 27.8293333333333 84.3733333333333 28.912 84.7893333333333 29.9146666666667C85.2426666666667 30.9973333333333 85.2106666666667 33.1733333333333 84.72 34.24C84.288 35.2 83.0346666666667 36.3946666666667 82.0426666666667 36.8C81.28 37.1146666666667 59.0986666666667 37.3546666666667 50.9866666666667 37.1413333333333M54.6133333333333 15.8133333333333C51.1146666666667 15.664 50.656 15.504 49.408 14.048C48.5226666666667 13.0133333333334 48.2186666666667 12.096 48.2133333333333 10.5013333333333C48.2133333333333 8.5386666666667 49.2373333333333 6.9066666666667 51.0933333333333 5.8986666666667C51.9413333333333 5.4453333333333 52.048 5.44 64 5.44C75.952 5.44 76.0586666666667 5.4453333333333 76.9066666666667 5.8986666666667C78.0106666666667 6.496 79.04 7.5786666666667 79.456 8.5813333333333C79.9093333333333 9.664 79.8773333333333 11.84 79.3866666666667 12.9066666666667C78.9546666666667 13.8666666666667 77.7013333333333 15.0613333333334 76.7093333333333 15.472C75.9466666666667 15.7813333333333 59.776 16.032 54.6133333333333 15.8133333333333" />
+    <glyph glyph-name="lightbulb-1"
+      unicode="&#x6C;&#x69;&#x67;&#x68;&#x74;&#x62;&#x75;&#x6C;&#x62;"
+      horiz-adv-x="128" d="M58.5493333333333 122.1226666666667C52.992 121.312 47.936 119.3333333333333 42.9653333333333 116.0266666666667C39.76 113.8933333333333 35.44 109.5733333333333 33.3066666666667 106.368C28.8426666666667 99.664 26.88 93.248 26.88 85.4133333333333C26.8853333333333 79.8826666666667 27.8133333333333 75.712 29.9893333333333 71.4666666666667C31.36 68.8 33.0346666666667 66.5066666666667 36.1493333333333 63.04C40.272 58.4533333333334 41.2053333333333 57.0026666666667 42.656 52.912C43.9306666666667 49.3386666666667 45.184 48.2293333333333 47.952 48.2186666666667C49.52 48.2133333333333 50.3893333333333 48.528 51.5146666666667 49.52C53.3386666666667 51.12 53.6053333333333 53.424 52.384 57.0773333333333C50.848 61.6693333333333 48.912 64.7146666666667 44.2506666666667 69.8666666666667C40.5386666666667 73.9733333333333 38.8 76.7573333333333 37.9306666666667 79.9733333333333C37.344 82.1493333333334 37.296 87.7173333333333 37.84 90.512C39.6053333333333 99.6053333333333 46.3733333333333 107.4186666666667 55.1466666666667 110.5066666666667C58.1546666666667 111.5626666666667 59.7333333333333 111.7866666666667 64.2026666666667 111.7866666666667C67.7226666666667 111.7866666666667 68.4533333333333 111.7226666666667 70.2133333333333 111.28C74.24 110.256 77.376 108.6933333333333 80.6346666666667 106.0853333333333C86.3573333333333 101.5093333333333 89.7386666666667 95.2533333333333 90.4693333333333 87.8933333333334C91.024 82.2986666666667 89.7653333333333 77.2906666666667 86.8533333333333 73.4933333333333C86.3146666666667 72.7893333333333 84.8746666666667 71.1093333333333 83.6533333333333 69.76C79.3226666666667 64.976 78.048 63.1733333333334 76.5653333333333 59.7333333333333C74.3626666666667 54.6293333333333 74.3413333333333 51.4026666666667 76.4853333333333 49.52C77.5786666666667 48.5546666666667 78.576 48.1706666666667 79.9946666666667 48.1546666666667C82.592 48.1333333333333 84.256 49.552 85.216 52.5973333333333C86.5333333333333 56.7733333333333 87.5253333333333 58.368 91.4026666666667 62.5066666666667C96.0053333333333 67.4186666666667 98.0213333333333 70.5973333333333 99.6213333333333 75.472C100.8693333333333 79.28 101.1946666666667 81.8506666666667 101.056 86.72C100.8906666666667 92.4746666666667 100.0053333333333 96.2133333333333 97.5893333333333 101.2853333333333C95.5413333333333 105.5946666666667 93.104 108.9493333333333 89.5626666666667 112.32C84.9653333333333 116.704 79.1253333333333 119.8933333333333 72.7626666666667 121.4986666666667C69.0933333333333 122.4266666666667 62.5653333333333 122.7146666666667 58.5493333333333 122.1226666666667M50.9866666666667 37.1413333333333C45.5946666666667 36.9973333333333 45.4186666666667 36.9546666666667 44.0746666666667 35.3813333333333C43.1893333333333 34.3466666666667 42.8853333333333 33.4293333333333 42.88 31.8346666666667C42.88 29.872 43.904 28.24 45.76 27.232L46.6133333333333 26.7733333333333L64 26.7733333333333L81.3866666666667 26.7733333333333L82.24 27.232C83.344 27.8293333333333 84.3733333333333 28.912 84.7893333333333 29.9146666666667C85.2426666666667 30.9973333333333 85.2106666666667 33.1733333333333 84.72 34.24C84.288 35.2 83.0346666666667 36.3946666666667 82.0426666666667 36.8C81.28 37.1146666666667 59.0986666666667 37.3546666666667 50.9866666666667 37.1413333333333M54.6133333333333 15.8133333333333C51.1146666666667 15.664 50.656 15.504 49.408 14.048C48.5226666666667 13.0133333333334 48.2186666666667 12.096 48.2133333333333 10.5013333333333C48.2133333333333 8.5386666666667 49.2373333333333 6.9066666666667 51.0933333333333 5.8986666666667C51.9413333333333 5.4453333333333 52.048 5.44 64 5.44C75.952 5.44 76.0586666666667 5.4453333333333 76.9066666666667 5.8986666666667C78.0106666666667 6.496 79.04 7.5786666666667 79.456 8.5813333333333C79.9093333333333 9.664 79.8773333333333 11.84 79.3866666666667 12.9066666666667C78.9546666666667 13.8666666666667 77.7013333333333 15.0613333333334 76.7093333333333 15.472C75.9466666666667 15.7813333333333 59.776 16.032 54.6133333333333 15.8133333333333" />
+    <glyph glyph-name="server-off"
       unicode="&#xF103;"
+      horiz-adv-x="128" d="M9.6 122.4693333333334C7.3173333333333 122 5.5466666666667 119.9733333333333 5.5413333333333 117.8186666666667C5.5413333333333 117.2586666666667 5.5146666666667 114.496 5.488 111.68C5.4613333333333 108.864 5.44 101.232 5.44 94.72C5.44 83.0026666666667 5.4453333333333 82.864 5.9306666666667 81.184C6.7733333333333 78.2826666666667 7.9466666666667 76.304 10.1226666666667 74.1226666666667C12.2666666666667 71.984 14.2186666666667 70.8106666666667 17.072 69.9466666666667C18.656 69.4666666666667 18.768 69.4613333333333 34.896 69.3866666666667L51.1253333333333 69.3066666666667L56.432 63.9946666666667L61.7333333333333 58.688L40.2026666666667 58.6133333333334L18.6666666666667 58.544L17.072 58.0586666666667C14.208 57.184 12.2666666666667 56.016 10.1226666666667 53.8773333333333C7.9466666666667 51.696 6.7733333333333 49.7226666666667 5.9306666666667 46.816C5.44 45.1306666666667 5.44 45.056 5.44 32C5.44 18.944 5.44 18.8693333333333 5.9306666666667 17.184C6.7733333333333 14.2773333333333 7.9466666666667 12.304 10.1226666666667 10.1226666666667C12.304 7.9466666666667 14.2773333333333 6.7733333333333 17.184 5.9306666666667L18.88 5.44L64.7466666666667 5.44L110.6133333333333 5.44L112.16 6.1653333333333C113.568 6.8213333333333 113.744 6.8586666666667 114.08 6.5653333333333C114.9226666666667 5.824 115.952 5.4826666666667 117.328 5.4826666666667C119.4613333333333 5.4826666666667 121.0933333333333 6.496 122.08 8.4213333333333C122.6986666666667 9.632 122.6773333333333 11.728 122.0373333333333 13.0133333333334C121.3973333333333 14.304 14.3893333333333 121.3546666666667 13.12 121.9786666666667C12.1066666666667 122.4746666666667 10.6346666666667 122.6826666666667 9.6 122.4693333333334M36.2666666666667 122.4693333333334C33.7973333333333 121.9626666666667 32.1493333333333 119.9093333333333 32.1493333333333 117.3333333333333C32.1493333333333 115.2106666666667 33.136 113.6106666666667 35.088 112.5653333333333L35.9466666666667 112.1066666666667L72.1066666666667 112L108.2666666666667 111.8933333333333L109.12 111.4346666666667C110.2346666666667 110.832 111.0186666666667 109.984 111.5573333333333 108.8C111.9786666666667 107.872 111.9893333333333 107.456 111.9893333333333 96C111.9893333333333 84.544 111.9786666666667 84.128 111.5573333333333 83.2C111.0186666666667 82.016 110.2346666666667 81.168 109.12 80.5653333333333C108.2773333333333 80.112 108.1226666666667 80.1066666666667 93.44 80C78.7786666666667 79.8933333333334 78.6026666666667 79.888 77.7546666666667 79.4346666666667C75.8026666666667 78.3893333333333 74.816 76.7893333333333 74.816 74.6666666666667C74.816 72.544 75.8026666666667 70.944 77.7546666666667 69.8986666666667C78.608 69.44 78.6666666666667 69.44 93.8666666666667 69.44L109.12 69.44L110.816 69.9306666666667C113.7226666666667 70.7733333333333 115.696 71.9466666666667 117.8773333333333 74.1226666666667C120.0533333333334 76.304 121.2266666666667 78.2773333333333 122.0693333333333 81.184C122.56 82.8693333333334 122.56 82.944 122.56 96C122.56 109.056 122.56 109.1306666666667 122.0693333333333 110.816C121.2266666666667 113.7226666666667 120.0533333333334 115.696 117.8773333333333 117.8773333333334C115.7386666666667 120.0106666666667 113.8026666666667 121.1786666666667 110.928 122.064L109.3333333333333 122.5493333333333L73.1733333333333 122.5866666666667C53.2853333333333 122.608 36.6773333333333 122.5546666666667 36.2666666666667 122.4693333333334M30.3466666666667 80.048C21.5093333333333 79.9946666666667 20.2666666666667 80.032 19.4453333333333 80.3413333333333C18.16 80.8266666666667 17.0933333333333 81.8293333333333 16.5013333333333 83.0933333333333L16.0053333333333 84.16L16 94.2933333333333L16 104.4266666666667L28.16 92.2666666666667L40.32 80.1066666666667L30.3466666666667 80.048M100.2666666666667 58.48C96.2133333333333 57.5786666666667 94.7093333333333 52.5493333333333 97.6266666666667 49.6266666666667C98.96 48.2986666666667 99.5626666666667 48.144 104.1066666666667 48.0106666666667C108.6613333333333 47.872 109.2906666666667 47.712 110.5333333333333 46.368C111.7706666666667 45.0346666666667 111.872 44.592 112.0106666666667 40.1066666666667C112.1173333333333 36.4586666666667 112.192 35.84 112.5813333333333 35.088C113.584 33.152 115.2053333333333 32.1493333333333 117.3333333333333 32.1493333333333C119.456 32.1493333333333 121.056 33.136 122.1013333333333 35.088C122.5333333333333 35.8933333333333 122.56 36.2346666666667 122.5493333333333 40.5333333333333C122.5333333333333 45.808 122.272 47.1626666666667 120.6933333333333 50.2293333333333C119.4506666666667 52.6293333333333 116.6293333333333 55.4506666666667 114.2346666666667 56.688C111.3546666666667 58.176 109.9573333333333 58.464 105.1733333333333 58.5653333333333C102.8853333333333 58.608 100.6773333333333 58.576 100.2666666666667 58.48M88.4266666666667 32L104.4266666666667 16L62.2933333333333 16L20.16 16.0053333333333L19.0933333333333 16.5066666666667C17.8133333333333 17.1146666666667 17.0293333333333 17.9093333333333 16.4426666666667 19.2C16.0213333333333 20.128 16.0106666666667 20.544 16.0106666666667 32C16.0106666666667 43.456 16.0213333333333 43.872 16.4426666666667 44.8C17.0293333333333 46.0906666666667 17.8133333333333 46.8853333333333 19.0933333333333 47.4933333333333L20.16 47.9946666666667L46.2933333333333 48L72.4266666666667 48L88.4266666666667 32M30.9333333333333 37.136C26.9013333333333 36.3093333333333 25.3813333333333 31.2106666666667 28.2933333333333 28.2933333333333C29.7706666666667 26.8213333333333 32.4 26.3413333333333 34.24 27.216C35.9946666666667 28.048 37.3333333333333 30.1173333333333 37.3333333333333 32C37.3333333333333 33.8453333333333 35.9893333333333 35.968 34.336 36.7306666666667C33.4133333333333 37.1573333333333 31.9093333333333 37.3333333333333 30.9333333333333 37.136" />
+    <glyph glyph-name="server-off-1"
+      unicode="&#x73;&#x65;&#x72;&#x76;&#x65;&#x72;&#x2D;&#x6F;&#x66;&#x66;"
+      horiz-adv-x="128" d="M9.6 122.4693333333334C7.3173333333333 122 5.5466666666667 119.9733333333333 5.5413333333333 117.8186666666667C5.5413333333333 117.2586666666667 5.5146666666667 114.496 5.488 111.68C5.4613333333333 108.864 5.44 101.232 5.44 94.72C5.44 83.0026666666667 5.4453333333333 82.864 5.9306666666667 81.184C6.7733333333333 78.2826666666667 7.9466666666667 76.304 10.1226666666667 74.1226666666667C12.2666666666667 71.984 14.2186666666667 70.8106666666667 17.072 69.9466666666667C18.656 69.4666666666667 18.768 69.4613333333333 34.896 69.3866666666667L51.1253333333333 69.3066666666667L56.432 63.9946666666667L61.7333333333333 58.688L40.2026666666667 58.6133333333334L18.6666666666667 58.544L17.072 58.0586666666667C14.208 57.184 12.2666666666667 56.016 10.1226666666667 53.8773333333333C7.9466666666667 51.696 6.7733333333333 49.7226666666667 5.9306666666667 46.816C5.44 45.1306666666667 5.44 45.056 5.44 32C5.44 18.944 5.44 18.8693333333333 5.9306666666667 17.184C6.7733333333333 14.2773333333333 7.9466666666667 12.304 10.1226666666667 10.1226666666667C12.304 7.9466666666667 14.2773333333333 6.7733333333333 17.184 5.9306666666667L18.88 5.44L64.7466666666667 5.44L110.6133333333333 5.44L112.16 6.1653333333333C113.568 6.8213333333333 113.744 6.8586666666667 114.08 6.5653333333333C114.9226666666667 5.824 115.952 5.4826666666667 117.328 5.4826666666667C119.4613333333333 5.4826666666667 121.0933333333333 6.496 122.08 8.4213333333333C122.6986666666667 9.632 122.6773333333333 11.728 122.0373333333333 13.0133333333334C121.3973333333333 14.304 14.3893333333333 121.3546666666667 13.12 121.9786666666667C12.1066666666667 122.4746666666667 10.6346666666667 122.6826666666667 9.6 122.4693333333334M36.2666666666667 122.4693333333334C33.7973333333333 121.9626666666667 32.1493333333333 119.9093333333333 32.1493333333333 117.3333333333333C32.1493333333333 115.2106666666667 33.136 113.6106666666667 35.088 112.5653333333333L35.9466666666667 112.1066666666667L72.1066666666667 112L108.2666666666667 111.8933333333333L109.12 111.4346666666667C110.2346666666667 110.832 111.0186666666667 109.984 111.5573333333333 108.8C111.9786666666667 107.872 111.9893333333333 107.456 111.9893333333333 96C111.9893333333333 84.544 111.9786666666667 84.128 111.5573333333333 83.2C111.0186666666667 82.016 110.2346666666667 81.168 109.12 80.5653333333333C108.2773333333333 80.112 108.1226666666667 80.1066666666667 93.44 80C78.7786666666667 79.8933333333334 78.6026666666667 79.888 77.7546666666667 79.4346666666667C75.8026666666667 78.3893333333333 74.816 76.7893333333333 74.816 74.6666666666667C74.816 72.544 75.8026666666667 70.944 77.7546666666667 69.8986666666667C78.608 69.44 78.6666666666667 69.44 93.8666666666667 69.44L109.12 69.44L110.816 69.9306666666667C113.7226666666667 70.7733333333333 115.696 71.9466666666667 117.8773333333333 74.1226666666667C120.0533333333334 76.304 121.2266666666667 78.2773333333333 122.0693333333333 81.184C122.56 82.8693333333334 122.56 82.944 122.56 96C122.56 109.056 122.56 109.1306666666667 122.0693333333333 110.816C121.2266666666667 113.7226666666667 120.0533333333334 115.696 117.8773333333333 117.8773333333334C115.7386666666667 120.0106666666667 113.8026666666667 121.1786666666667 110.928 122.064L109.3333333333333 122.5493333333333L73.1733333333333 122.5866666666667C53.2853333333333 122.608 36.6773333333333 122.5546666666667 36.2666666666667 122.4693333333334M30.3466666666667 80.048C21.5093333333333 79.9946666666667 20.2666666666667 80.032 19.4453333333333 80.3413333333333C18.16 80.8266666666667 17.0933333333333 81.8293333333333 16.5013333333333 83.0933333333333L16.0053333333333 84.16L16 94.2933333333333L16 104.4266666666667L28.16 92.2666666666667L40.32 80.1066666666667L30.3466666666667 80.048M100.2666666666667 58.48C96.2133333333333 57.5786666666667 94.7093333333333 52.5493333333333 97.6266666666667 49.6266666666667C98.96 48.2986666666667 99.5626666666667 48.144 104.1066666666667 48.0106666666667C108.6613333333333 47.872 109.2906666666667 47.712 110.5333333333333 46.368C111.7706666666667 45.0346666666667 111.872 44.592 112.0106666666667 40.1066666666667C112.1173333333333 36.4586666666667 112.192 35.84 112.5813333333333 35.088C113.584 33.152 115.2053333333333 32.1493333333333 117.3333333333333 32.1493333333333C119.456 32.1493333333333 121.056 33.136 122.1013333333333 35.088C122.5333333333333 35.8933333333333 122.56 36.2346666666667 122.5493333333333 40.5333333333333C122.5333333333333 45.808 122.272 47.1626666666667 120.6933333333333 50.2293333333333C119.4506666666667 52.6293333333333 116.6293333333333 55.4506666666667 114.2346666666667 56.688C111.3546666666667 58.176 109.9573333333333 58.464 105.1733333333333 58.5653333333333C102.8853333333333 58.608 100.6773333333333 58.576 100.2666666666667 58.48M88.4266666666667 32L104.4266666666667 16L62.2933333333333 16L20.16 16.0053333333333L19.0933333333333 16.5066666666667C17.8133333333333 17.1146666666667 17.0293333333333 17.9093333333333 16.4426666666667 19.2C16.0213333333333 20.128 16.0106666666667 20.544 16.0106666666667 32C16.0106666666667 43.456 16.0213333333333 43.872 16.4426666666667 44.8C17.0293333333333 46.0906666666667 17.8133333333333 46.8853333333333 19.0933333333333 47.4933333333333L20.16 47.9946666666667L46.2933333333333 48L72.4266666666667 48L88.4266666666667 32M30.9333333333333 37.136C26.9013333333333 36.3093333333333 25.3813333333333 31.2106666666667 28.2933333333333 28.2933333333333C29.7706666666667 26.8213333333333 32.4 26.3413333333333 34.24 27.216C35.9946666666667 28.048 37.3333333333333 30.1173333333333 37.3333333333333 32C37.3333333333333 33.8453333333333 35.9893333333333 35.968 34.336 36.7306666666667C33.4133333333333 37.1573333333333 31.9093333333333 37.3333333333333 30.9333333333333 37.136" />
+    <glyph glyph-name="circle-check-big"
+      unicode="&#xF104;"
+      horiz-adv-x="128" d="M60.576 122.432C50.5866666666667 121.936 40.1173333333333 118.432 31.36 112.672C25.4773333333333 108.8 19.1253333333333 102.368 14.912 96.016C10.6506666666667 89.6 7.3333333333333 80.8586666666667 6.0746666666667 72.7466666666667C5.6106666666667 69.744 5.424 61.84 5.7386666666667 58.56C7.056 44.768 12.8533333333333 32.3893333333333 22.512 22.7253333333333C30.192 15.04 39.568 9.7546666666667 50.1333333333333 7.1573333333333C55.28 5.8933333333333 57.4506666666667 5.6586666666667 64 5.6586666666667C70.5493333333333 5.6586666666667 72.72 5.8933333333333 77.8666666666667 7.1573333333333C85.4773333333333 9.0293333333333 92.624 12.352 98.5706666666667 16.7733333333333C101.472 18.9386666666667 102.2026666666667 19.5733333333334 105.1413333333333 22.4693333333333C112.304 29.536 117.1946666666667 37.68 120.1226666666667 47.392C121.808 52.992 122.4266666666667 57.568 122.4853333333333 64.88C122.5333333333333 71.0506666666667 122.4746666666667 71.328 120.7146666666667 72.832C118.784 74.4853333333333 115.7333333333333 74.464 113.872 72.784C112.2933333333333 71.3653333333333 112.1813333333333 70.864 111.9573333333333 64.3306666666667C111.744 57.936 111.3386666666667 55.0933333333333 109.968 50.3306666666667C105.7813333333333 35.7866666666667 94.272 23.7386666666667 79.792 18.7466666666667C73.9146666666667 16.72 70.496 16.1386666666667 64.32 16.1226666666667C59.072 16.1066666666667 57.3386666666667 16.2986666666667 52.7466666666667 17.408C40.896 20.2773333333333 30.8106666666667 27.344 24.0053333333333 37.5466666666667C14.6506666666667 51.5733333333333 13.4506666666667 69.888 20.9013333333333 85.0666666666667C27.216 97.9253333333333 38.752 107.184 52.8586666666667 110.7146666666667C58.992 112.2506666666667 67.216 112.384 73.6693333333333 111.0453333333333C75.8773333333333 110.5866666666667 79.3813333333333 109.5093333333333 83.4133333333333 108.0533333333333C85.1946666666667 107.408 86.6133333333333 107.408 87.9626666666667 108.048C90.9653333333333 109.472 91.8453333333333 113.6586666666667 89.6533333333333 116.0853333333334C87.4293333333333 118.5493333333333 78.2453333333333 121.424 70.08 122.2133333333334C66.7626666666667 122.5333333333333 63.9146666666667 122.6026666666667 60.576 122.432M115.2266666666667 111.456C114.3626666666667 111.0826666666667 110.4533333333333 107.2533333333333 84.1173333333333 80.9813333333333L64.0266666666667 60.9333333333333L57.872 67.0026666666667C54.4853333333333 70.336 51.3013333333333 73.3493333333333 50.8 73.696C49.0933333333333 74.864 46.2666666666667 74.6666666666667 44.624 73.2586666666667C43.0186666666667 71.888 42.3626666666667 69.2746666666667 43.152 67.392C43.8826666666667 65.6373333333334 60.2613333333333 49.232 62.0106666666667 48.5066666666667C62.9066666666667 48.128 65.0933333333333 48.128 65.9893333333333 48.5013333333333C67.7333333333333 49.232 121.4346666666667 102.9333333333333 122.1653333333333 104.6773333333333C122.5546666666667 105.6106666666667 122.528 107.776 122.1226666666667 108.752C121.3546666666667 110.592 119.4346666666667 111.792 117.2853333333333 111.776C116.5493333333333 111.776 115.6213333333333 111.6266666666667 115.2266666666667 111.456" />
+    <glyph glyph-name="circle-check-big-1"
+      unicode="&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x63;&#x68;&#x65;&#x63;&#x6B;&#x2D;&#x62;&#x69;&#x67;"
+      horiz-adv-x="128" d="M60.576 122.432C50.5866666666667 121.936 40.1173333333333 118.432 31.36 112.672C25.4773333333333 108.8 19.1253333333333 102.368 14.912 96.016C10.6506666666667 89.6 7.3333333333333 80.8586666666667 6.0746666666667 72.7466666666667C5.6106666666667 69.744 5.424 61.84 5.7386666666667 58.56C7.056 44.768 12.8533333333333 32.3893333333333 22.512 22.7253333333333C30.192 15.04 39.568 9.7546666666667 50.1333333333333 7.1573333333333C55.28 5.8933333333333 57.4506666666667 5.6586666666667 64 5.6586666666667C70.5493333333333 5.6586666666667 72.72 5.8933333333333 77.8666666666667 7.1573333333333C85.4773333333333 9.0293333333333 92.624 12.352 98.5706666666667 16.7733333333333C101.472 18.9386666666667 102.2026666666667 19.5733333333334 105.1413333333333 22.4693333333333C112.304 29.536 117.1946666666667 37.68 120.1226666666667 47.392C121.808 52.992 122.4266666666667 57.568 122.4853333333333 64.88C122.5333333333333 71.0506666666667 122.4746666666667 71.328 120.7146666666667 72.832C118.784 74.4853333333333 115.7333333333333 74.464 113.872 72.784C112.2933333333333 71.3653333333333 112.1813333333333 70.864 111.9573333333333 64.3306666666667C111.744 57.936 111.3386666666667 55.0933333333333 109.968 50.3306666666667C105.7813333333333 35.7866666666667 94.272 23.7386666666667 79.792 18.7466666666667C73.9146666666667 16.72 70.496 16.1386666666667 64.32 16.1226666666667C59.072 16.1066666666667 57.3386666666667 16.2986666666667 52.7466666666667 17.408C40.896 20.2773333333333 30.8106666666667 27.344 24.0053333333333 37.5466666666667C14.6506666666667 51.5733333333333 13.4506666666667 69.888 20.9013333333333 85.0666666666667C27.216 97.9253333333333 38.752 107.184 52.8586666666667 110.7146666666667C58.992 112.2506666666667 67.216 112.384 73.6693333333333 111.0453333333333C75.8773333333333 110.5866666666667 79.3813333333333 109.5093333333333 83.4133333333333 108.0533333333333C85.1946666666667 107.408 86.6133333333333 107.408 87.9626666666667 108.048C90.9653333333333 109.472 91.8453333333333 113.6586666666667 89.6533333333333 116.0853333333334C87.4293333333333 118.5493333333333 78.2453333333333 121.424 70.08 122.2133333333334C66.7626666666667 122.5333333333333 63.9146666666667 122.6026666666667 60.576 122.432M115.2266666666667 111.456C114.3626666666667 111.0826666666667 110.4533333333333 107.2533333333333 84.1173333333333 80.9813333333333L64.0266666666667 60.9333333333333L57.872 67.0026666666667C54.4853333333333 70.336 51.3013333333333 73.3493333333333 50.8 73.696C49.0933333333333 74.864 46.2666666666667 74.6666666666667 44.624 73.2586666666667C43.0186666666667 71.888 42.3626666666667 69.2746666666667 43.152 67.392C43.8826666666667 65.6373333333334 60.2613333333333 49.232 62.0106666666667 48.5066666666667C62.9066666666667 48.128 65.0933333333333 48.128 65.9893333333333 48.5013333333333C67.7333333333333 49.232 121.4346666666667 102.9333333333333 122.1653333333333 104.6773333333333C122.5546666666667 105.6106666666667 122.528 107.776 122.1226666666667 108.752C121.3546666666667 110.592 119.4346666666667 111.792 117.2853333333333 111.776C116.5493333333333 111.776 115.6213333333333 111.6266666666667 115.2266666666667 111.456" />
+    <glyph glyph-name="panel-right"
+      unicode="&#xF105;"
+      horiz-adv-x="128" d="M22.848 116.7893333333333C19.0346666666667 115.9626666666667 14.5706666666667 112.4853333333333 12.6133333333333 108.8213333333333C12.2613333333333 108.1546666666667 11.6746666666667 106.704 11.3173333333333 105.6L10.6666666666667 103.5893333333333L10.6666666666667 64L10.6666666666667 24.4106666666667L11.3173333333333 22.4C12.448 18.9066666666667 13.9253333333333 16.6933333333333 16.6666666666667 14.3626666666667C18.3146666666667 12.9653333333333 19.872 12.1386666666667 22.4 11.3173333333333L24.4106666666667 10.6666666666667L64 10.6666666666667L103.5893333333333 10.6666666666667L105.6 11.3173333333333C108.128 12.1386666666667 109.6213333333333 12.9333333333333 111.28 14.352C114.096 16.7573333333333 115.5573333333333 18.928 116.6826666666667 22.4L117.3333333333333 24.4106666666667L117.3333333333333 64L117.3333333333333 103.5893333333333L116.6826666666667 105.6C115.5413333333334 109.12 114.1493333333333 111.1946666666667 111.28 113.648C109.7706666666667 114.9386666666667 108.2666666666667 115.776 106.0693333333333 116.5653333333333L104.5066666666667 117.12L64.3626666666667 117.104C30.9653333333333 117.088 23.984 117.0346666666667 22.848 116.7893333333333M74.6666666666667 63.9946666666667L74.6666666666667 21.3173333333333L49.8666666666667 21.3813333333333L25.0666666666667 21.44L24.0426666666667 22.0426666666667C22.9066666666667 22.7093333333333 21.872 23.9893333333334 21.5306666666667 25.152C21.376 25.6853333333333 21.328 37.7813333333333 21.3706666666667 64.32L21.44 102.72L21.936 103.728C22.496 104.864 23.3813333333333 105.696 24.64 106.2666666666667C25.4506666666667 106.64 26.7466666666667 106.656 50.08 106.6613333333333L74.6666666666667 106.6666666666667L74.6666666666667 63.9946666666667M103.9413333333333 105.968C105.04 105.3226666666667 105.8346666666667 104.4053333333333 106.3413333333333 103.1946666666667C106.6293333333333 102.5013333333333 106.6666666666667 98.0053333333333 106.6666666666667 64C106.6666666666667 29.9946666666667 106.6293333333333 25.4986666666667 106.3413333333333 24.8053333333333C105.8346666666667 23.5946666666667 105.04 22.6773333333333 103.9413333333333 22.032L102.9333333333333 21.44L94.1333333333333 21.376L85.3333333333333 21.312L85.3333333333333 64.0053333333333L85.3333333333333 106.6986666666667L94.1333333333333 106.6293333333333L102.9333333333333 106.56L103.9413333333333 105.968" />
+    <glyph glyph-name="panel-right-1"
+      unicode="&#x70;&#x61;&#x6E;&#x65;&#x6C;&#x2D;&#x72;&#x69;&#x67;&#x68;&#x74;"
+      horiz-adv-x="128" d="M22.848 116.7893333333333C19.0346666666667 115.9626666666667 14.5706666666667 112.4853333333333 12.6133333333333 108.8213333333333C12.2613333333333 108.1546666666667 11.6746666666667 106.704 11.3173333333333 105.6L10.6666666666667 103.5893333333333L10.6666666666667 64L10.6666666666667 24.4106666666667L11.3173333333333 22.4C12.448 18.9066666666667 13.9253333333333 16.6933333333333 16.6666666666667 14.3626666666667C18.3146666666667 12.9653333333333 19.872 12.1386666666667 22.4 11.3173333333333L24.4106666666667 10.6666666666667L64 10.6666666666667L103.5893333333333 10.6666666666667L105.6 11.3173333333333C108.128 12.1386666666667 109.6213333333333 12.9333333333333 111.28 14.352C114.096 16.7573333333333 115.5573333333333 18.928 116.6826666666667 22.4L117.3333333333333 24.4106666666667L117.3333333333333 64L117.3333333333333 103.5893333333333L116.6826666666667 105.6C115.5413333333334 109.12 114.1493333333333 111.1946666666667 111.28 113.648C109.7706666666667 114.9386666666667 108.2666666666667 115.776 106.0693333333333 116.5653333333333L104.5066666666667 117.12L64.3626666666667 117.104C30.9653333333333 117.088 23.984 117.0346666666667 22.848 116.7893333333333M74.6666666666667 63.9946666666667L74.6666666666667 21.3173333333333L49.8666666666667 21.3813333333333L25.0666666666667 21.44L24.0426666666667 22.0426666666667C22.9066666666667 22.7093333333333 21.872 23.9893333333334 21.5306666666667 25.152C21.376 25.6853333333333 21.328 37.7813333333333 21.3706666666667 64.32L21.44 102.72L21.936 103.728C22.496 104.864 23.3813333333333 105.696 24.64 106.2666666666667C25.4506666666667 106.64 26.7466666666667 106.656 50.08 106.6613333333333L74.6666666666667 106.6666666666667L74.6666666666667 63.9946666666667M103.9413333333333 105.968C105.04 105.3226666666667 105.8346666666667 104.4053333333333 106.3413333333333 103.1946666666667C106.6293333333333 102.5013333333333 106.6666666666667 98.0053333333333 106.6666666666667 64C106.6666666666667 29.9946666666667 106.6293333333333 25.4986666666667 106.3413333333333 24.8053333333333C105.8346666666667 23.5946666666667 105.04 22.6773333333333 103.9413333333333 22.032L102.9333333333333 21.44L94.1333333333333 21.376L85.3333333333333 21.312L85.3333333333333 64.0053333333333L85.3333333333333 106.6986666666667L94.1333333333333 106.6293333333333L102.9333333333333 106.56L103.9413333333333 105.968" />
+    <glyph glyph-name="wine"
+      unicode="&#xF106;"
       horiz-adv-x="128" d="M50.976 122.4746666666667C45.7706666666667 122.336 45.76 122.336 44.2986666666667 120.9866666666667C43.4826666666667 120.2293333333333 43.2906666666667 119.8186666666667 41.6906666666667 115.488C36.1493333333333 100.4426666666667 33.328 89.952 32.416 80.992C32.048 77.3813333333334 32.2613333333333 70.4533333333334 32.8106666666667 67.9466666666667C34.9386666666667 58.288 41.4453333333333 50.1066666666667 50.352 45.8986666666667C52.912 44.688 55.328 43.8506666666667 57.3013333333333 43.4826666666667L58.6666666666667 43.232L58.6666666666667 29.648L58.6666666666667 16.064L49.9146666666667 15.9466666666667L41.168 15.824L40.2613333333333 15.2906666666667C38.3573333333333 14.1653333333333 37.5466666666667 12.7893333333333 37.5466666666667 10.6666666666667C37.5466666666667 8.464 38.5386666666667 6.8906666666667 40.5813333333333 5.8453333333333L41.584 5.3333333333333L64 5.3333333333333L86.416 5.3333333333333L87.4186666666667 5.8453333333333C89.4613333333333 6.8906666666667 90.4533333333333 8.464 90.4533333333333 10.6666666666667C90.4533333333333 12.7893333333333 89.6426666666667 14.1653333333333 87.7386666666667 15.2906666666667L86.832 15.824L78.0853333333333 15.9466666666667L69.3333333333333 16.064L69.3333333333333 29.648L69.3333333333333 43.232L70.6986666666667 43.4826666666667C72.6773333333333 43.8506666666667 75.088 44.688 77.6533333333333 45.8986666666667C86.5546666666667 50.1066666666667 93.0186666666667 58.2346666666667 95.184 67.9466666666667C95.808 70.7413333333333 95.9573333333333 77.7333333333333 95.4826666666667 81.92C95.024 85.9733333333333 93.712 92.3893333333333 92.368 97.1733333333333C90.7733333333333 102.848 85.6426666666667 117.8506666666667 84.6186666666667 119.8293333333334C84.2133333333333 120.6186666666667 82.9173333333333 121.776 82.0426666666667 122.1333333333333C81.28 122.448 59.104 122.688 50.976 122.4746666666667M77.0186666666667 110.1333333333333C81.0933333333333 99.024 84.0106666666667 88.4 85.008 81.0133333333333L85.1466666666667 80L64.0053333333333 80L42.864 80L43.0026666666667 81.12C43.7653333333333 87.3066666666667 46.5973333333333 97.9626666666667 50.0213333333333 107.488C50.768 109.5573333333333 51.44 111.4186666666667 51.5253333333333 111.6266666666667C51.664 111.9786666666667 52.4586666666667 112 64 112L76.3306666666667 112L77.0186666666667 110.1333333333333M84.5813333333333 68.8533333333333C83.6053333333333 65.568 81.6213333333333 62.2026666666667 79.2586666666667 59.8186666666667C76.6186666666667 57.1573333333333 73.856 55.4773333333333 70.0213333333333 54.192C68.1493333333333 53.5626666666667 67.9893333333333 53.5466666666667 64.0266666666667 53.5466666666667C60.0906666666667 53.5466666666667 59.8826666666667 53.568 57.9733333333333 54.1813333333333C51.5786666666667 56.24 46.816 60.512 44.384 66.3893333333333C43.936 67.4826666666667 43.504 68.592 43.424 68.8533333333333L43.28 69.3333333333333L64 69.3333333333333L84.72 69.3333333333333L84.5813333333333 68.8533333333333" />
     <glyph glyph-name="wine-1"
       unicode="&#x77;&#x69;&#x6E;&#x65;"
       horiz-adv-x="128" d="M50.976 122.4746666666667C45.7706666666667 122.336 45.76 122.336 44.2986666666667 120.9866666666667C43.4826666666667 120.2293333333333 43.2906666666667 119.8186666666667 41.6906666666667 115.488C36.1493333333333 100.4426666666667 33.328 89.952 32.416 80.992C32.048 77.3813333333334 32.2613333333333 70.4533333333334 32.8106666666667 67.9466666666667C34.9386666666667 58.288 41.4453333333333 50.1066666666667 50.352 45.8986666666667C52.912 44.688 55.328 43.8506666666667 57.3013333333333 43.4826666666667L58.6666666666667 43.232L58.6666666666667 29.648L58.6666666666667 16.064L49.9146666666667 15.9466666666667L41.168 15.824L40.2613333333333 15.2906666666667C38.3573333333333 14.1653333333333 37.5466666666667 12.7893333333333 37.5466666666667 10.6666666666667C37.5466666666667 8.464 38.5386666666667 6.8906666666667 40.5813333333333 5.8453333333333L41.584 5.3333333333333L64 5.3333333333333L86.416 5.3333333333333L87.4186666666667 5.8453333333333C89.4613333333333 6.8906666666667 90.4533333333333 8.464 90.4533333333333 10.6666666666667C90.4533333333333 12.7893333333333 89.6426666666667 14.1653333333333 87.7386666666667 15.2906666666667L86.832 15.824L78.0853333333333 15.9466666666667L69.3333333333333 16.064L69.3333333333333 29.648L69.3333333333333 43.232L70.6986666666667 43.4826666666667C72.6773333333333 43.8506666666667 75.088 44.688 77.6533333333333 45.8986666666667C86.5546666666667 50.1066666666667 93.0186666666667 58.2346666666667 95.184 67.9466666666667C95.808 70.7413333333333 95.9573333333333 77.7333333333333 95.4826666666667 81.92C95.024 85.9733333333333 93.712 92.3893333333333 92.368 97.1733333333333C90.7733333333333 102.848 85.6426666666667 117.8506666666667 84.6186666666667 119.8293333333334C84.2133333333333 120.6186666666667 82.9173333333333 121.776 82.0426666666667 122.1333333333333C81.28 122.448 59.104 122.688 50.976 122.4746666666667M77.0186666666667 110.1333333333333C81.0933333333333 99.024 84.0106666666667 88.4 85.008 81.0133333333333L85.1466666666667 80L64.0053333333333 80L42.864 80L43.0026666666667 81.12C43.7653333333333 87.3066666666667 46.5973333333333 97.9626666666667 50.0213333333333 107.488C50.768 109.5573333333333 51.44 111.4186666666667 51.5253333333333 111.6266666666667C51.664 111.9786666666667 52.4586666666667 112 64 112L76.3306666666667 112L77.0186666666667 110.1333333333333M84.5813333333333 68.8533333333333C83.6053333333333 65.568 81.6213333333333 62.2026666666667 79.2586666666667 59.8186666666667C76.6186666666667 57.1573333333333 73.856 55.4773333333333 70.0213333333333 54.192C68.1493333333333 53.5626666666667 67.9893333333333 53.5466666666667 64.0266666666667 53.5466666666667C60.0906666666667 53.5466666666667 59.8826666666667 53.568 57.9733333333333 54.1813333333333C51.5786666666667 56.24 46.816 60.512 44.384 66.3893333333333C43.936 67.4826666666667 43.504 68.592 43.424 68.8533333333333L43.28 69.3333333333333L64 69.3333333333333L84.72 69.3333333333333L84.5813333333333 68.8533333333333" />
-    <glyph glyph-name="trash-2"
-      unicode="&#xF104;"
-      horiz-adv-x="128" d="M53.2266666666667 122.4693333333334C50.8373333333333 122.3466666666667 49.9306666666667 122.2026666666667 48.6933333333333 121.7653333333333C44.1813333333333 120.1653333333333 40.032 116.08 38.416 111.648C37.6373333333333 109.52 37.3333333333333 107.3706666666667 37.3333333333333 104.016L37.3333333333333 101.3973333333333L26.0693333333333 101.28C13.712 101.152 14.048 101.1893333333333 12.4853333333333 99.8133333333333C11.376 98.8426666666667 10.8906666666667 97.696 10.8853333333333 96.048C10.88 94.4746666666667 11.2746666666667 93.3973333333333 12.224 92.4053333333333C13.552 91.024 14.24 90.8213333333333 17.9733333333333 90.7093333333333L21.3333333333333 90.608L21.3386666666667 56.88C21.3386666666667 38.3253333333333 21.4293333333333 22.0426666666667 21.536 20.6933333333333C21.936 15.488 24.5226666666667 11.1253333333333 28.9386666666667 8.1866666666667C31.4346666666667 6.528 33.6426666666667 5.7706666666667 36.6933333333333 5.536C39.888 5.2853333333333 88.112 5.2853333333333 91.3066666666667 5.536C96.5973333333333 5.9466666666667 101.0453333333333 8.6346666666667 104.0106666666667 13.216C105.5413333333333 15.5893333333333 106.24 17.744 106.464 20.8C106.5706666666667 22.208 106.656 38.4906666666667 106.6613333333333 56.9866666666667L106.6666666666667 90.608L110.0266666666667 90.7093333333333C113.76 90.8213333333333 114.448 91.024 115.776 92.4053333333333C116.7253333333333 93.3973333333333 117.12 94.4746666666667 117.1146666666667 96.048C117.1093333333333 97.696 116.624 98.8426666666667 115.5146666666667 99.8133333333333C113.952 101.1893333333333 114.288 101.152 101.9306666666667 101.28L90.6666666666667 101.3973333333333L90.6666666666667 104.016C90.6666666666667 105.456 90.5653333333333 107.3813333333333 90.4373333333333 108.2933333333333C89.536 114.7733333333334 84.528 120.3626666666667 78.1066666666667 122.0586666666667C76.6026666666667 122.4586666666667 75.7013333333333 122.496 66.3466666666667 122.56C60.7733333333333 122.5973333333334 54.8693333333333 122.5546666666667 53.2266666666667 122.4693333333334M76.528 111.5146666666667C77.6266666666667 110.9173333333333 78.688 109.888 79.3173333333333 108.8266666666667C79.8613333333333 107.8933333333333 79.8986666666667 107.6693333333333 79.968 104.5866666666667L80.048 101.3333333333333L64 101.3333333333333L47.952 101.3333333333333L48.032 104.5866666666667C48.1013333333333 107.6586666666667 48.1386666666667 107.8933333333333 48.6773333333333 108.8106666666667C49.4666666666667 110.1493333333333 50.9973333333333 111.52 51.872 111.664C53.4346666666667 111.9253333333333 54.4693333333333 111.9413333333333 64.96 111.92C74.9333333333333 111.8933333333333 75.8986666666667 111.8613333333333 76.528 111.5146666666667M95.9573333333333 55.3973333333333L95.8933333333333 20.128L95.2533333333333 19.088C94.896 18.5173333333333 94.112 17.6426666666667 93.5093333333333 17.152C92.4373333333333 16.2826666666667 92.3573333333333 16.2506666666667 90.416 16.112C89.3226666666667 16.0373333333334 76.6666666666667 16.0053333333333 62.2933333333333 16.0373333333334L36.16 16.1066666666667L35.1733333333333 16.6826666666667C34.112 17.312 33.0826666666667 18.3733333333333 32.4853333333333 19.472C32.128 20.1226666666667 32.1013333333333 22.1706666666667 32.0426666666667 55.4133333333333L31.9786666666667 90.6666666666667L63.9946666666667 90.6666666666667L96.016 90.6666666666667L95.9573333333333 55.3973333333333M51.2906666666667 74.1493333333334C50.32 73.728 49.104 72.5866666666667 48.576 71.5946666666667L48.1066666666667 70.72L48.1066666666667 53.3333333333333L48.1066666666667 35.9466666666667L48.5653333333333 35.0933333333333C49.6 33.1786666666667 51.2053333333333 32.2133333333333 53.3333333333333 32.2133333333333C55.4613333333333 32.2133333333333 57.0666666666667 33.1786666666667 58.1013333333333 35.0933333333333L58.56 35.9466666666667L58.56 53.3333333333333L58.56 70.72L58.1013333333333 71.5733333333333C57.5413333333333 72.608 56.7146666666667 73.4026666666667 55.5786666666667 74.0053333333333C54.576 74.5333333333333 52.3413333333333 74.608 51.2906666666667 74.1493333333334M72.624 74.1493333333334C71.6533333333333 73.728 70.4373333333333 72.5866666666667 69.9093333333333 71.5946666666667L69.44 70.72L69.44 53.3333333333333L69.44 35.9466666666667L69.8986666666667 35.0933333333333C70.9333333333333 33.1786666666667 72.5386666666667 32.2133333333333 74.6666666666667 32.2133333333333C76.7946666666667 32.2133333333333 78.4 33.1786666666667 79.4346666666667 35.0933333333333L79.8933333333333 35.9466666666667L79.8933333333333 53.3333333333333L79.8933333333333 70.72L79.4346666666667 71.5733333333333C78.8746666666667 72.608 78.048 73.4026666666667 76.912 74.0053333333333C75.9093333333333 74.5333333333333 73.6746666666667 74.608 72.624 74.1493333333334" />
-    <glyph glyph-name="trash-2-1"
-      unicode="&#x74;&#x72;&#x61;&#x73;&#x68;&#x2D;&#x32;"
-      horiz-adv-x="128" d="M53.2266666666667 122.4693333333334C50.8373333333333 122.3466666666667 49.9306666666667 122.2026666666667 48.6933333333333 121.7653333333333C44.1813333333333 120.1653333333333 40.032 116.08 38.416 111.648C37.6373333333333 109.52 37.3333333333333 107.3706666666667 37.3333333333333 104.016L37.3333333333333 101.3973333333333L26.0693333333333 101.28C13.712 101.152 14.048 101.1893333333333 12.4853333333333 99.8133333333333C11.376 98.8426666666667 10.8906666666667 97.696 10.8853333333333 96.048C10.88 94.4746666666667 11.2746666666667 93.3973333333333 12.224 92.4053333333333C13.552 91.024 14.24 90.8213333333333 17.9733333333333 90.7093333333333L21.3333333333333 90.608L21.3386666666667 56.88C21.3386666666667 38.3253333333333 21.4293333333333 22.0426666666667 21.536 20.6933333333333C21.936 15.488 24.5226666666667 11.1253333333333 28.9386666666667 8.1866666666667C31.4346666666667 6.528 33.6426666666667 5.7706666666667 36.6933333333333 5.536C39.888 5.2853333333333 88.112 5.2853333333333 91.3066666666667 5.536C96.5973333333333 5.9466666666667 101.0453333333333 8.6346666666667 104.0106666666667 13.216C105.5413333333333 15.5893333333333 106.24 17.744 106.464 20.8C106.5706666666667 22.208 106.656 38.4906666666667 106.6613333333333 56.9866666666667L106.6666666666667 90.608L110.0266666666667 90.7093333333333C113.76 90.8213333333333 114.448 91.024 115.776 92.4053333333333C116.7253333333333 93.3973333333333 117.12 94.4746666666667 117.1146666666667 96.048C117.1093333333333 97.696 116.624 98.8426666666667 115.5146666666667 99.8133333333333C113.952 101.1893333333333 114.288 101.152 101.9306666666667 101.28L90.6666666666667 101.3973333333333L90.6666666666667 104.016C90.6666666666667 105.456 90.5653333333333 107.3813333333333 90.4373333333333 108.2933333333333C89.536 114.7733333333334 84.528 120.3626666666667 78.1066666666667 122.0586666666667C76.6026666666667 122.4586666666667 75.7013333333333 122.496 66.3466666666667 122.56C60.7733333333333 122.5973333333334 54.8693333333333 122.5546666666667 53.2266666666667 122.4693333333334M76.528 111.5146666666667C77.6266666666667 110.9173333333333 78.688 109.888 79.3173333333333 108.8266666666667C79.8613333333333 107.8933333333333 79.8986666666667 107.6693333333333 79.968 104.5866666666667L80.048 101.3333333333333L64 101.3333333333333L47.952 101.3333333333333L48.032 104.5866666666667C48.1013333333333 107.6586666666667 48.1386666666667 107.8933333333333 48.6773333333333 108.8106666666667C49.4666666666667 110.1493333333333 50.9973333333333 111.52 51.872 111.664C53.4346666666667 111.9253333333333 54.4693333333333 111.9413333333333 64.96 111.92C74.9333333333333 111.8933333333333 75.8986666666667 111.8613333333333 76.528 111.5146666666667M95.9573333333333 55.3973333333333L95.8933333333333 20.128L95.2533333333333 19.088C94.896 18.5173333333333 94.112 17.6426666666667 93.5093333333333 17.152C92.4373333333333 16.2826666666667 92.3573333333333 16.2506666666667 90.416 16.112C89.3226666666667 16.0373333333334 76.6666666666667 16.0053333333333 62.2933333333333 16.0373333333334L36.16 16.1066666666667L35.1733333333333 16.6826666666667C34.112 17.312 33.0826666666667 18.3733333333333 32.4853333333333 19.472C32.128 20.1226666666667 32.1013333333333 22.1706666666667 32.0426666666667 55.4133333333333L31.9786666666667 90.6666666666667L63.9946666666667 90.6666666666667L96.016 90.6666666666667L95.9573333333333 55.3973333333333M51.2906666666667 74.1493333333334C50.32 73.728 49.104 72.5866666666667 48.576 71.5946666666667L48.1066666666667 70.72L48.1066666666667 53.3333333333333L48.1066666666667 35.9466666666667L48.5653333333333 35.0933333333333C49.6 33.1786666666667 51.2053333333333 32.2133333333333 53.3333333333333 32.2133333333333C55.4613333333333 32.2133333333333 57.0666666666667 33.1786666666667 58.1013333333333 35.0933333333333L58.56 35.9466666666667L58.56 53.3333333333333L58.56 70.72L58.1013333333333 71.5733333333333C57.5413333333333 72.608 56.7146666666667 73.4026666666667 55.5786666666667 74.0053333333333C54.576 74.5333333333333 52.3413333333333 74.608 51.2906666666667 74.1493333333334M72.624 74.1493333333334C71.6533333333333 73.728 70.4373333333333 72.5866666666667 69.9093333333333 71.5946666666667L69.44 70.72L69.44 53.3333333333333L69.44 35.9466666666667L69.8986666666667 35.0933333333333C70.9333333333333 33.1786666666667 72.5386666666667 32.2133333333333 74.6666666666667 32.2133333333333C76.7946666666667 32.2133333333333 78.4 33.1786666666667 79.4346666666667 35.0933333333333L79.8933333333333 35.9466666666667L79.8933333333333 53.3333333333333L79.8933333333333 70.72L79.4346666666667 71.5733333333333C78.8746666666667 72.608 78.048 73.4026666666667 76.912 74.0053333333333C75.9093333333333 74.5333333333333 73.6746666666667 74.608 72.624 74.1493333333334" />
     <glyph glyph-name="book-open"
-      unicode="&#xF105;"
+      unicode="&#xF107;"
       horiz-adv-x="128" d="M11.296 117.152C8.704 117.008 8.2773333333333 116.8586666666667 6.9653333333333 115.6533333333333C6.6346666666667 115.344 6.128 114.64 5.8453333333333 114.0853333333334L5.3333333333333 113.0826666666667L5.3333333333333 72L5.3333333333333 30.9173333333333L5.7813333333333 30.016C6.368 28.848 7.36 27.808 8.4266666666667 27.248C9.2746666666667 26.8 9.456 26.7946666666667 30.08 26.6613333333333L50.88 26.5226666666667L52.3733333333333 25.7973333333333C54.1813333333333 24.912 56.6506666666667 22.5813333333333 57.4453333333333 21.008C58.096 19.712 58.368 18.7413333333333 58.6666666666667 16.64C59.0133333333333 14.192 59.264 13.4933333333333 60.1173333333333 12.5386666666667C62.1866666666667 10.24 65.8133333333333 10.24 67.8826666666667 12.5386666666667C68.736 13.4933333333333 68.9866666666667 14.192 69.3333333333333 16.64C69.632 18.7413333333333 69.904 19.712 70.5546666666667 21.008C71.3493333333333 22.5813333333333 73.8186666666667 24.912 75.6266666666667 25.7973333333333L77.12 26.5226666666667L97.92 26.6613333333333C118.544 26.7946666666667 118.7253333333333 26.8 119.5733333333334 27.248C120.64 27.808 121.632 28.848 122.2186666666667 30.016L122.6666666666667 30.9173333333333L122.6666666666667 72L122.6666666666667 113.0826666666667L122.1493333333333 114.1066666666667C121.5626666666667 115.264 120.3946666666667 116.384 119.2906666666667 116.8426666666667C118.3093333333333 117.2533333333333 92.608 117.4933333333334 85.76 117.1573333333333C79.4773333333333 116.8426666666667 77.3813333333333 116.3626666666667 73.3066666666667 114.288C70.5226666666667 112.8693333333333 68.1493333333333 111.0933333333333 65.872 108.7253333333333L64.016 106.7946666666667L61.9253333333333 108.9173333333333C58.7306666666667 112.1706666666667 54.7466666666667 114.6826666666667 50.8106666666667 115.9253333333333C47.0666666666667 117.104 46.432 117.1413333333333 29.44 117.2213333333333C20.816 117.2586666666667 12.6506666666667 117.2266666666667 11.296 117.152M47.5893333333333 105.968C49.6693333333333 105.1733333333333 50.72 104.6026666666667 52.3413333333333 103.392C54.8106666666667 101.536 56.96 98.528 58.0693333333333 95.36C58.4693333333333 94.2293333333333 58.4906666666667 93.1306666666667 58.608 65.6C58.6773333333333 49.8773333333333 58.6613333333333 36.4693333333333 58.5813333333333 35.808L58.4266666666667 34.5973333333333L57.1093333333333 35.1946666666667C56.3786666666667 35.5253333333334 54.9706666666667 36.0586666666667 53.9733333333333 36.384C52.16 36.9706666666667 52.1546666666667 36.9706666666667 43.7333333333333 37.136C39.0986666666667 37.2213333333333 30.96 37.3066666666667 25.6533333333333 37.3173333333333L16 37.3333333333333L16 72.032L16 106.7253333333333L31.0933333333333 106.6133333333334L46.1866666666667 106.5013333333333L47.5893333333333 105.968M112 72L112 37.3333333333333L102.3466666666667 37.3173333333333C97.04 37.3066666666667 88.9013333333333 37.2213333333333 84.2666666666667 37.136C75.8453333333333 36.9706666666667 75.84 36.9706666666667 74.0266666666667 36.384C73.0293333333333 36.0586666666667 71.6213333333333 35.5253333333334 70.896 35.1946666666667L69.5786666666667 34.6026666666667L69.44 35.9146666666667C69.1946666666667 38.2026666666667 69.4666666666667 93.2 69.728 94.496C70.5173333333333 98.4266666666667 74.2506666666667 103.04 78.272 105.0506666666667C81.3013333333333 106.5653333333333 81.5946666666667 106.5866666666667 99.1466666666667 106.6346666666667L112 106.6666666666667L112 72" />
     <glyph glyph-name="book-open-1"
       unicode="&#x62;&#x6F;&#x6F;&#x6B;&#x2D;&#x6F;&#x70;&#x65;&#x6E;"
       horiz-adv-x="128" d="M11.296 117.152C8.704 117.008 8.2773333333333 116.8586666666667 6.9653333333333 115.6533333333333C6.6346666666667 115.344 6.128 114.64 5.8453333333333 114.0853333333334L5.3333333333333 113.0826666666667L5.3333333333333 72L5.3333333333333 30.9173333333333L5.7813333333333 30.016C6.368 28.848 7.36 27.808 8.4266666666667 27.248C9.2746666666667 26.8 9.456 26.7946666666667 30.08 26.6613333333333L50.88 26.5226666666667L52.3733333333333 25.7973333333333C54.1813333333333 24.912 56.6506666666667 22.5813333333333 57.4453333333333 21.008C58.096 19.712 58.368 18.7413333333333 58.6666666666667 16.64C59.0133333333333 14.192 59.264 13.4933333333333 60.1173333333333 12.5386666666667C62.1866666666667 10.24 65.8133333333333 10.24 67.8826666666667 12.5386666666667C68.736 13.4933333333333 68.9866666666667 14.192 69.3333333333333 16.64C69.632 18.7413333333333 69.904 19.712 70.5546666666667 21.008C71.3493333333333 22.5813333333333 73.8186666666667 24.912 75.6266666666667 25.7973333333333L77.12 26.5226666666667L97.92 26.6613333333333C118.544 26.7946666666667 118.7253333333333 26.8 119.5733333333334 27.248C120.64 27.808 121.632 28.848 122.2186666666667 30.016L122.6666666666667 30.9173333333333L122.6666666666667 72L122.6666666666667 113.0826666666667L122.1493333333333 114.1066666666667C121.5626666666667 115.264 120.3946666666667 116.384 119.2906666666667 116.8426666666667C118.3093333333333 117.2533333333333 92.608 117.4933333333334 85.76 117.1573333333333C79.4773333333333 116.8426666666667 77.3813333333333 116.3626666666667 73.3066666666667 114.288C70.5226666666667 112.8693333333333 68.1493333333333 111.0933333333333 65.872 108.7253333333333L64.016 106.7946666666667L61.9253333333333 108.9173333333333C58.7306666666667 112.1706666666667 54.7466666666667 114.6826666666667 50.8106666666667 115.9253333333333C47.0666666666667 117.104 46.432 117.1413333333333 29.44 117.2213333333333C20.816 117.2586666666667 12.6506666666667 117.2266666666667 11.296 117.152M47.5893333333333 105.968C49.6693333333333 105.1733333333333 50.72 104.6026666666667 52.3413333333333 103.392C54.8106666666667 101.536 56.96 98.528 58.0693333333333 95.36C58.4693333333333 94.2293333333333 58.4906666666667 93.1306666666667 58.608 65.6C58.6773333333333 49.8773333333333 58.6613333333333 36.4693333333333 58.5813333333333 35.808L58.4266666666667 34.5973333333333L57.1093333333333 35.1946666666667C56.3786666666667 35.5253333333334 54.9706666666667 36.0586666666667 53.9733333333333 36.384C52.16 36.9706666666667 52.1546666666667 36.9706666666667 43.7333333333333 37.136C39.0986666666667 37.2213333333333 30.96 37.3066666666667 25.6533333333333 37.3173333333333L16 37.3333333333333L16 72.032L16 106.7253333333333L31.0933333333333 106.6133333333334L46.1866666666667 106.5013333333333L47.5893333333333 105.968M112 72L112 37.3333333333333L102.3466666666667 37.3173333333333C97.04 37.3066666666667 88.9013333333333 37.2213333333333 84.2666666666667 37.136C75.8453333333333 36.9706666666667 75.84 36.9706666666667 74.0266666666667 36.384C73.0293333333333 36.0586666666667 71.6213333333333 35.5253333333334 70.896 35.1946666666667L69.5786666666667 34.6026666666667L69.44 35.9146666666667C69.1946666666667 38.2026666666667 69.4666666666667 93.2 69.728 94.496C70.5173333333333 98.4266666666667 74.2506666666667 103.04 78.272 105.0506666666667C81.3013333333333 106.5653333333333 81.5946666666667 106.5866666666667 99.1466666666667 106.6346666666667L112 106.6666666666667L112 72" />
-    <glyph glyph-name="moon"
-      unicode="&#xF106;"
-      horiz-adv-x="128" d="M58.7733333333333 116.976C50.3146666666667 115.92 43.8453333333333 113.8186666666667 37.2586666666667 110C25.7546666666667 103.3173333333333 17.568 93.1413333333333 13.3706666666667 80.304C11.5253333333333 74.6506666666667 10.88 70.3946666666667 10.8853333333333 63.8986666666667C10.8906666666667 57.2213333333333 11.5946666666667 52.8906666666667 13.68 46.7626666666667C19.0986666666667 30.8106666666667 31.4666666666667 18.672 47.728 13.36C53.344 11.5253333333334 57.616 10.88 64.1013333333333 10.8853333333333C70.56 10.8906666666667 74.5386666666667 11.4986666666667 80.2826666666667 13.3706666666667C88.624 16.08 95.5733333333333 20.2986666666667 101.536 26.2773333333333C111.0613333333333 35.8293333333333 116.6613333333333 48.4853333333333 117.0613333333333 61.3653333333333C117.1733333333333 65.0453333333333 117.1573333333333 65.2853333333333 116.7093333333333 66.2026666666667C116.1226666666667 67.4186666666667 114.8373333333333 68.5973333333333 113.776 68.8906666666667C112.6453333333333 69.2053333333333 110.8426666666667 69.1786666666667 110.0213333333333 68.832C109.6426666666667 68.672 108.3253333333333 67.7066666666667 107.0933333333333 66.688C103.1306666666667 63.3973333333333 100.4533333333333 61.888 96.2933333333333 60.608C92.7893333333333 59.5253333333333 90.592 59.2373333333333 86.9333333333333 59.3813333333334C82.544 59.552 79.568 60.2613333333333 75.6213333333333 62.0746666666667C67.5413333333333 65.7866666666667 61.264 74.0426666666667 59.7173333333333 82.9866666666667C59.3546666666667 85.0933333333333 59.344 91.248 59.696 92.9066666666667C60.896 98.48 63.2106666666667 103.1413333333333 66.7893333333333 107.2C68.5066666666667 109.1466666666667 69.1146666666667 110.4373333333333 69.1146666666667 112.1066666666667C69.1093333333333 112.8853333333333 68.96 113.7226666666667 68.72 114.24C68.224 115.3386666666667 66.816 116.6026666666667 65.776 116.8906666666667C65.0186666666667 117.0986666666667 60.2346666666667 117.1573333333333 58.7733333333333 116.976M52.4106666666667 104.8C52.3466666666667 104.592 51.8986666666667 103.392 51.424 102.1226666666667C49.5946666666667 97.2906666666667 48.7893333333333 92.928 48.7946666666667 87.8933333333334C48.8106666666667 72.7413333333333 57.28 59.2426666666667 70.9066666666667 52.6773333333333C81.0613333333333 47.7813333333333 92.2026666666667 47.4666666666667 103.1093333333333 51.776C104.144 52.1813333333333 105.0293333333333 52.48 105.072 52.4373333333333C105.4133333333333 52.1013333333333 102.2773333333333 44.832 100.56 41.968C97.584 37.0133333333334 92.5813333333333 31.7813333333333 87.6426666666667 28.4693333333333C82.9173333333333 25.3013333333333 76.8426666666667 22.864 71.1893333333333 21.8773333333333C66.864 21.1253333333333 59.392 21.264 55.3013333333333 22.176C42.48 25.0293333333333 31.7013333333333 33.3066666666667 25.9733333333333 44.6933333333333C23.216 50.1813333333333 21.9626666666667 54.7413333333333 21.52 60.88C20.9706666666667 68.6133333333334 22.2453333333333 75.4773333333333 25.504 82.304C27.824 87.152 30.4906666666667 90.8586666666667 34.3786666666667 94.6186666666667C38.9066666666667 99.0026666666667 43.568 101.9146666666667 49.92 104.3146666666667C52.496 105.2853333333333 52.5706666666667 105.3013333333333 52.4106666666667 104.8" />
-    <glyph glyph-name="moon-1"
-      unicode="&#x6D;&#x6F;&#x6F;&#x6E;"
-      horiz-adv-x="128" d="M58.7733333333333 116.976C50.3146666666667 115.92 43.8453333333333 113.8186666666667 37.2586666666667 110C25.7546666666667 103.3173333333333 17.568 93.1413333333333 13.3706666666667 80.304C11.5253333333333 74.6506666666667 10.88 70.3946666666667 10.8853333333333 63.8986666666667C10.8906666666667 57.2213333333333 11.5946666666667 52.8906666666667 13.68 46.7626666666667C19.0986666666667 30.8106666666667 31.4666666666667 18.672 47.728 13.36C53.344 11.5253333333334 57.616 10.88 64.1013333333333 10.8853333333333C70.56 10.8906666666667 74.5386666666667 11.4986666666667 80.2826666666667 13.3706666666667C88.624 16.08 95.5733333333333 20.2986666666667 101.536 26.2773333333333C111.0613333333333 35.8293333333333 116.6613333333333 48.4853333333333 117.0613333333333 61.3653333333333C117.1733333333333 65.0453333333333 117.1573333333333 65.2853333333333 116.7093333333333 66.2026666666667C116.1226666666667 67.4186666666667 114.8373333333333 68.5973333333333 113.776 68.8906666666667C112.6453333333333 69.2053333333333 110.8426666666667 69.1786666666667 110.0213333333333 68.832C109.6426666666667 68.672 108.3253333333333 67.7066666666667 107.0933333333333 66.688C103.1306666666667 63.3973333333333 100.4533333333333 61.888 96.2933333333333 60.608C92.7893333333333 59.5253333333333 90.592 59.2373333333333 86.9333333333333 59.3813333333334C82.544 59.552 79.568 60.2613333333333 75.6213333333333 62.0746666666667C67.5413333333333 65.7866666666667 61.264 74.0426666666667 59.7173333333333 82.9866666666667C59.3546666666667 85.0933333333333 59.344 91.248 59.696 92.9066666666667C60.896 98.48 63.2106666666667 103.1413333333333 66.7893333333333 107.2C68.5066666666667 109.1466666666667 69.1146666666667 110.4373333333333 69.1146666666667 112.1066666666667C69.1093333333333 112.8853333333333 68.96 113.7226666666667 68.72 114.24C68.224 115.3386666666667 66.816 116.6026666666667 65.776 116.8906666666667C65.0186666666667 117.0986666666667 60.2346666666667 117.1573333333333 58.7733333333333 116.976M52.4106666666667 104.8C52.3466666666667 104.592 51.8986666666667 103.392 51.424 102.1226666666667C49.5946666666667 97.2906666666667 48.7893333333333 92.928 48.7946666666667 87.8933333333334C48.8106666666667 72.7413333333333 57.28 59.2426666666667 70.9066666666667 52.6773333333333C81.0613333333333 47.7813333333333 92.2026666666667 47.4666666666667 103.1093333333333 51.776C104.144 52.1813333333333 105.0293333333333 52.48 105.072 52.4373333333333C105.4133333333333 52.1013333333333 102.2773333333333 44.832 100.56 41.968C97.584 37.0133333333334 92.5813333333333 31.7813333333333 87.6426666666667 28.4693333333333C82.9173333333333 25.3013333333333 76.8426666666667 22.864 71.1893333333333 21.8773333333333C66.864 21.1253333333333 59.392 21.264 55.3013333333333 22.176C42.48 25.0293333333333 31.7013333333333 33.3066666666667 25.9733333333333 44.6933333333333C23.216 50.1813333333333 21.9626666666667 54.7413333333333 21.52 60.88C20.9706666666667 68.6133333333334 22.2453333333333 75.4773333333333 25.504 82.304C27.824 87.152 30.4906666666667 90.8586666666667 34.3786666666667 94.6186666666667C38.9066666666667 99.0026666666667 43.568 101.9146666666667 49.92 104.3146666666667C52.496 105.2853333333333 52.5706666666667 105.3013333333333 52.4106666666667 104.8" />
-    <glyph glyph-name="circle-x"
-      unicode="&#xF107;"
-      horiz-adv-x="128" d="M61.44 122.5173333333334C45.3653333333333 121.5733333333334 31.232 114.9386666666667 20.656 103.3706666666667C16.944 99.312 14.0853333333333 95.0933333333333 11.536 89.92C6.9813333333333 80.672 4.992 70.9706666666667 5.5626666666667 60.7786666666667C5.7973333333333 56.544 6.256 53.504 7.2533333333333 49.5893333333333C9.3173333333333 41.472 13.3973333333333 33.3386666666667 18.6453333333333 26.88C20.8213333333333 24.208 25.712 19.5093333333333 28.4853333333333 17.4293333333333C37.1786666666667 10.9226666666667 46.8 7.072 57.7066666666667 5.744C60.4106666666667 5.4133333333333 67.2586666666667 5.4186666666667 70.1866666666667 5.7493333333333C80.9333333333333 6.96 91.5146666666667 11.2373333333333 99.9626666666667 17.7866666666667C103.0933333333333 20.208 107.792 24.9066666666667 110.2133333333333 28.0373333333334C115.424 34.7573333333333 119.376 43.1146666666667 121.168 51.2C121.968 54.8106666666667 122.272 57.536 122.3893333333333 62.2186666666667C122.6133333333333 71.072 121.5146666666667 77.728 118.6133333333333 85.104C115.5413333333334 92.896 111.3226666666667 99.3813333333334 105.536 105.1946666666667C100.6133333333333 110.144 96.5493333333333 113.0773333333333 90.24 116.24C82.4693333333333 120.128 76.2293333333333 121.808 67.2 122.4426666666667C65.4986666666667 122.5653333333333 63.7706666666667 122.6453333333333 63.36 122.624C62.9493333333333 122.6026666666667 62.0853333333333 122.5546666666667 61.44 122.5173333333334M68.5493333333333 111.7866666666667C79.328 110.8906666666667 90.1173333333333 105.776 98.0266666666667 97.8133333333333C116.7093333333333 79.0026666666667 116.6026666666667 48.656 97.7866666666667 29.9626666666667C89.8346666666667 22.0586666666667 79.8453333333333 17.3653333333333 68.496 16.192C65.488 15.8826666666667 59.3386666666667 16.0533333333333 56.5333333333333 16.528C48.2346666666667 17.936 40.2453333333333 21.504 33.8293333333333 26.6773333333333C24.64 34.0906666666667 18.24 45.248 16.5386666666667 56.8426666666667C15.1146666666667 66.5173333333333 16.672 76.544 20.928 85.0986666666667C25.7813333333333 94.864 33.1893333333333 102.2826666666667 42.7733333333333 106.992C51.0933333333333 111.072 59.12 112.5653333333333 68.5493333333333 111.7866666666667M45.9413333333333 84.8266666666667C44.8533333333333 84.3306666666667 43.568 83.0293333333333 43.1893333333333 82.0266666666667C42.624 80.5493333333333 42.8266666666667 78.384 43.632 77.2106666666667C43.9786666666667 76.704 46.9973333333333 73.5146666666667 50.3306666666667 70.1333333333333L56.4 63.9733333333333L51.28 58.816C42.992 50.464 42.832 50.256 42.8426666666667 48.0106666666667C42.8533333333333 45.0613333333333 45.0613333333333 42.8373333333333 47.984 42.8373333333333C50.2666666666667 42.8373333333333 50.448 42.9813333333333 58.8266666666667 51.2906666666667L64 56.4213333333333L69.1733333333333 51.2906666666667C77.552 42.9813333333333 77.7333333333333 42.8373333333333 80.016 42.8373333333333C82.9493333333333 42.8373333333333 85.136 45.0453333333333 85.1466666666667 48.0213333333333C85.1573333333333 50.272 85.0133333333333 50.4533333333334 76.7093333333333 58.8266666666667L71.5786666666667 64L76.7093333333333 69.1733333333334C85.0346666666667 77.5626666666667 85.1573333333333 77.728 85.1466666666667 80.0106666666667C85.136 82.288 83.6533333333333 84.3306666666667 81.5946666666667 84.9066666666667C80.096 85.328 78.2826666666667 85.104 77.2 84.3626666666667C76.6986666666667 84.016 73.5253333333333 81.008 70.144 77.68L64 71.6266666666667L57.856 77.68C54.4746666666667 81.008 51.3013333333333 84.016 50.8053333333333 84.3573333333333C50.0373333333333 84.8853333333333 49.6533333333333 84.992 48.256 85.056C47.1413333333333 85.104 46.3946666666667 85.0293333333333 45.9413333333333 84.8266666666667" />
-    <glyph glyph-name="circle-x-1"
-      unicode="&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x78;"
-      horiz-adv-x="128" d="M61.44 122.5173333333334C45.3653333333333 121.5733333333334 31.232 114.9386666666667 20.656 103.3706666666667C16.944 99.312 14.0853333333333 95.0933333333333 11.536 89.92C6.9813333333333 80.672 4.992 70.9706666666667 5.5626666666667 60.7786666666667C5.7973333333333 56.544 6.256 53.504 7.2533333333333 49.5893333333333C9.3173333333333 41.472 13.3973333333333 33.3386666666667 18.6453333333333 26.88C20.8213333333333 24.208 25.712 19.5093333333333 28.4853333333333 17.4293333333333C37.1786666666667 10.9226666666667 46.8 7.072 57.7066666666667 5.744C60.4106666666667 5.4133333333333 67.2586666666667 5.4186666666667 70.1866666666667 5.7493333333333C80.9333333333333 6.96 91.5146666666667 11.2373333333333 99.9626666666667 17.7866666666667C103.0933333333333 20.208 107.792 24.9066666666667 110.2133333333333 28.0373333333334C115.424 34.7573333333333 119.376 43.1146666666667 121.168 51.2C121.968 54.8106666666667 122.272 57.536 122.3893333333333 62.2186666666667C122.6133333333333 71.072 121.5146666666667 77.728 118.6133333333333 85.104C115.5413333333334 92.896 111.3226666666667 99.3813333333334 105.536 105.1946666666667C100.6133333333333 110.144 96.5493333333333 113.0773333333333 90.24 116.24C82.4693333333333 120.128 76.2293333333333 121.808 67.2 122.4426666666667C65.4986666666667 122.5653333333333 63.7706666666667 122.6453333333333 63.36 122.624C62.9493333333333 122.6026666666667 62.0853333333333 122.5546666666667 61.44 122.5173333333334M68.5493333333333 111.7866666666667C79.328 110.8906666666667 90.1173333333333 105.776 98.0266666666667 97.8133333333333C116.7093333333333 79.0026666666667 116.6026666666667 48.656 97.7866666666667 29.9626666666667C89.8346666666667 22.0586666666667 79.8453333333333 17.3653333333333 68.496 16.192C65.488 15.8826666666667 59.3386666666667 16.0533333333333 56.5333333333333 16.528C48.2346666666667 17.936 40.2453333333333 21.504 33.8293333333333 26.6773333333333C24.64 34.0906666666667 18.24 45.248 16.5386666666667 56.8426666666667C15.1146666666667 66.5173333333333 16.672 76.544 20.928 85.0986666666667C25.7813333333333 94.864 33.1893333333333 102.2826666666667 42.7733333333333 106.992C51.0933333333333 111.072 59.12 112.5653333333333 68.5493333333333 111.7866666666667M45.9413333333333 84.8266666666667C44.8533333333333 84.3306666666667 43.568 83.0293333333333 43.1893333333333 82.0266666666667C42.624 80.5493333333333 42.8266666666667 78.384 43.632 77.2106666666667C43.9786666666667 76.704 46.9973333333333 73.5146666666667 50.3306666666667 70.1333333333333L56.4 63.9733333333333L51.28 58.816C42.992 50.464 42.832 50.256 42.8426666666667 48.0106666666667C42.8533333333333 45.0613333333333 45.0613333333333 42.8373333333333 47.984 42.8373333333333C50.2666666666667 42.8373333333333 50.448 42.9813333333333 58.8266666666667 51.2906666666667L64 56.4213333333333L69.1733333333333 51.2906666666667C77.552 42.9813333333333 77.7333333333333 42.8373333333333 80.016 42.8373333333333C82.9493333333333 42.8373333333333 85.136 45.0453333333333 85.1466666666667 48.0213333333333C85.1573333333333 50.272 85.0133333333333 50.4533333333334 76.7093333333333 58.8266666666667L71.5786666666667 64L76.7093333333333 69.1733333333334C85.0346666666667 77.5626666666667 85.1573333333333 77.728 85.1466666666667 80.0106666666667C85.136 82.288 83.6533333333333 84.3306666666667 81.5946666666667 84.9066666666667C80.096 85.328 78.2826666666667 85.104 77.2 84.3626666666667C76.6986666666667 84.016 73.5253333333333 81.008 70.144 77.68L64 71.6266666666667L57.856 77.68C54.4746666666667 81.008 51.3013333333333 84.016 50.8053333333333 84.3573333333333C50.0373333333333 84.8853333333333 49.6533333333333 84.992 48.256 85.056C47.1413333333333 85.104 46.3946666666667 85.0293333333333 45.9413333333333 84.8266666666667" />
-    <glyph glyph-name="mic-off"
+    <glyph glyph-name="info"
       unicode="&#xF108;"
-      horiz-adv-x="128" d="M9.6 122.4693333333334C8.0266666666667 122.1493333333333 6.6986666666667 121.104 5.92 119.5786666666667C5.3013333333333 118.3626666666667 5.3226666666667 116.272 5.9626666666667 114.9866666666667C6.304 114.2986666666667 11.5893333333333 108.8693333333333 24.5386666666667 95.8933333333334L42.6346666666667 77.76L42.7253333333333 69.3333333333333C42.816 61.1306666666667 42.832 60.8533333333333 43.3653333333333 58.8533333333333C45.2053333333333 51.92 49.9253333333333 46.6133333333333 56.4266666666667 44.1813333333333C58.768 43.3066666666667 59.5893333333333 43.1146666666667 61.9733333333333 42.8906666666667C65.696 42.5386666666667 69.776 43.2373333333333 73.0933333333333 44.7893333333333L74.8266666666667 45.6L78.8426666666667 41.584C81.0506666666667 39.3706666666667 82.816 37.5306666666667 82.7626666666667 37.4933333333333C82.7093333333333 37.456 82.3146666666667 37.1626666666667 81.888 36.848C80.576 35.888 76.8 33.9946666666667 74.784 33.2906666666667C72.0053333333333 32.32 69.2533333333333 31.744 67.3066666666667 31.7333333333333C65.2 31.7173333333333 62.96 31.7173333333333 60.5866666666667 31.728C58.5066666666667 31.7386666666667 55.4346666666667 32.448 52.3733333333333 33.6266666666667C43.5573333333333 37.0293333333333 36.5973333333333 44.3253333333333 33.648 53.2586666666667C32.2133333333333 57.6106666666667 32.176 57.9253333333333 32.0213333333333 67.4133333333333C31.8933333333333 75.68 31.8666666666667 76.0906666666667 31.4293333333333 76.912C30.3946666666667 78.8586666666667 28.7893333333333 79.8506666666667 26.6666666666667 79.8506666666667C24.544 79.8506666666667 22.944 78.864 21.8986666666667 76.912C21.4506666666667 76.0746666666667 21.44 75.8346666666667 21.4506666666667 68.16C21.4613333333333 59.4986666666667 21.6213333333333 57.424 22.624 53.328C25.4026666666667 41.936 32.8213333333333 32.128 42.9866666666667 26.4106666666667C47.664 23.776 51.4933333333333 22.464 58.1706666666667 21.2053333333333C58.6293333333333 21.12 58.6346666666667 21.0773333333333 58.704 15.2C58.7733333333333 9.632 58.8053333333333 9.2266666666667 59.232 8.4213333333333C60.2773333333333 6.4693333333333 61.8773333333333 5.4826666666667 64 5.4826666666667C66.1226666666667 5.4826666666667 67.728 6.4746666666667 68.768 8.4213333333333C69.1893333333333 9.2213333333333 69.2266666666667 9.68 69.328 15.2373333333333L69.44 21.2L71.1466666666667 21.4826666666667C75.3173333333333 22.1813333333333 80.2346666666667 23.8293333333333 83.84 25.7386666666667C85.296 26.5066666666667 88.256 28.3946666666667 90.1546666666667 29.76C90.3786666666667 29.92 93.1946666666667 27.232 102.24 18.208C110.5013333333333 9.9626666666667 114.3146666666667 6.304 114.9866666666667 5.9626666666667C116.9173333333333 4.9973333333333 119.4986666666667 5.424 121.04 6.96C122.576 8.5013333333333 123.0026666666667 11.0773333333333 122.0373333333333 13.0133333333334C121.3973333333333 14.304 14.3893333333333 121.3546666666667 13.12 121.9786666666667C12.1066666666667 122.4746666666667 10.6346666666667 122.6826666666667 9.6 122.4693333333334M59.9466666666667 122.1333333333333C53.7066666666667 120.8693333333333 48 116.6666666666667 45.3333333333333 111.36C44.4053333333333 109.504 44.2506666666667 108.4746666666667 44.6826666666667 106.9866666666667C45.344 104.7146666666667 47.3013333333333 103.2533333333333 49.68 103.2533333333333C51.9413333333333 103.2533333333333 53.0346666666667 103.9733333333333 54.7573333333333 106.5866666666667C56.1866666666667 108.7573333333333 57.4453333333333 109.9146666666667 59.4133333333333 110.8533333333333C61.8666666666667 112.0266666666667 63.888 112.2613333333333 66.3306666666667 111.6533333333333C70.048 110.7306666666667 72.7573333333333 108.3413333333333 74.0906666666667 104.8213333333333C74.5493333333333 103.5946666666667 74.56 103.344 74.6666666666667 90.24C74.784 75.6586666666667 74.7253333333333 76.2773333333333 76.064 74.688C77.968 72.4373333333333 82.032 72.4373333333333 83.936 74.688C85.2853333333333 76.288 85.2266666666667 75.5946666666667 85.2213333333333 90.4533333333333C85.216 103.6266666666667 85.2053333333333 104.0533333333333 84.752 105.9733333333333C83.1146666666667 112.896 78.2773333333333 118.48 71.648 121.0773333333333C68.416 122.352 63.296 122.8106666666667 59.9466666666667 122.1333333333333M100.2666666666667 79.8026666666667C98.704 79.4826666666667 97.392 78.4586666666667 96.5706666666667 76.912C96.1333333333333 76.096 96.1066666666667 75.6533333333333 95.9573333333333 67.9466666666667C95.872 63.488 95.7386666666667 59.0026666666667 95.664 57.9733333333333C95.5466666666667 56.3146666666667 95.5786666666667 56.0106666666667 96 55.2C96.6613333333333 53.9146666666667 97.232 53.3493333333333 98.4533333333333 52.7733333333333C100.4266666666667 51.8453333333333 102.8746666666667 52.2026666666667 104.3733333333333 53.6426666666667C106.1333333333333 55.3333333333333 106.5226666666667 57.9733333333333 106.544 68.3733333333333C106.56 75.84 106.5493333333333 76.0746666666667 106.1013333333333 76.912C104.9173333333333 79.12 102.5813333333333 80.2773333333333 100.2666666666667 79.8026666666667M66.4906666666667 53.6213333333333C66.4053333333333 53.536 65.488 53.424 64.4533333333333 53.376C61.2693333333333 53.2213333333333 58.8426666666667 54.1813333333333 56.512 56.512C54.1546666666667 58.8693333333334 53.3333333333333 60.992 53.3333333333333 64.7306666666667L53.3333333333333 67.0933333333333L59.9893333333333 60.4373333333333C63.6533333333333 56.7733333333333 66.576 53.7066666666667 66.4906666666667 53.6213333333333" />
-    <glyph glyph-name="mic-off-1"
-      unicode="&#x6D;&#x69;&#x63;&#x2D;&#x6F;&#x66;&#x66;"
-      horiz-adv-x="128" d="M9.6 122.4693333333334C8.0266666666667 122.1493333333333 6.6986666666667 121.104 5.92 119.5786666666667C5.3013333333333 118.3626666666667 5.3226666666667 116.272 5.9626666666667 114.9866666666667C6.304 114.2986666666667 11.5893333333333 108.8693333333333 24.5386666666667 95.8933333333334L42.6346666666667 77.76L42.7253333333333 69.3333333333333C42.816 61.1306666666667 42.832 60.8533333333333 43.3653333333333 58.8533333333333C45.2053333333333 51.92 49.9253333333333 46.6133333333333 56.4266666666667 44.1813333333333C58.768 43.3066666666667 59.5893333333333 43.1146666666667 61.9733333333333 42.8906666666667C65.696 42.5386666666667 69.776 43.2373333333333 73.0933333333333 44.7893333333333L74.8266666666667 45.6L78.8426666666667 41.584C81.0506666666667 39.3706666666667 82.816 37.5306666666667 82.7626666666667 37.4933333333333C82.7093333333333 37.456 82.3146666666667 37.1626666666667 81.888 36.848C80.576 35.888 76.8 33.9946666666667 74.784 33.2906666666667C72.0053333333333 32.32 69.2533333333333 31.744 67.3066666666667 31.7333333333333C65.2 31.7173333333333 62.96 31.7173333333333 60.5866666666667 31.728C58.5066666666667 31.7386666666667 55.4346666666667 32.448 52.3733333333333 33.6266666666667C43.5573333333333 37.0293333333333 36.5973333333333 44.3253333333333 33.648 53.2586666666667C32.2133333333333 57.6106666666667 32.176 57.9253333333333 32.0213333333333 67.4133333333333C31.8933333333333 75.68 31.8666666666667 76.0906666666667 31.4293333333333 76.912C30.3946666666667 78.8586666666667 28.7893333333333 79.8506666666667 26.6666666666667 79.8506666666667C24.544 79.8506666666667 22.944 78.864 21.8986666666667 76.912C21.4506666666667 76.0746666666667 21.44 75.8346666666667 21.4506666666667 68.16C21.4613333333333 59.4986666666667 21.6213333333333 57.424 22.624 53.328C25.4026666666667 41.936 32.8213333333333 32.128 42.9866666666667 26.4106666666667C47.664 23.776 51.4933333333333 22.464 58.1706666666667 21.2053333333333C58.6293333333333 21.12 58.6346666666667 21.0773333333333 58.704 15.2C58.7733333333333 9.632 58.8053333333333 9.2266666666667 59.232 8.4213333333333C60.2773333333333 6.4693333333333 61.8773333333333 5.4826666666667 64 5.4826666666667C66.1226666666667 5.4826666666667 67.728 6.4746666666667 68.768 8.4213333333333C69.1893333333333 9.2213333333333 69.2266666666667 9.68 69.328 15.2373333333333L69.44 21.2L71.1466666666667 21.4826666666667C75.3173333333333 22.1813333333333 80.2346666666667 23.8293333333333 83.84 25.7386666666667C85.296 26.5066666666667 88.256 28.3946666666667 90.1546666666667 29.76C90.3786666666667 29.92 93.1946666666667 27.232 102.24 18.208C110.5013333333333 9.9626666666667 114.3146666666667 6.304 114.9866666666667 5.9626666666667C116.9173333333333 4.9973333333333 119.4986666666667 5.424 121.04 6.96C122.576 8.5013333333333 123.0026666666667 11.0773333333333 122.0373333333333 13.0133333333334C121.3973333333333 14.304 14.3893333333333 121.3546666666667 13.12 121.9786666666667C12.1066666666667 122.4746666666667 10.6346666666667 122.6826666666667 9.6 122.4693333333334M59.9466666666667 122.1333333333333C53.7066666666667 120.8693333333333 48 116.6666666666667 45.3333333333333 111.36C44.4053333333333 109.504 44.2506666666667 108.4746666666667 44.6826666666667 106.9866666666667C45.344 104.7146666666667 47.3013333333333 103.2533333333333 49.68 103.2533333333333C51.9413333333333 103.2533333333333 53.0346666666667 103.9733333333333 54.7573333333333 106.5866666666667C56.1866666666667 108.7573333333333 57.4453333333333 109.9146666666667 59.4133333333333 110.8533333333333C61.8666666666667 112.0266666666667 63.888 112.2613333333333 66.3306666666667 111.6533333333333C70.048 110.7306666666667 72.7573333333333 108.3413333333333 74.0906666666667 104.8213333333333C74.5493333333333 103.5946666666667 74.56 103.344 74.6666666666667 90.24C74.784 75.6586666666667 74.7253333333333 76.2773333333333 76.064 74.688C77.968 72.4373333333333 82.032 72.4373333333333 83.936 74.688C85.2853333333333 76.288 85.2266666666667 75.5946666666667 85.2213333333333 90.4533333333333C85.216 103.6266666666667 85.2053333333333 104.0533333333333 84.752 105.9733333333333C83.1146666666667 112.896 78.2773333333333 118.48 71.648 121.0773333333333C68.416 122.352 63.296 122.8106666666667 59.9466666666667 122.1333333333333M100.2666666666667 79.8026666666667C98.704 79.4826666666667 97.392 78.4586666666667 96.5706666666667 76.912C96.1333333333333 76.096 96.1066666666667 75.6533333333333 95.9573333333333 67.9466666666667C95.872 63.488 95.7386666666667 59.0026666666667 95.664 57.9733333333333C95.5466666666667 56.3146666666667 95.5786666666667 56.0106666666667 96 55.2C96.6613333333333 53.9146666666667 97.232 53.3493333333333 98.4533333333333 52.7733333333333C100.4266666666667 51.8453333333333 102.8746666666667 52.2026666666667 104.3733333333333 53.6426666666667C106.1333333333333 55.3333333333333 106.5226666666667 57.9733333333333 106.544 68.3733333333333C106.56 75.84 106.5493333333333 76.0746666666667 106.1013333333333 76.912C104.9173333333333 79.12 102.5813333333333 80.2773333333333 100.2666666666667 79.8026666666667M66.4906666666667 53.6213333333333C66.4053333333333 53.536 65.488 53.424 64.4533333333333 53.376C61.2693333333333 53.2213333333333 58.8426666666667 54.1813333333333 56.512 56.512C54.1546666666667 58.8693333333334 53.3333333333333 60.992 53.3333333333333 64.7306666666667L53.3333333333333 67.0933333333333L59.9893333333333 60.4373333333333C63.6533333333333 56.7733333333333 66.576 53.7066666666667 66.4906666666667 53.6213333333333" />
-    <glyph glyph-name="plus"
+      horiz-adv-x="128" d="M60.16 122.4373333333333C48.3626666666667 121.7066666666667 36.6826666666667 117.1786666666667 27.312 109.712C24.704 107.632 20.368 103.296 18.288 100.688C13.088 94.16 9.0293333333333 85.904 7.0666666666667 77.8346666666667C4.9173333333333 69.0346666666667 4.9173333333333 58.9653333333333 7.0666666666667 50.1653333333333C9.0293333333333 42.096 13.088 33.84 18.288 27.312C20.368 24.704 24.704 20.368 27.312 18.288C32.192 14.4 39.0506666666667 10.608 44.7253333333333 8.6666666666667C59.7493333333333 3.52 75.8186666666667 4.5333333333333 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M62.9333333333333 90.4693333333333C58.9013333333333 89.6426666666667 57.3813333333333 84.544 60.2933333333333 81.6266666666667C61.7706666666667 80.1546666666667 64.4 79.6746666666667 66.24 80.5493333333333C67.9946666666667 81.3813333333334 69.3333333333333 83.4506666666667 69.3333333333333 85.3333333333333C69.3333333333333 87.1786666666667 67.9893333333333 89.3013333333333 66.336 90.064C65.4133333333333 90.4906666666667 63.9093333333333 90.6666666666667 62.9333333333333 90.4693333333333M62.9333333333333 69.136C61.3706666666667 68.816 60.064 67.792 59.232 66.2453333333333C58.7786666666667 65.3973333333333 58.7733333333333 65.2586666666667 58.7733333333333 53.3333333333333C58.7733333333333 41.408 58.7786666666667 41.2693333333333 59.232 40.4213333333333C60.2773333333333 38.4693333333333 61.8773333333333 37.4826666666667 64 37.4826666666667C66.1226666666667 37.4826666666667 67.7226666666667 38.4693333333333 68.768 40.4213333333333C69.2213333333333 41.2693333333333 69.2266666666667 41.408 69.2266666666667 53.3333333333333C69.2266666666667 65.2586666666667 69.2213333333333 65.3973333333333 68.768 66.2453333333333C67.584 68.4533333333334 65.248 69.6106666666667 62.9333333333333 69.136" />
+    <glyph glyph-name="info-1"
+      unicode="&#x69;&#x6E;&#x66;&#x6F;"
+      horiz-adv-x="128" d="M60.16 122.4373333333333C48.3626666666667 121.7066666666667 36.6826666666667 117.1786666666667 27.312 109.712C24.704 107.632 20.368 103.296 18.288 100.688C13.088 94.16 9.0293333333333 85.904 7.0666666666667 77.8346666666667C4.9173333333333 69.0346666666667 4.9173333333333 58.9653333333333 7.0666666666667 50.1653333333333C9.0293333333333 42.096 13.088 33.84 18.288 27.312C20.368 24.704 24.704 20.368 27.312 18.288C32.192 14.4 39.0506666666667 10.608 44.7253333333333 8.6666666666667C59.7493333333333 3.52 75.8186666666667 4.5333333333333 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M62.9333333333333 90.4693333333333C58.9013333333333 89.6426666666667 57.3813333333333 84.544 60.2933333333333 81.6266666666667C61.7706666666667 80.1546666666667 64.4 79.6746666666667 66.24 80.5493333333333C67.9946666666667 81.3813333333334 69.3333333333333 83.4506666666667 69.3333333333333 85.3333333333333C69.3333333333333 87.1786666666667 67.9893333333333 89.3013333333333 66.336 90.064C65.4133333333333 90.4906666666667 63.9093333333333 90.6666666666667 62.9333333333333 90.4693333333333M62.9333333333333 69.136C61.3706666666667 68.816 60.064 67.792 59.232 66.2453333333333C58.7786666666667 65.3973333333333 58.7733333333333 65.2586666666667 58.7733333333333 53.3333333333333C58.7733333333333 41.408 58.7786666666667 41.2693333333333 59.232 40.4213333333333C60.2773333333333 38.4693333333333 61.8773333333333 37.4826666666667 64 37.4826666666667C66.1226666666667 37.4826666666667 67.7226666666667 38.4693333333333 68.768 40.4213333333333C69.2213333333333 41.2693333333333 69.2266666666667 41.408 69.2266666666667 53.3333333333333C69.2266666666667 65.2586666666667 69.2213333333333 65.3973333333333 68.768 66.2453333333333C67.584 68.4533333333334 65.248 69.6106666666667 62.9333333333333 69.136" />
+    <glyph glyph-name="more_horiz"
       unicode="&#xF109;"
-      horiz-adv-x="128" d="M61.9573333333333 106.1493333333333C60.9813333333333 105.728 59.7706666666667 104.5866666666667 59.2426666666667 103.5946666666667C58.7786666666667 102.72 58.7786666666667 102.7093333333333 58.704 86.0586666666667L58.6293333333333 69.3973333333333L42.0533333333333 69.28C23.8346666666667 69.1466666666667 24.752 69.2213333333333 23.152 67.8133333333333C22.0426666666667 66.8426666666667 21.5573333333333 65.696 21.552 64.048C21.5413333333333 61.872 22.496 60.2773333333333 24.4266666666667 59.2373333333333C25.2746666666667 58.7786666666667 25.3546666666667 58.7786666666667 41.9573333333333 58.704L58.6293333333333 58.6293333333333L58.704 41.9573333333333C58.7786666666667 25.3546666666667 58.7786666666667 25.2746666666667 59.2373333333333 24.4266666666667C60.2666666666667 22.5173333333333 61.8666666666667 21.5466666666667 64 21.5466666666667C66.1333333333333 21.5466666666667 67.7333333333333 22.5173333333333 68.7626666666667 24.4266666666667C69.2213333333333 25.2746666666667 69.2213333333333 25.3546666666667 69.296 41.9573333333333L69.3706666666667 58.6293333333333L86.0426666666667 58.704C102.6453333333333 58.7786666666667 102.7253333333333 58.7786666666667 103.5733333333333 59.2373333333333C105.504 60.2773333333333 106.4586666666667 61.872 106.448 64.048C106.4426666666667 65.696 105.9573333333333 66.8426666666667 104.848 67.8133333333333C103.248 69.2213333333333 104.1653333333333 69.1466666666667 85.9466666666667 69.28L69.3706666666667 69.3973333333333L69.296 86.0586666666667C69.2213333333333 102.6346666666667 69.2213333333333 102.7253333333333 68.7626666666667 103.5733333333333C68.208 104.608 67.3813333333333 105.4026666666667 66.2453333333333 106.0053333333333C65.2426666666667 106.5333333333333 63.008 106.608 61.9573333333333 106.1493333333333" />
-    <glyph glyph-name="plus-1"
-      unicode="&#x70;&#x6C;&#x75;&#x73;"
-      horiz-adv-x="128" d="M61.9573333333333 106.1493333333333C60.9813333333333 105.728 59.7706666666667 104.5866666666667 59.2426666666667 103.5946666666667C58.7786666666667 102.72 58.7786666666667 102.7093333333333 58.704 86.0586666666667L58.6293333333333 69.3973333333333L42.0533333333333 69.28C23.8346666666667 69.1466666666667 24.752 69.2213333333333 23.152 67.8133333333333C22.0426666666667 66.8426666666667 21.5573333333333 65.696 21.552 64.048C21.5413333333333 61.872 22.496 60.2773333333333 24.4266666666667 59.2373333333333C25.2746666666667 58.7786666666667 25.3546666666667 58.7786666666667 41.9573333333333 58.704L58.6293333333333 58.6293333333333L58.704 41.9573333333333C58.7786666666667 25.3546666666667 58.7786666666667 25.2746666666667 59.2373333333333 24.4266666666667C60.2666666666667 22.5173333333333 61.8666666666667 21.5466666666667 64 21.5466666666667C66.1333333333333 21.5466666666667 67.7333333333333 22.5173333333333 68.7626666666667 24.4266666666667C69.2213333333333 25.2746666666667 69.2213333333333 25.3546666666667 69.296 41.9573333333333L69.3706666666667 58.6293333333333L86.0426666666667 58.704C102.6453333333333 58.7786666666667 102.7253333333333 58.7786666666667 103.5733333333333 59.2373333333333C105.504 60.2773333333333 106.4586666666667 61.872 106.448 64.048C106.4426666666667 65.696 105.9573333333333 66.8426666666667 104.848 67.8133333333333C103.248 69.2213333333333 104.1653333333333 69.1466666666667 85.9466666666667 69.28L69.3706666666667 69.3973333333333L69.296 86.0586666666667C69.2213333333333 102.6346666666667 69.2213333333333 102.7253333333333 68.7626666666667 103.5733333333333C68.208 104.608 67.3813333333333 105.4026666666667 66.2453333333333 106.0053333333333C65.2426666666667 106.5333333333333 63.008 106.608 61.9573333333333 106.1493333333333" />
-    <glyph glyph-name="circle-play"
+      horiz-adv-x="128" d="M29.568 74.3413333333333C23.728 72.736 20.2453333333333 67.1093333333333 21.6693333333333 61.5786666666667C23.1466666666667 55.8666666666667 28.992 52.24 34.4426666666667 53.6586666666667C38.24 54.6453333333333 41.3546666666667 57.76 42.3413333333333 61.5573333333333C43.8933333333333 67.52 39.5786666666667 73.664 33.2853333333333 74.4426666666667C31.104 74.7146666666667 30.9013333333333 74.7093333333333 29.568 74.3413333333333M61.568 74.3413333333333C55.728 72.736 52.2453333333333 67.1093333333333 53.6693333333333 61.5786666666667C55.1466666666667 55.8666666666667 60.992 52.24 66.4426666666667 53.6586666666667C70.24 54.6453333333333 73.3546666666667 57.76 74.3413333333333 61.5573333333333C75.8933333333333 67.52 71.5786666666667 73.664 65.2853333333333 74.4426666666667C63.104 74.7146666666667 62.9013333333333 74.7093333333333 61.568 74.3413333333333M93.568 74.3413333333333C87.728 72.736 84.2453333333333 67.1093333333333 85.6693333333333 61.5786666666667C87.1466666666667 55.8666666666667 92.992 52.24 98.4426666666667 53.6586666666667C102.24 54.6453333333333 105.3546666666667 57.76 106.3413333333333 61.5573333333333C107.8933333333333 67.52 103.5786666666667 73.664 97.2853333333333 74.4426666666667C95.104 74.7146666666667 94.9013333333333 74.7093333333333 93.568 74.3413333333333" />
+    <glyph glyph-name="more_horiz-1"
+      unicode="&#x6D;&#x6F;&#x72;&#x65;&#x5F;&#x68;&#x6F;&#x72;&#x69;&#x7A;"
+      horiz-adv-x="128" d="M29.568 74.3413333333333C23.728 72.736 20.2453333333333 67.1093333333333 21.6693333333333 61.5786666666667C23.1466666666667 55.8666666666667 28.992 52.24 34.4426666666667 53.6586666666667C38.24 54.6453333333333 41.3546666666667 57.76 42.3413333333333 61.5573333333333C43.8933333333333 67.52 39.5786666666667 73.664 33.2853333333333 74.4426666666667C31.104 74.7146666666667 30.9013333333333 74.7093333333333 29.568 74.3413333333333M61.568 74.3413333333333C55.728 72.736 52.2453333333333 67.1093333333333 53.6693333333333 61.5786666666667C55.1466666666667 55.8666666666667 60.992 52.24 66.4426666666667 53.6586666666667C70.24 54.6453333333333 73.3546666666667 57.76 74.3413333333333 61.5573333333333C75.8933333333333 67.52 71.5786666666667 73.664 65.2853333333333 74.4426666666667C63.104 74.7146666666667 62.9013333333333 74.7093333333333 61.568 74.3413333333333M93.568 74.3413333333333C87.728 72.736 84.2453333333333 67.1093333333333 85.6693333333333 61.5786666666667C87.1466666666667 55.8666666666667 92.992 52.24 98.4426666666667 53.6586666666667C102.24 54.6453333333333 105.3546666666667 57.76 106.3413333333333 61.5573333333333C107.8933333333333 67.52 103.5786666666667 73.664 97.2853333333333 74.4426666666667C95.104 74.7146666666667 94.9013333333333 74.7093333333333 93.568 74.3413333333333" />
+    <glyph glyph-name="panel-left"
       unicode="&#xF10A;"
-      horiz-adv-x="128" d="M60.16 122.4373333333333C52.3573333333333 121.952 45.3546666666667 120.064 38.08 116.48C31.904 113.44 27.4186666666667 110.2293333333333 22.5973333333333 105.4026666666667C17.7706666666667 100.5813333333333 14.56 96.096 11.52 89.92C7.824 82.4213333333333 6.0533333333333 75.7013333333333 5.5466666666667 67.2693333333333C4.9333333333333 57.1413333333333 6.928 47.392 11.52 38.08C14.56 31.904 17.7706666666667 27.4186666666667 22.5973333333333 22.5973333333333C27.4133333333333 17.7813333333333 31.888 14.576 38.08 11.5093333333333C46.4693333333333 7.36 54.464 5.5093333333333 64 5.5093333333333C73.536 5.5093333333333 81.5306666666667 7.36 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M52.2666666666667 90.4693333333333C50.704 90.1493333333333 49.3973333333333 89.1253333333334 48.5653333333333 87.5786666666667L48.1066666666667 86.72L48.1066666666667 64L48.1066666666667 41.28L48.5653333333333 40.4213333333333C49.6053333333333 38.4853333333333 51.312 37.4506666666667 53.44 37.4666666666667C54.24 37.472 54.9973333333333 37.616 55.456 37.856C56.736 38.528 88.688 59.8986666666667 89.1733333333333 60.416C90.96 62.3093333333333 90.9653333333333 65.728 89.1786666666667 67.584C88.6933333333333 68.0906666666667 56.688 89.504 55.5626666666667 90.08C54.7626666666667 90.4853333333333 53.232 90.6666666666667 52.2666666666667 90.4693333333333M67.3866666666667 69.6533333333333C71.968 66.6026666666667 75.7226666666667 64.0586666666667 75.7226666666667 64C75.7226666666667 63.8933333333334 59.216 52.864 58.8586666666667 52.7306666666667C58.7466666666667 52.688 58.6666666666667 57.408 58.6666666666667 64C58.6666666666667 70.592 58.7466666666667 75.312 58.8586666666667 75.2693333333333C58.9653333333333 75.232 62.8 72.704 67.3866666666667 69.6533333333333" />
-    <glyph glyph-name="circle-play-1"
-      unicode="&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x70;&#x6C;&#x61;&#x79;"
-      horiz-adv-x="128" d="M60.16 122.4373333333333C52.3573333333333 121.952 45.3546666666667 120.064 38.08 116.48C31.904 113.44 27.4186666666667 110.2293333333333 22.5973333333333 105.4026666666667C17.7706666666667 100.5813333333333 14.56 96.096 11.52 89.92C7.824 82.4213333333333 6.0533333333333 75.7013333333333 5.5466666666667 67.2693333333333C4.9333333333333 57.1413333333333 6.928 47.392 11.52 38.08C14.56 31.904 17.7706666666667 27.4186666666667 22.5973333333333 22.5973333333333C27.4133333333333 17.7813333333333 31.888 14.576 38.08 11.5093333333333C46.4693333333333 7.36 54.464 5.5093333333333 64 5.5093333333333C73.536 5.5093333333333 81.5306666666667 7.36 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M52.2666666666667 90.4693333333333C50.704 90.1493333333333 49.3973333333333 89.1253333333334 48.5653333333333 87.5786666666667L48.1066666666667 86.72L48.1066666666667 64L48.1066666666667 41.28L48.5653333333333 40.4213333333333C49.6053333333333 38.4853333333333 51.312 37.4506666666667 53.44 37.4666666666667C54.24 37.472 54.9973333333333 37.616 55.456 37.856C56.736 38.528 88.688 59.8986666666667 89.1733333333333 60.416C90.96 62.3093333333333 90.9653333333333 65.728 89.1786666666667 67.584C88.6933333333333 68.0906666666667 56.688 89.504 55.5626666666667 90.08C54.7626666666667 90.4853333333333 53.232 90.6666666666667 52.2666666666667 90.4693333333333M67.3866666666667 69.6533333333333C71.968 66.6026666666667 75.7226666666667 64.0586666666667 75.7226666666667 64C75.7226666666667 63.8933333333334 59.216 52.864 58.8586666666667 52.7306666666667C58.7466666666667 52.688 58.6666666666667 57.408 58.6666666666667 64C58.6666666666667 70.592 58.7466666666667 75.312 58.8586666666667 75.2693333333333C58.9653333333333 75.232 62.8 72.704 67.3866666666667 69.6533333333333" />
-    <glyph glyph-name="chevron-left"
+      horiz-adv-x="128" d="M22.848 116.7893333333333C19.0346666666667 115.9626666666667 14.5706666666667 112.4853333333333 12.6133333333333 108.8213333333333C12.2613333333333 108.1546666666667 11.6746666666667 106.704 11.3173333333333 105.6L10.6666666666667 103.5893333333333L10.6666666666667 64L10.6666666666667 24.4106666666667L11.3173333333333 22.4C12.448 18.9066666666667 13.9253333333333 16.6933333333333 16.6666666666667 14.3626666666667C18.3146666666667 12.9653333333333 19.872 12.1386666666667 22.4 11.3173333333333L24.4106666666667 10.6666666666667L64 10.6666666666667L103.5893333333333 10.6666666666667L105.6 11.3173333333333C108.128 12.1386666666667 109.6213333333333 12.9333333333333 111.28 14.352C114.096 16.7573333333333 115.5573333333333 18.928 116.6826666666667 22.4L117.3333333333333 24.4106666666667L117.3333333333333 64L117.3333333333333 103.5893333333333L116.6826666666667 105.6C115.5413333333334 109.12 114.1493333333333 111.1946666666667 111.28 113.648C109.7706666666667 114.9386666666667 108.2666666666667 115.776 106.0693333333333 116.5653333333333L104.5066666666667 117.12L64.3626666666667 117.104C30.9653333333333 117.088 23.984 117.0346666666667 22.848 116.7893333333333M42.6666666666667 63.9893333333333L42.6666666666667 21.312L33.8666666666667 21.376L25.0666666666667 21.44L24.0586666666667 22.032C22.96 22.6773333333333 22.1653333333333 23.5946666666667 21.6586666666667 24.8053333333333C21.3706666666667 25.4986666666667 21.3333333333333 29.7546666666667 21.3493333333333 61.9146666666667C21.36 81.8933333333334 21.4346666666667 99.4026666666667 21.5146666666667 100.8266666666667C21.648 103.1466666666667 21.7226666666667 103.4986666666667 22.2453333333333 104.288C22.9706666666667 105.376 24.1653333333333 106.192 25.4026666666667 106.4373333333333C25.9253333333333 106.5386666666667 30.0213333333333 106.6293333333333 34.5066666666667 106.6453333333333L42.6666666666667 106.6666666666667L42.6666666666667 63.9893333333333M103.728 106.064C104.864 105.504 105.696 104.6186666666667 106.2666666666667 103.36C106.64 102.544 106.656 100.8053333333333 106.6613333333333 64.048C106.6666666666667 29.9893333333334 106.6293333333333 25.4986666666667 106.3413333333333 24.8053333333333C105.8346666666667 23.5946666666667 105.04 22.6773333333333 103.9413333333333 22.032L102.9333333333333 21.44L78.1333333333333 21.3813333333333L53.3333333333333 21.3173333333333L53.3333333333333 64.0053333333333L53.3333333333333 106.688L78.0266666666667 106.624L102.72 106.56L103.728 106.064" />
+    <glyph glyph-name="panel-left-1"
+      unicode="&#x70;&#x61;&#x6E;&#x65;&#x6C;&#x2D;&#x6C;&#x65;&#x66;&#x74;"
+      horiz-adv-x="128" d="M22.848 116.7893333333333C19.0346666666667 115.9626666666667 14.5706666666667 112.4853333333333 12.6133333333333 108.8213333333333C12.2613333333333 108.1546666666667 11.6746666666667 106.704 11.3173333333333 105.6L10.6666666666667 103.5893333333333L10.6666666666667 64L10.6666666666667 24.4106666666667L11.3173333333333 22.4C12.448 18.9066666666667 13.9253333333333 16.6933333333333 16.6666666666667 14.3626666666667C18.3146666666667 12.9653333333333 19.872 12.1386666666667 22.4 11.3173333333333L24.4106666666667 10.6666666666667L64 10.6666666666667L103.5893333333333 10.6666666666667L105.6 11.3173333333333C108.128 12.1386666666667 109.6213333333333 12.9333333333333 111.28 14.352C114.096 16.7573333333333 115.5573333333333 18.928 116.6826666666667 22.4L117.3333333333333 24.4106666666667L117.3333333333333 64L117.3333333333333 103.5893333333333L116.6826666666667 105.6C115.5413333333334 109.12 114.1493333333333 111.1946666666667 111.28 113.648C109.7706666666667 114.9386666666667 108.2666666666667 115.776 106.0693333333333 116.5653333333333L104.5066666666667 117.12L64.3626666666667 117.104C30.9653333333333 117.088 23.984 117.0346666666667 22.848 116.7893333333333M42.6666666666667 63.9893333333333L42.6666666666667 21.312L33.8666666666667 21.376L25.0666666666667 21.44L24.0586666666667 22.032C22.96 22.6773333333333 22.1653333333333 23.5946666666667 21.6586666666667 24.8053333333333C21.3706666666667 25.4986666666667 21.3333333333333 29.7546666666667 21.3493333333333 61.9146666666667C21.36 81.8933333333334 21.4346666666667 99.4026666666667 21.5146666666667 100.8266666666667C21.648 103.1466666666667 21.7226666666667 103.4986666666667 22.2453333333333 104.288C22.9706666666667 105.376 24.1653333333333 106.192 25.4026666666667 106.4373333333333C25.9253333333333 106.5386666666667 30.0213333333333 106.6293333333333 34.5066666666667 106.6453333333333L42.6666666666667 106.6666666666667L42.6666666666667 63.9893333333333M103.728 106.064C104.864 105.504 105.696 104.6186666666667 106.2666666666667 103.36C106.64 102.544 106.656 100.8053333333333 106.6613333333333 64.048C106.6666666666667 29.9893333333334 106.6293333333333 25.4986666666667 106.3413333333333 24.8053333333333C105.8346666666667 23.5946666666667 105.04 22.6773333333333 103.9413333333333 22.032L102.9333333333333 21.44L78.1333333333333 21.3813333333333L53.3333333333333 21.3173333333333L53.3333333333333 64.0053333333333L53.3333333333333 106.688L78.0266666666667 106.624L102.72 106.56L103.728 106.064" />
+    <glyph glyph-name="heart-crack"
       unicode="&#xF10B;"
-      horiz-adv-x="128" d="M78.9333333333333 101.136C78.5226666666667 101.0506666666667 77.8506666666667 100.8106666666667 77.44 100.6026666666667C76.2666666666667 100.0053333333333 43.8773333333333 67.5093333333333 43.296 66.3466666666667C42.6346666666667 65.024 42.6346666666667 62.976 43.296 61.6533333333333C43.9733333333333 60.2933333333333 76.2933333333333 27.9733333333333 77.6533333333333 27.296C79.584 26.3306666666667 82.1653333333333 26.7573333333333 83.7066666666667 28.2933333333333C85.2426666666667 29.8346666666667 85.6693333333333 32.416 84.704 34.3466666666667C84.3626666666667 35.0293333333333 80.0533333333333 39.4826666666667 69.904 49.6533333333333L55.5786666666667 64L69.904 78.3466666666667C80.0533333333333 88.5173333333333 84.3626666666667 92.9706666666667 84.704 93.6533333333333C85.344 94.9386666666667 85.3653333333333 97.0293333333333 84.7466666666667 98.2453333333333C83.632 100.4266666666667 81.2533333333333 101.6106666666667 78.9333333333333 101.136" />
-    <glyph glyph-name="chevron-left-1"
-      unicode="&#x63;&#x68;&#x65;&#x76;&#x72;&#x6F;&#x6E;&#x2D;&#x6C;&#x65;&#x66;&#x74;"
-      horiz-adv-x="128" d="M78.9333333333333 101.136C78.5226666666667 101.0506666666667 77.8506666666667 100.8106666666667 77.44 100.6026666666667C76.2666666666667 100.0053333333333 43.8773333333333 67.5093333333333 43.296 66.3466666666667C42.6346666666667 65.024 42.6346666666667 62.976 43.296 61.6533333333333C43.9733333333333 60.2933333333333 76.2933333333333 27.9733333333333 77.6533333333333 27.296C79.584 26.3306666666667 82.1653333333333 26.7573333333333 83.7066666666667 28.2933333333333C85.2426666666667 29.8346666666667 85.6693333333333 32.416 84.704 34.3466666666667C84.3626666666667 35.0293333333333 80.0533333333333 39.4826666666667 69.904 49.6533333333333L55.5786666666667 64L69.904 78.3466666666667C80.0533333333333 88.5173333333333 84.3626666666667 92.9706666666667 84.704 93.6533333333333C85.344 94.9386666666667 85.3653333333333 97.0293333333333 84.7466666666667 98.2453333333333C83.632 100.4266666666667 81.2533333333333 101.6106666666667 78.9333333333333 101.136" />
-    <glyph glyph-name="triangle-alert"
+      horiz-adv-x="128" d="M38.4 117.1946666666667C29.552 116.72 21.728 113.264 15.5626666666667 107.104C8.3893333333333 99.9306666666667 4.8053333333333 90.2613333333333 5.5626666666667 80.1226666666667C6.1226666666667 72.64 9.2906666666667 65.2906666666667 15.0346666666667 58.144C17.8666666666667 54.624 21.6906666666667 50.6933333333333 41.4186666666667 31.008C55.2373333333333 17.2213333333333 60.9653333333333 11.6426666666667 61.6533333333333 11.296C62.976 10.6346666666667 65.0186666666667 10.6346666666667 66.3466666666667 11.2906666666667C67.6586666666667 11.9413333333333 108.4 52.704 111.6106666666667 56.5813333333333C116.96 63.0346666666667 120.0266666666667 68.5493333333333 121.4986666666667 74.336C122.832 79.6106666666667 122.8586666666667 85.7066666666667 121.568 90.9866666666667C118.576 103.1946666666667 108.7946666666667 113.0773333333333 96.64 116.1653333333333C93.1466666666667 117.056 88.7466666666667 117.3973333333333 84.6933333333333 117.0986666666667C77.2373333333333 116.544 71.7226666666667 114.448 65.712 109.872L64 108.5653333333333L62.288 109.872C56.2506666666667 114.4693333333334 50.7786666666667 116.5386666666667 43.2 117.1093333333334C41.5573333333333 117.232 40.0693333333333 117.312 39.8933333333333 117.2906666666667C39.7173333333333 117.2693333333333 39.0453333333333 117.2266666666667 38.4 117.1946666666667M46.4 106.0586666666667C49.5306666666667 105.328 51.632 104.4106666666667 54.3306666666667 102.5866666666667C55.1733333333333 102.016 55.9306666666667 101.4506666666667 56.0106666666667 101.3173333333333C56.0906666666667 101.184 54.6453333333333 99.5573333333333 52.64 97.5306666666667C50.5493333333333 95.4133333333333 48.928 93.584 48.64 93.0133333333333C47.968 91.6906666666667 47.9626666666667 89.6533333333333 48.6346666666667 88.32C48.9546666666667 87.6853333333333 51.2426666666667 85.2213333333333 55.4293333333333 81.0133333333333L61.7386666666667 74.672L58.096 70.9866666666667C53.952 66.7946666666667 53.4826666666667 66.0853333333333 53.4826666666667 64C53.4826666666667 61.9413333333334 53.9733333333333 61.168 57.5733333333333 57.5733333333333C61.168 53.9733333333333 61.9413333333333 53.4826666666667 64 53.4826666666667C67.024 53.4826666666667 69.184 55.6426666666667 69.184 58.6666666666667C69.184 60.3253333333333 68.7573333333333 61.2746666666667 67.296 62.9013333333333L66.288 64.0213333333333L69.9146666666667 67.6906666666667C72.0906666666667 69.888 73.7386666666667 71.744 74.0266666666667 72.32C74.6986666666667 73.6426666666667 74.704 75.6853333333334 74.032 77.0133333333333C73.712 77.648 71.424 80.112 67.232 84.3253333333333L60.9173333333333 90.672L65.2853333333333 95.0613333333333C71.904 101.7066666666667 74.4373333333333 103.6213333333333 78.7893333333333 105.2586666666667C81.4666666666667 106.2666666666667 83.4186666666667 106.5493333333333 87.68 106.5546666666667C91.0933333333333 106.56 91.8826666666667 106.4906666666667 93.536 106.0746666666667C100.9973333333333 104.176 107.12 99.0133333333333 110.0586666666667 92.1333333333333C111.2906666666667 89.2426666666667 111.8026666666667 86.9813333333333 111.9413333333333 83.7813333333333C112.0746666666667 80.6133333333334 111.824 78.6773333333333 110.8853333333333 75.7333333333333C109.6373333333333 71.8133333333333 107.3653333333333 67.9786666666667 103.7226666666667 63.664C102.544 62.2666666666667 93.1253333333333 52.672 82.7893333333333 42.3466666666667L64 23.5733333333334L46.384 41.1733333333333C36.6986666666667 50.8533333333333 28.0693333333333 59.4933333333333 27.2106666666667 60.3733333333333C21.0026666666667 66.7413333333333 17.6586666666667 72.2933333333333 16.4213333333333 78.2933333333333C15.8293333333333 81.1626666666667 15.92 85.4986666666667 16.6293333333333 88.3093333333333C17.7013333333333 92.576 19.9306666666667 96.5066666666667 23.0453333333333 99.6213333333333C26.7306666666667 103.3066666666667 30.848 105.392 36.6933333333333 106.528C36.9866666666667 106.5866666666667 38.8586666666667 106.608 40.8533333333333 106.5706666666667C43.616 106.5226666666667 44.9386666666667 106.4 46.4 106.0586666666667" />
+    <glyph glyph-name="heart-crack-1"
+      unicode="&#x68;&#x65;&#x61;&#x72;&#x74;&#x2D;&#x63;&#x72;&#x61;&#x63;&#x6B;"
+      horiz-adv-x="128" d="M38.4 117.1946666666667C29.552 116.72 21.728 113.264 15.5626666666667 107.104C8.3893333333333 99.9306666666667 4.8053333333333 90.2613333333333 5.5626666666667 80.1226666666667C6.1226666666667 72.64 9.2906666666667 65.2906666666667 15.0346666666667 58.144C17.8666666666667 54.624 21.6906666666667 50.6933333333333 41.4186666666667 31.008C55.2373333333333 17.2213333333333 60.9653333333333 11.6426666666667 61.6533333333333 11.296C62.976 10.6346666666667 65.0186666666667 10.6346666666667 66.3466666666667 11.2906666666667C67.6586666666667 11.9413333333333 108.4 52.704 111.6106666666667 56.5813333333333C116.96 63.0346666666667 120.0266666666667 68.5493333333333 121.4986666666667 74.336C122.832 79.6106666666667 122.8586666666667 85.7066666666667 121.568 90.9866666666667C118.576 103.1946666666667 108.7946666666667 113.0773333333333 96.64 116.1653333333333C93.1466666666667 117.056 88.7466666666667 117.3973333333333 84.6933333333333 117.0986666666667C77.2373333333333 116.544 71.7226666666667 114.448 65.712 109.872L64 108.5653333333333L62.288 109.872C56.2506666666667 114.4693333333334 50.7786666666667 116.5386666666667 43.2 117.1093333333334C41.5573333333333 117.232 40.0693333333333 117.312 39.8933333333333 117.2906666666667C39.7173333333333 117.2693333333333 39.0453333333333 117.2266666666667 38.4 117.1946666666667M46.4 106.0586666666667C49.5306666666667 105.328 51.632 104.4106666666667 54.3306666666667 102.5866666666667C55.1733333333333 102.016 55.9306666666667 101.4506666666667 56.0106666666667 101.3173333333333C56.0906666666667 101.184 54.6453333333333 99.5573333333333 52.64 97.5306666666667C50.5493333333333 95.4133333333333 48.928 93.584 48.64 93.0133333333333C47.968 91.6906666666667 47.9626666666667 89.6533333333333 48.6346666666667 88.32C48.9546666666667 87.6853333333333 51.2426666666667 85.2213333333333 55.4293333333333 81.0133333333333L61.7386666666667 74.672L58.096 70.9866666666667C53.952 66.7946666666667 53.4826666666667 66.0853333333333 53.4826666666667 64C53.4826666666667 61.9413333333334 53.9733333333333 61.168 57.5733333333333 57.5733333333333C61.168 53.9733333333333 61.9413333333333 53.4826666666667 64 53.4826666666667C67.024 53.4826666666667 69.184 55.6426666666667 69.184 58.6666666666667C69.184 60.3253333333333 68.7573333333333 61.2746666666667 67.296 62.9013333333333L66.288 64.0213333333333L69.9146666666667 67.6906666666667C72.0906666666667 69.888 73.7386666666667 71.744 74.0266666666667 72.32C74.6986666666667 73.6426666666667 74.704 75.6853333333334 74.032 77.0133333333333C73.712 77.648 71.424 80.112 67.232 84.3253333333333L60.9173333333333 90.672L65.2853333333333 95.0613333333333C71.904 101.7066666666667 74.4373333333333 103.6213333333333 78.7893333333333 105.2586666666667C81.4666666666667 106.2666666666667 83.4186666666667 106.5493333333333 87.68 106.5546666666667C91.0933333333333 106.56 91.8826666666667 106.4906666666667 93.536 106.0746666666667C100.9973333333333 104.176 107.12 99.0133333333333 110.0586666666667 92.1333333333333C111.2906666666667 89.2426666666667 111.8026666666667 86.9813333333333 111.9413333333333 83.7813333333333C112.0746666666667 80.6133333333334 111.824 78.6773333333333 110.8853333333333 75.7333333333333C109.6373333333333 71.8133333333333 107.3653333333333 67.9786666666667 103.7226666666667 63.664C102.544 62.2666666666667 93.1253333333333 52.672 82.7893333333333 42.3466666666667L64 23.5733333333334L46.384 41.1733333333333C36.6986666666667 50.8533333333333 28.0693333333333 59.4933333333333 27.2106666666667 60.3733333333333C21.0026666666667 66.7413333333333 17.6586666666667 72.2933333333333 16.4213333333333 78.2933333333333C15.8293333333333 81.1626666666667 15.92 85.4986666666667 16.6293333333333 88.3093333333333C17.7013333333333 92.576 19.9306666666667 96.5066666666667 23.0453333333333 99.6213333333333C26.7306666666667 103.3066666666667 30.848 105.392 36.6933333333333 106.528C36.9866666666667 106.5866666666667 38.8586666666667 106.608 40.8533333333333 106.5706666666667C43.616 106.5226666666667 44.9386666666667 106.4 46.4 106.0586666666667" />
+    <glyph glyph-name="menu"
       unicode="&#xF10C;"
-      horiz-adv-x="128" d="M59.9466666666667 116.8213333333333C56.7733333333333 115.888 54.704 114.6293333333333 52.448 112.2613333333333C50.64 110.3626666666667 51.2373333333333 111.3706666666667 33.392 80.1066666666667C9.904 38.96 6.5013333333333 32.9066666666667 6.0586666666667 31.4666666666667C5.4506666666667 29.4773333333334 5.2266666666667 26.8426666666667 5.488 24.8C6.0053333333333 20.816 7.1733333333333 18.4586666666667 10.1333333333333 15.4666666666667C12.176 13.3973333333333 13.4666666666667 12.5813333333333 16.2666666666667 11.584C17.7973333333333 11.04 17.8986666666667 11.0293333333333 27.0933333333333 10.8373333333333C32.1973333333333 10.7253333333333 52.7893333333333 10.6826666666667 72.8533333333333 10.7413333333333L109.3333333333333 10.8426666666667L110.8266666666667 11.312C115.3493333333333 12.736 118.9226666666667 15.664 120.8373333333333 19.52C121.8826666666667 21.6266666666667 122.2666666666667 23.216 122.3946666666667 25.952C122.5493333333333 29.2906666666667 122.1546666666667 30.9546666666667 120.4213333333333 34.2773333333333C118.0693333333333 38.768 105.36 61.184 88.6826666666667 90.24C83.3973333333333 99.4506666666667 78.5813333333333 107.8346666666667 77.9893333333333 108.8746666666667C77.392 109.9093333333333 76.3946666666667 111.3226666666667 75.7706666666667 112.016C74.4 113.5306666666667 71.76 115.312 69.44 116.2773333333333C67.7813333333333 116.9653333333333 67.6373333333333 116.9866666666667 64.32 117.0453333333333C61.9466666666667 117.088 60.6133333333333 117.0186666666667 59.9466666666667 116.8213333333333M65.0613333333333 106.6453333333333C66.976 106.24 67.6586666666667 105.392 71.968 98.08C78.4906666666667 87.0133333333333 111.392 29.2053333333333 111.7493333333333 28.1813333333333C112.5546666666667 25.856 110.9386666666667 22.544 108.592 21.7066666666667C108 21.4986666666667 98.6186666666667 21.44 63.7866666666667 21.44L19.7333333333333 21.44L18.8586666666667 21.9093333333333C17.8453333333333 22.4533333333333 16.7093333333333 23.6693333333333 16.2933333333333 24.672C16.1333333333333 25.056 16 25.9946666666667 16 26.7466666666667C16 27.92 16.1173333333333 28.3413333333333 16.768 29.5733333333334C17.5253333333333 31.0026666666667 33.072 58.272 50.496 88.7466666666667C60.1066666666667 105.552 60.3253333333333 105.8826666666667 62.464 106.544C63.7173333333333 106.928 63.7493333333333 106.928 65.0613333333333 106.6453333333333M61.9573333333333 84.816C60.9866666666667 84.3946666666667 59.7706666666667 83.2533333333333 59.2426666666667 82.2613333333333C58.7733333333333 81.392 58.7733333333333 81.328 58.7733333333333 69.3333333333333C58.7733333333333 57.3813333333334 58.7786666666667 57.2746666666667 59.232 56.4266666666667C60.2666666666667 54.512 61.872 53.5466666666667 64 53.5466666666667C66.128 53.5466666666667 67.7333333333333 54.512 68.768 56.4266666666667C69.2213333333333 57.2746666666667 69.2266666666667 57.3813333333334 69.2266666666667 69.3333333333333C69.2266666666667 81.2746666666667 69.2213333333333 81.392 68.768 82.24C68.208 83.2746666666667 67.3813333333333 84.0693333333333 66.2453333333333 84.672C65.2426666666667 85.2 63.008 85.2746666666667 61.9573333333333 84.816M61.712 42.0053333333333C59.9253333333333 41.1253333333333 58.8373333333333 39.36 58.832 37.3386666666667C58.8213333333333 35.7653333333333 59.3706666666667 34.512 60.5013333333333 33.52C62.672 31.6053333333333 65.8506666666667 31.7066666666667 67.7653333333333 33.7386666666667C68.8533333333333 34.9013333333333 69.2106666666667 35.792 69.2106666666667 37.3333333333333C69.2106666666667 39.456 67.9893333333333 41.328 66.0853333333333 42.1226666666667C64.9226666666667 42.608 62.8106666666667 42.5493333333334 61.712 42.0053333333333" />
-    <glyph glyph-name="triangle-alert-1"
-      unicode="&#x74;&#x72;&#x69;&#x61;&#x6E;&#x67;&#x6C;&#x65;&#x2D;&#x61;&#x6C;&#x65;&#x72;&#x74;"
-      horiz-adv-x="128" d="M59.9466666666667 116.8213333333333C56.7733333333333 115.888 54.704 114.6293333333333 52.448 112.2613333333333C50.64 110.3626666666667 51.2373333333333 111.3706666666667 33.392 80.1066666666667C9.904 38.96 6.5013333333333 32.9066666666667 6.0586666666667 31.4666666666667C5.4506666666667 29.4773333333334 5.2266666666667 26.8426666666667 5.488 24.8C6.0053333333333 20.816 7.1733333333333 18.4586666666667 10.1333333333333 15.4666666666667C12.176 13.3973333333333 13.4666666666667 12.5813333333333 16.2666666666667 11.584C17.7973333333333 11.04 17.8986666666667 11.0293333333333 27.0933333333333 10.8373333333333C32.1973333333333 10.7253333333333 52.7893333333333 10.6826666666667 72.8533333333333 10.7413333333333L109.3333333333333 10.8426666666667L110.8266666666667 11.312C115.3493333333333 12.736 118.9226666666667 15.664 120.8373333333333 19.52C121.8826666666667 21.6266666666667 122.2666666666667 23.216 122.3946666666667 25.952C122.5493333333333 29.2906666666667 122.1546666666667 30.9546666666667 120.4213333333333 34.2773333333333C118.0693333333333 38.768 105.36 61.184 88.6826666666667 90.24C83.3973333333333 99.4506666666667 78.5813333333333 107.8346666666667 77.9893333333333 108.8746666666667C77.392 109.9093333333333 76.3946666666667 111.3226666666667 75.7706666666667 112.016C74.4 113.5306666666667 71.76 115.312 69.44 116.2773333333333C67.7813333333333 116.9653333333333 67.6373333333333 116.9866666666667 64.32 117.0453333333333C61.9466666666667 117.088 60.6133333333333 117.0186666666667 59.9466666666667 116.8213333333333M65.0613333333333 106.6453333333333C66.976 106.24 67.6586666666667 105.392 71.968 98.08C78.4906666666667 87.0133333333333 111.392 29.2053333333333 111.7493333333333 28.1813333333333C112.5546666666667 25.856 110.9386666666667 22.544 108.592 21.7066666666667C108 21.4986666666667 98.6186666666667 21.44 63.7866666666667 21.44L19.7333333333333 21.44L18.8586666666667 21.9093333333333C17.8453333333333 22.4533333333333 16.7093333333333 23.6693333333333 16.2933333333333 24.672C16.1333333333333 25.056 16 25.9946666666667 16 26.7466666666667C16 27.92 16.1173333333333 28.3413333333333 16.768 29.5733333333334C17.5253333333333 31.0026666666667 33.072 58.272 50.496 88.7466666666667C60.1066666666667 105.552 60.3253333333333 105.8826666666667 62.464 106.544C63.7173333333333 106.928 63.7493333333333 106.928 65.0613333333333 106.6453333333333M61.9573333333333 84.816C60.9866666666667 84.3946666666667 59.7706666666667 83.2533333333333 59.2426666666667 82.2613333333333C58.7733333333333 81.392 58.7733333333333 81.328 58.7733333333333 69.3333333333333C58.7733333333333 57.3813333333334 58.7786666666667 57.2746666666667 59.232 56.4266666666667C60.2666666666667 54.512 61.872 53.5466666666667 64 53.5466666666667C66.128 53.5466666666667 67.7333333333333 54.512 68.768 56.4266666666667C69.2213333333333 57.2746666666667 69.2266666666667 57.3813333333334 69.2266666666667 69.3333333333333C69.2266666666667 81.2746666666667 69.2213333333333 81.392 68.768 82.24C68.208 83.2746666666667 67.3813333333333 84.0693333333333 66.2453333333333 84.672C65.2426666666667 85.2 63.008 85.2746666666667 61.9573333333333 84.816M61.712 42.0053333333333C59.9253333333333 41.1253333333333 58.8373333333333 39.36 58.832 37.3386666666667C58.8213333333333 35.7653333333333 59.3706666666667 34.512 60.5013333333333 33.52C62.672 31.6053333333333 65.8506666666667 31.7066666666667 67.7653333333333 33.7386666666667C68.8533333333333 34.9013333333333 69.2106666666667 35.792 69.2106666666667 37.3333333333333C69.2106666666667 39.456 67.9893333333333 41.328 66.0853333333333 42.1226666666667C64.9226666666667 42.608 62.8106666666667 42.5493333333334 61.712 42.0053333333333" />
-    <glyph glyph-name="paintbrush"
+      horiz-adv-x="128" d="M30.8266666666667 101.136C18.1493333333333 100.9973333333333 18.8746666666667 101.0933333333333 17.408 99.3813333333334C16.5226666666667 98.3466666666667 16.2186666666667 97.4293333333333 16.2133333333333 95.8346666666667C16.2133333333333 93.8026666666667 17.264 92.1973333333333 19.248 91.1786666666667L20.2506666666667 90.6666666666667L64 90.6666666666667L107.7493333333333 90.6666666666667L108.752 91.1786666666667C110.7946666666667 92.224 111.7866666666667 93.7973333333333 111.7866666666667 96C111.7866666666667 98.1066666666667 110.9653333333333 99.52 109.12 100.5813333333333L108.2666666666667 101.0773333333333L75.2 101.168C57.0133333333333 101.216 37.0453333333333 101.2 30.8266666666667 101.136M30.8266666666667 69.136C18.1493333333333 68.9973333333333 18.8746666666667 69.0933333333333 17.408 67.3813333333334C16.5226666666667 66.3466666666667 16.2186666666667 65.4293333333334 16.2133333333333 63.8346666666667C16.2133333333333 61.8026666666667 17.264 60.1973333333334 19.248 59.1786666666667L20.2506666666667 58.6666666666667L64 58.6666666666667L107.7493333333333 58.6666666666667L108.752 59.1786666666667C110.7946666666667 60.224 111.7866666666667 61.7973333333333 111.7866666666667 64C111.7866666666667 66.1066666666667 110.9653333333333 67.52 109.12 68.5813333333333L108.2666666666667 69.0773333333333L75.2 69.168C57.0133333333333 69.216 37.0453333333333 69.2 30.8266666666667 69.136M30.8266666666667 37.136C18.1493333333333 36.9973333333333 18.8746666666667 37.0933333333333 17.408 35.3813333333333C16.5226666666667 34.3466666666667 16.2186666666667 33.4293333333333 16.2133333333333 31.8346666666667C16.2133333333333 29.8026666666667 17.264 28.1973333333333 19.248 27.1786666666667L20.2506666666667 26.6666666666667L64 26.6666666666667L107.7493333333333 26.6666666666667L108.752 27.1786666666667C110.7946666666667 28.224 111.7866666666667 29.7973333333333 111.7866666666667 32C111.7866666666667 34.1066666666667 110.9653333333333 35.52 109.12 36.5813333333334L108.2666666666667 37.0773333333333L75.2 37.168C57.0133333333333 37.216 37.0453333333333 37.2 30.8266666666667 37.136" />
+    <glyph glyph-name="menu-1"
+      unicode="&#x6D;&#x65;&#x6E;&#x75;"
+      horiz-adv-x="128" d="M30.8266666666667 101.136C18.1493333333333 100.9973333333333 18.8746666666667 101.0933333333333 17.408 99.3813333333334C16.5226666666667 98.3466666666667 16.2186666666667 97.4293333333333 16.2133333333333 95.8346666666667C16.2133333333333 93.8026666666667 17.264 92.1973333333333 19.248 91.1786666666667L20.2506666666667 90.6666666666667L64 90.6666666666667L107.7493333333333 90.6666666666667L108.752 91.1786666666667C110.7946666666667 92.224 111.7866666666667 93.7973333333333 111.7866666666667 96C111.7866666666667 98.1066666666667 110.9653333333333 99.52 109.12 100.5813333333333L108.2666666666667 101.0773333333333L75.2 101.168C57.0133333333333 101.216 37.0453333333333 101.2 30.8266666666667 101.136M30.8266666666667 69.136C18.1493333333333 68.9973333333333 18.8746666666667 69.0933333333333 17.408 67.3813333333334C16.5226666666667 66.3466666666667 16.2186666666667 65.4293333333334 16.2133333333333 63.8346666666667C16.2133333333333 61.8026666666667 17.264 60.1973333333334 19.248 59.1786666666667L20.2506666666667 58.6666666666667L64 58.6666666666667L107.7493333333333 58.6666666666667L108.752 59.1786666666667C110.7946666666667 60.224 111.7866666666667 61.7973333333333 111.7866666666667 64C111.7866666666667 66.1066666666667 110.9653333333333 67.52 109.12 68.5813333333333L108.2666666666667 69.0773333333333L75.2 69.168C57.0133333333333 69.216 37.0453333333333 69.2 30.8266666666667 69.136M30.8266666666667 37.136C18.1493333333333 36.9973333333333 18.8746666666667 37.0933333333333 17.408 35.3813333333333C16.5226666666667 34.3466666666667 16.2186666666667 33.4293333333333 16.2133333333333 31.8346666666667C16.2133333333333 29.8026666666667 17.264 28.1973333333333 19.248 27.1786666666667L20.2506666666667 26.6666666666667L64 26.6666666666667L107.7493333333333 26.6666666666667L108.752 27.1786666666667C110.7946666666667 28.224 111.7866666666667 29.7973333333333 111.7866666666667 32C111.7866666666667 34.1066666666667 110.9653333333333 35.52 109.12 36.5813333333334L108.2666666666667 37.0773333333333L75.2 37.168C57.0133333333333 37.216 37.0453333333333 37.2 30.8266666666667 37.136" />
+    <glyph glyph-name="circle-slash"
       unicode="&#xF10D;"
-      horiz-adv-x="128" d="M101.7813333333333 122.016C99.8933333333333 121.52 98.352 120.8373333333333 96.6933333333333 119.76C95.9626666666667 119.28 91.248 114.7573333333333 85.072 108.6133333333334L74.672 98.2666666666667L72.0586666666667 100.8213333333333C68.8906666666667 103.9093333333333 67.936 104.688 66.1333333333333 105.6693333333333C63.6053333333333 107.04 61.9573333333333 107.4133333333333 58.56 107.3973333333333C55.9573333333333 107.3813333333333 55.36 107.312 53.936 106.8373333333333C50.432 105.68 48.5813333333333 104.2453333333333 42.2133333333333 97.7866666666667C37.9466666666667 93.456 37.4826666666667 92.7573333333333 37.4826666666667 90.6666666666667C37.4826666666667 88.9226666666667 37.9466666666667 87.968 39.7066666666667 86.0853333333333L41.008 84.6933333333333L40.1973333333333 83.68C38.6826666666667 81.7973333333333 34.8746666666667 78.192 32.9493333333333 76.832C28.2826666666667 73.52 23.1146666666667 71.6693333333333 13.5466666666667 69.8773333333333C11.3173333333333 69.4613333333333 9.104 68.976 8.624 68.7946666666667C7.5733333333333 68.4053333333334 6.5226666666667 67.4186666666667 5.92 66.2506666666667C5.264 64.992 5.3066666666667 62.8693333333334 6.0053333333333 61.6213333333333C6.4693333333333 60.7946666666667 48.544 8.064 49.6853333333333 6.88C50.544 5.9946666666667 51.8506666666667 5.472 53.2373333333333 5.472C54.8693333333333 5.4666666666667 56.528 6.208 59.9306666666667 8.4746666666667C69.7013333333333 14.976 81.5093333333333 27.264 86.8373333333333 36.48C87.344 37.36 87.7813333333333 38.112 87.808 38.1493333333333C87.8346666666667 38.1866666666667 88.1706666666667 38.0533333333333 88.5653333333333 37.8506666666667C89.632 37.3013333333333 91.8026666666667 37.36 93.0133333333333 37.968C94.064 38.5013333333334 100.4906666666667 44.7093333333333 103.2693333333333 47.872C106.2773333333333 51.3013333333333 107.3973333333333 54.2186666666667 107.3973333333333 58.6666666666667C107.3973333333333 61.7333333333333 107.0666666666667 63.2746666666667 105.9093333333333 65.6426666666667C104.9493333333333 67.6053333333333 103.984 68.8266666666667 100.8266666666667 72.0586666666667L98.2666666666667 74.6773333333333L108.4 84.8586666666667C113.9733333333333 90.4586666666667 118.8266666666667 95.424 119.1893333333333 95.8933333333334C120.192 97.2 121.3013333333333 99.36 121.8186666666667 101.0133333333333C122.4586666666667 103.0453333333333 122.6346666666667 107.3973333333333 122.1653333333333 109.6C120.8853333333333 115.632 115.6746666666667 120.8746666666667 109.712 122.1386666666667C107.6106666666667 122.5866666666667 103.7226666666667 122.5226666666667 101.7813333333333 122.016M107.6053333333333 111.7706666666667C110.7093333333333 110.9866666666667 112.704 107.232 111.68 104.0853333333333C111.3333333333333 102.9973333333333 110.608 102.2293333333333 98.88 90.4533333333333C90.1653333333333 81.7066666666667 86.304 77.6853333333334 85.9626666666667 77.0133333333333C85.296 75.68 85.3013333333333 73.6426666666667 85.968 72.32C86.2773333333333 71.712 88.272 69.5253333333333 91.4133333333333 66.3466666666667C96.7573333333333 60.9386666666667 96.9173333333333 60.7146666666667 96.9013333333333 58.544C96.88 56.7413333333333 96.3146666666667 55.84 93.3546666666667 52.9066666666667L90.6613333333333 50.2453333333333L70.4533333333333 70.4533333333334L50.2453333333333 90.6613333333333L52.9066666666667 93.3546666666667C55.84 96.3146666666667 56.7413333333333 96.88 58.544 96.9013333333333C60.7146666666667 96.9173333333333 60.9386666666667 96.7573333333333 66.3466666666667 91.4133333333333C69.5253333333333 88.272 71.712 86.2773333333333 72.32 85.968C73.6426666666667 85.3013333333333 75.68 85.296 77.0133333333333 85.9626666666667C77.6906666666667 86.304 81.648 90.112 90.352 98.8C101.072 109.4933333333333 102.8746666666667 111.2106666666667 103.792 111.568C104.9973333333333 112.0373333333333 106.2773333333333 112.1066666666667 107.6053333333333 111.7706666666667M79.5733333333333 45.824C79.5733333333333 45.36 77.2906666666667 40.8533333333333 76.8853333333333 40.5173333333333C76.6506666666667 40.32 71.2106666666667 41.6106666666667 51.4986666666667 46.5333333333333L26.416 52.8L23.5466666666667 56.3786666666667C21.968 58.352 20.6293333333333 60.08 20.576 60.2186666666667C20.5066666666667 60.3946666666667 21.4613333333333 60.7306666666667 23.552 61.2693333333333C30.848 63.1413333333333 36.7146666666667 66.0746666666667 41.936 70.4533333333334C43.7813333333333 72.0053333333333 46.7253333333333 74.96 47.9626666666667 76.5066666666667L48.5333333333333 77.2266666666667L64.0533333333333 61.7066666666667C72.5866666666667 53.1733333333333 79.5733333333333 46.0213333333333 79.5733333333333 45.824M53.6533333333333 35.1786666666667C62.2186666666667 33.0453333333333 69.312 31.2266666666667 69.4133333333333 31.136C69.8773333333333 30.72 59.3013333333333 20.8853333333333 55.728 18.4053333333333C54.7573333333333 17.7333333333333 54.56 17.6693333333333 54.3146666666667 17.936C54.1066666666667 18.16 39.0186666666667 37.0346666666667 37.4613333333333 39.0186666666667C37.2746666666667 39.2533333333333 37.312 39.2906666666667 37.6533333333333 39.184C37.888 39.1146666666667 45.088 37.312 53.6533333333333 35.1786666666667" />
-    <glyph glyph-name="paintbrush-1"
-      unicode="&#x70;&#x61;&#x69;&#x6E;&#x74;&#x62;&#x72;&#x75;&#x73;&#x68;"
-      horiz-adv-x="128" d="M101.7813333333333 122.016C99.8933333333333 121.52 98.352 120.8373333333333 96.6933333333333 119.76C95.9626666666667 119.28 91.248 114.7573333333333 85.072 108.6133333333334L74.672 98.2666666666667L72.0586666666667 100.8213333333333C68.8906666666667 103.9093333333333 67.936 104.688 66.1333333333333 105.6693333333333C63.6053333333333 107.04 61.9573333333333 107.4133333333333 58.56 107.3973333333333C55.9573333333333 107.3813333333333 55.36 107.312 53.936 106.8373333333333C50.432 105.68 48.5813333333333 104.2453333333333 42.2133333333333 97.7866666666667C37.9466666666667 93.456 37.4826666666667 92.7573333333333 37.4826666666667 90.6666666666667C37.4826666666667 88.9226666666667 37.9466666666667 87.968 39.7066666666667 86.0853333333333L41.008 84.6933333333333L40.1973333333333 83.68C38.6826666666667 81.7973333333333 34.8746666666667 78.192 32.9493333333333 76.832C28.2826666666667 73.52 23.1146666666667 71.6693333333333 13.5466666666667 69.8773333333333C11.3173333333333 69.4613333333333 9.104 68.976 8.624 68.7946666666667C7.5733333333333 68.4053333333334 6.5226666666667 67.4186666666667 5.92 66.2506666666667C5.264 64.992 5.3066666666667 62.8693333333334 6.0053333333333 61.6213333333333C6.4693333333333 60.7946666666667 48.544 8.064 49.6853333333333 6.88C50.544 5.9946666666667 51.8506666666667 5.472 53.2373333333333 5.472C54.8693333333333 5.4666666666667 56.528 6.208 59.9306666666667 8.4746666666667C69.7013333333333 14.976 81.5093333333333 27.264 86.8373333333333 36.48C87.344 37.36 87.7813333333333 38.112 87.808 38.1493333333333C87.8346666666667 38.1866666666667 88.1706666666667 38.0533333333333 88.5653333333333 37.8506666666667C89.632 37.3013333333333 91.8026666666667 37.36 93.0133333333333 37.968C94.064 38.5013333333334 100.4906666666667 44.7093333333333 103.2693333333333 47.872C106.2773333333333 51.3013333333333 107.3973333333333 54.2186666666667 107.3973333333333 58.6666666666667C107.3973333333333 61.7333333333333 107.0666666666667 63.2746666666667 105.9093333333333 65.6426666666667C104.9493333333333 67.6053333333333 103.984 68.8266666666667 100.8266666666667 72.0586666666667L98.2666666666667 74.6773333333333L108.4 84.8586666666667C113.9733333333333 90.4586666666667 118.8266666666667 95.424 119.1893333333333 95.8933333333334C120.192 97.2 121.3013333333333 99.36 121.8186666666667 101.0133333333333C122.4586666666667 103.0453333333333 122.6346666666667 107.3973333333333 122.1653333333333 109.6C120.8853333333333 115.632 115.6746666666667 120.8746666666667 109.712 122.1386666666667C107.6106666666667 122.5866666666667 103.7226666666667 122.5226666666667 101.7813333333333 122.016M107.6053333333333 111.7706666666667C110.7093333333333 110.9866666666667 112.704 107.232 111.68 104.0853333333333C111.3333333333333 102.9973333333333 110.608 102.2293333333333 98.88 90.4533333333333C90.1653333333333 81.7066666666667 86.304 77.6853333333334 85.9626666666667 77.0133333333333C85.296 75.68 85.3013333333333 73.6426666666667 85.968 72.32C86.2773333333333 71.712 88.272 69.5253333333333 91.4133333333333 66.3466666666667C96.7573333333333 60.9386666666667 96.9173333333333 60.7146666666667 96.9013333333333 58.544C96.88 56.7413333333333 96.3146666666667 55.84 93.3546666666667 52.9066666666667L90.6613333333333 50.2453333333333L70.4533333333333 70.4533333333334L50.2453333333333 90.6613333333333L52.9066666666667 93.3546666666667C55.84 96.3146666666667 56.7413333333333 96.88 58.544 96.9013333333333C60.7146666666667 96.9173333333333 60.9386666666667 96.7573333333333 66.3466666666667 91.4133333333333C69.5253333333333 88.272 71.712 86.2773333333333 72.32 85.968C73.6426666666667 85.3013333333333 75.68 85.296 77.0133333333333 85.9626666666667C77.6906666666667 86.304 81.648 90.112 90.352 98.8C101.072 109.4933333333333 102.8746666666667 111.2106666666667 103.792 111.568C104.9973333333333 112.0373333333333 106.2773333333333 112.1066666666667 107.6053333333333 111.7706666666667M79.5733333333333 45.824C79.5733333333333 45.36 77.2906666666667 40.8533333333333 76.8853333333333 40.5173333333333C76.6506666666667 40.32 71.2106666666667 41.6106666666667 51.4986666666667 46.5333333333333L26.416 52.8L23.5466666666667 56.3786666666667C21.968 58.352 20.6293333333333 60.08 20.576 60.2186666666667C20.5066666666667 60.3946666666667 21.4613333333333 60.7306666666667 23.552 61.2693333333333C30.848 63.1413333333333 36.7146666666667 66.0746666666667 41.936 70.4533333333334C43.7813333333333 72.0053333333333 46.7253333333333 74.96 47.9626666666667 76.5066666666667L48.5333333333333 77.2266666666667L64.0533333333333 61.7066666666667C72.5866666666667 53.1733333333333 79.5733333333333 46.0213333333333 79.5733333333333 45.824M53.6533333333333 35.1786666666667C62.2186666666667 33.0453333333333 69.312 31.2266666666667 69.4133333333333 31.136C69.8773333333333 30.72 59.3013333333333 20.8853333333333 55.728 18.4053333333333C54.7573333333333 17.7333333333333 54.56 17.6693333333333 54.3146666666667 17.936C54.1066666666667 18.16 39.0186666666667 37.0346666666667 37.4613333333333 39.0186666666667C37.2746666666667 39.2533333333333 37.312 39.2906666666667 37.6533333333333 39.184C37.888 39.1146666666667 45.088 37.312 53.6533333333333 35.1786666666667" />
-    <glyph glyph-name="circle-stop"
+      horiz-adv-x="128" d="M60.16 122.4373333333333C48.3626666666667 121.7066666666667 36.6826666666667 117.1786666666667 27.312 109.712C24.704 107.632 20.368 103.296 18.288 100.688C13.088 94.16 9.0293333333333 85.904 7.0666666666667 77.8346666666667C4.9173333333333 69.0346666666667 4.9173333333333 58.9653333333333 7.0666666666667 50.1653333333333C9.0293333333333 42.096 13.088 33.84 18.288 27.312C20.368 24.704 24.704 20.368 27.312 18.288C32.192 14.4 39.0506666666667 10.608 44.7253333333333 8.6666666666667C59.7493333333333 3.52 75.8186666666667 4.5333333333333 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M78.9333333333333 85.136C78.5226666666667 85.0506666666667 77.8506666666667 84.8106666666667 77.44 84.6026666666667C76.2666666666667 84.0053333333333 43.8773333333333 51.5093333333333 43.296 50.3466666666667C42.3306666666667 48.416 42.7573333333333 45.8346666666667 44.2933333333333 44.2933333333333C45.8346666666667 42.7573333333333 48.416 42.3306666666667 50.3466666666667 43.296C51.7066666666667 43.9733333333333 84.0266666666667 76.2933333333333 84.704 77.6533333333333C85.344 78.9386666666667 85.3653333333333 81.0293333333333 84.7466666666667 82.2453333333333C83.632 84.4266666666667 81.2533333333333 85.6106666666667 78.9333333333333 85.136" />
+    <glyph glyph-name="circle-slash-1"
+      unicode="&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x73;&#x6C;&#x61;&#x73;&#x68;"
+      horiz-adv-x="128" d="M60.16 122.4373333333333C48.3626666666667 121.7066666666667 36.6826666666667 117.1786666666667 27.312 109.712C24.704 107.632 20.368 103.296 18.288 100.688C13.088 94.16 9.0293333333333 85.904 7.0666666666667 77.8346666666667C4.9173333333333 69.0346666666667 4.9173333333333 58.9653333333333 7.0666666666667 50.1653333333333C9.0293333333333 42.096 13.088 33.84 18.288 27.312C20.368 24.704 24.704 20.368 27.312 18.288C32.192 14.4 39.0506666666667 10.608 44.7253333333333 8.6666666666667C59.7493333333333 3.52 75.8186666666667 4.5333333333333 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M78.9333333333333 85.136C78.5226666666667 85.0506666666667 77.8506666666667 84.8106666666667 77.44 84.6026666666667C76.2666666666667 84.0053333333333 43.8773333333333 51.5093333333333 43.296 50.3466666666667C42.3306666666667 48.416 42.7573333333333 45.8346666666667 44.2933333333333 44.2933333333333C45.8346666666667 42.7573333333333 48.416 42.3306666666667 50.3466666666667 43.296C51.7066666666667 43.9733333333333 84.0266666666667 76.2933333333333 84.704 77.6533333333333C85.344 78.9386666666667 85.3653333333333 81.0293333333333 84.7466666666667 82.2453333333333C83.632 84.4266666666667 81.2533333333333 85.6106666666667 78.9333333333333 85.136" />
+    <glyph glyph-name="layout-panel-left"
       unicode="&#xF10E;"
-      horiz-adv-x="128" d="M60.16 122.4373333333333C52.3573333333333 121.952 45.3546666666667 120.064 38.08 116.48C31.904 113.44 27.4186666666667 110.2293333333333 22.5973333333333 105.4026666666667C17.7706666666667 100.5813333333333 14.56 96.096 11.52 89.92C7.824 82.4213333333333 6.0533333333333 75.7013333333333 5.5466666666667 67.2693333333333C4.9333333333333 57.1413333333333 6.928 47.392 11.52 38.08C14.56 31.904 17.7706666666667 27.4186666666667 22.5973333333333 22.5973333333333C27.4133333333333 17.7813333333333 31.888 14.576 38.08 11.5093333333333C46.4693333333333 7.36 54.464 5.5093333333333 64 5.5093333333333C73.536 5.5093333333333 81.5306666666667 7.36 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M46.9333333333333 85.136C45.3653333333333 84.816 44.064 83.792 43.232 82.2453333333333C42.7733333333333 81.3866666666667 42.7733333333333 81.3813333333334 42.7733333333333 64C42.7733333333333 46.6186666666667 42.7733333333333 46.6133333333333 43.232 45.7546666666667C43.8133333333333 44.6666666666667 44.6666666666667 43.8133333333333 45.7546666666667 43.232C46.6133333333333 42.7733333333333 46.6186666666667 42.7733333333333 64 42.7733333333333C81.3813333333333 42.7733333333333 81.3866666666667 42.7733333333333 82.2453333333333 43.232C83.3333333333333 43.8133333333333 84.1866666666667 44.6666666666667 84.768 45.7546666666667C85.2266666666667 46.6133333333333 85.2266666666667 46.6186666666667 85.2266666666667 64C85.2266666666667 81.3813333333334 85.2266666666667 81.3866666666667 84.768 82.2453333333333C84.1866666666667 83.3333333333333 83.3333333333333 84.1866666666667 82.2453333333333 84.768C81.3866666666667 85.2266666666667 81.3386666666667 85.2266666666667 64.5333333333333 85.2586666666667C55.264 85.2746666666667 47.344 85.2213333333333 46.9333333333333 85.136M74.6666666666667 64L74.6666666666667 53.3333333333333L64 53.3333333333333L53.3333333333333 53.3333333333333L53.3333333333333 64L53.3333333333333 74.6666666666667L64 74.6666666666667L74.6666666666667 74.6666666666667L74.6666666666667 64" />
-    <glyph glyph-name="circle-stop-1"
-      unicode="&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x73;&#x74;&#x6F;&#x70;"
-      horiz-adv-x="128" d="M60.16 122.4373333333333C52.3573333333333 121.952 45.3546666666667 120.064 38.08 116.48C31.904 113.44 27.4186666666667 110.2293333333333 22.5973333333333 105.4026666666667C17.7706666666667 100.5813333333333 14.56 96.096 11.52 89.92C7.824 82.4213333333333 6.0533333333333 75.7013333333333 5.5466666666667 67.2693333333333C4.9333333333333 57.1413333333333 6.928 47.392 11.52 38.08C14.56 31.904 17.7706666666667 27.4186666666667 22.5973333333333 22.5973333333333C27.4133333333333 17.7813333333333 31.888 14.576 38.08 11.5093333333333C46.4693333333333 7.36 54.464 5.5093333333333 64 5.5093333333333C73.536 5.5093333333333 81.5306666666667 7.36 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M46.9333333333333 85.136C45.3653333333333 84.816 44.064 83.792 43.232 82.2453333333333C42.7733333333333 81.3866666666667 42.7733333333333 81.3813333333334 42.7733333333333 64C42.7733333333333 46.6186666666667 42.7733333333333 46.6133333333333 43.232 45.7546666666667C43.8133333333333 44.6666666666667 44.6666666666667 43.8133333333333 45.7546666666667 43.232C46.6133333333333 42.7733333333333 46.6186666666667 42.7733333333333 64 42.7733333333333C81.3813333333333 42.7733333333333 81.3866666666667 42.7733333333333 82.2453333333333 43.232C83.3333333333333 43.8133333333333 84.1866666666667 44.6666666666667 84.768 45.7546666666667C85.2266666666667 46.6133333333333 85.2266666666667 46.6186666666667 85.2266666666667 64C85.2266666666667 81.3813333333334 85.2266666666667 81.3866666666667 84.768 82.2453333333333C84.1866666666667 83.3333333333333 83.3333333333333 84.1866666666667 82.2453333333333 84.768C81.3866666666667 85.2266666666667 81.3386666666667 85.2266666666667 64.5333333333333 85.2586666666667C55.264 85.2746666666667 47.344 85.2213333333333 46.9333333333333 85.136M74.6666666666667 64L74.6666666666667 53.3333333333333L64 53.3333333333333L53.3333333333333 53.3333333333333L53.3333333333333 64L53.3333333333333 74.6666666666667L64 74.6666666666667L74.6666666666667 74.6666666666667L74.6666666666667 64" />
-    <glyph glyph-name="chevron-right"
+      horiz-adv-x="128" d="M19.5253333333333 117.0933333333333C15.232 116.4693333333334 11.52 112.6773333333333 10.8906666666667 108.2666666666667C10.5973333333333 106.224 10.5973333333333 21.776 10.8906666666667 19.7333333333333C11.536 15.2213333333333 15.2213333333333 11.536 19.7333333333333 10.8906666666667C21.712 10.608 47.6213333333333 10.608 49.6 10.8906666666667C54.112 11.536 57.7973333333333 15.2213333333333 58.4426666666667 19.7333333333333C58.736 21.776 58.736 106.224 58.4426666666667 108.2666666666667C57.7973333333333 112.7786666666667 54.112 116.464 49.6 117.1093333333334C47.7653333333333 117.376 21.3386666666667 117.36 19.5253333333333 117.0933333333333M78.192 117.0933333333333C73.8986666666667 116.4693333333334 70.1866666666667 112.6773333333333 69.5573333333333 108.2666666666667C69.2746666666667 106.288 69.2746666666667 80.3786666666667 69.5573333333333 78.4C70.2026666666667 73.888 73.888 70.2026666666667 78.4 69.5573333333333C80.3786666666667 69.2746666666667 106.288 69.2746666666667 108.2666666666667 69.5573333333333C112.7786666666667 70.2026666666667 116.464 73.888 117.1093333333333 78.4C117.392 80.3786666666667 117.392 106.288 117.1093333333333 108.2666666666667C116.464 112.7786666666667 112.7786666666667 116.464 108.2666666666667 117.1093333333334C106.432 117.376 80.0053333333333 117.36 78.192 117.0933333333333M48 64L48 21.3333333333333L34.6666666666667 21.3333333333333L21.3333333333333 21.3333333333333L21.3333333333333 64L21.3333333333333 106.6666666666667L34.6666666666667 106.6666666666667L48 106.6666666666667L48 64M106.6666666666667 93.3333333333333L106.6666666666667 80L93.3333333333333 80L80 80L80 93.3333333333333L80 106.6666666666667L93.3333333333333 106.6666666666667L106.6666666666667 106.6666666666667L106.6666666666667 93.3333333333333M78.192 58.4266666666667C73.8986666666667 57.8026666666667 70.1866666666667 54.0106666666667 69.5573333333333 49.6C69.2746666666667 47.6213333333333 69.2746666666667 21.712 69.5573333333333 19.7333333333333C70.2026666666667 15.2213333333333 73.888 11.536 78.4 10.8906666666667C79.2693333333333 10.7626666666667 85.504 10.6773333333333 93.3333333333333 10.6773333333333C101.1626666666667 10.6773333333333 107.3973333333333 10.7626666666667 108.2666666666667 10.8906666666667C112.7786666666667 11.536 116.464 15.2213333333333 117.1093333333333 19.7333333333333C117.392 21.712 117.392 47.6213333333333 117.1093333333333 49.6C116.464 54.112 112.7786666666667 57.7973333333333 108.2666666666667 58.4426666666667C106.432 58.7093333333333 80.0053333333333 58.6933333333333 78.192 58.4266666666667M106.6666666666667 34.6666666666667L106.6666666666667 21.3333333333333L93.3333333333333 21.3333333333333L80 21.3333333333333L80 34.6666666666667L80 48L93.3333333333333 48L106.6666666666667 48L106.6666666666667 34.6666666666667" />
+    <glyph glyph-name="layout-panel-left-1"
+      unicode="&#x6C;&#x61;&#x79;&#x6F;&#x75;&#x74;&#x2D;&#x70;&#x61;&#x6E;&#x65;&#x6C;&#x2D;&#x6C;&#x65;&#x66;&#x74;"
+      horiz-adv-x="128" d="M19.5253333333333 117.0933333333333C15.232 116.4693333333334 11.52 112.6773333333333 10.8906666666667 108.2666666666667C10.5973333333333 106.224 10.5973333333333 21.776 10.8906666666667 19.7333333333333C11.536 15.2213333333333 15.2213333333333 11.536 19.7333333333333 10.8906666666667C21.712 10.608 47.6213333333333 10.608 49.6 10.8906666666667C54.112 11.536 57.7973333333333 15.2213333333333 58.4426666666667 19.7333333333333C58.736 21.776 58.736 106.224 58.4426666666667 108.2666666666667C57.7973333333333 112.7786666666667 54.112 116.464 49.6 117.1093333333334C47.7653333333333 117.376 21.3386666666667 117.36 19.5253333333333 117.0933333333333M78.192 117.0933333333333C73.8986666666667 116.4693333333334 70.1866666666667 112.6773333333333 69.5573333333333 108.2666666666667C69.2746666666667 106.288 69.2746666666667 80.3786666666667 69.5573333333333 78.4C70.2026666666667 73.888 73.888 70.2026666666667 78.4 69.5573333333333C80.3786666666667 69.2746666666667 106.288 69.2746666666667 108.2666666666667 69.5573333333333C112.7786666666667 70.2026666666667 116.464 73.888 117.1093333333333 78.4C117.392 80.3786666666667 117.392 106.288 117.1093333333333 108.2666666666667C116.464 112.7786666666667 112.7786666666667 116.464 108.2666666666667 117.1093333333334C106.432 117.376 80.0053333333333 117.36 78.192 117.0933333333333M48 64L48 21.3333333333333L34.6666666666667 21.3333333333333L21.3333333333333 21.3333333333333L21.3333333333333 64L21.3333333333333 106.6666666666667L34.6666666666667 106.6666666666667L48 106.6666666666667L48 64M106.6666666666667 93.3333333333333L106.6666666666667 80L93.3333333333333 80L80 80L80 93.3333333333333L80 106.6666666666667L93.3333333333333 106.6666666666667L106.6666666666667 106.6666666666667L106.6666666666667 93.3333333333333M78.192 58.4266666666667C73.8986666666667 57.8026666666667 70.1866666666667 54.0106666666667 69.5573333333333 49.6C69.2746666666667 47.6213333333333 69.2746666666667 21.712 69.5573333333333 19.7333333333333C70.2026666666667 15.2213333333333 73.888 11.536 78.4 10.8906666666667C79.2693333333333 10.7626666666667 85.504 10.6773333333333 93.3333333333333 10.6773333333333C101.1626666666667 10.6773333333333 107.3973333333333 10.7626666666667 108.2666666666667 10.8906666666667C112.7786666666667 11.536 116.464 15.2213333333333 117.1093333333333 19.7333333333333C117.392 21.712 117.392 47.6213333333333 117.1093333333333 49.6C116.464 54.112 112.7786666666667 57.7973333333333 108.2666666666667 58.4426666666667C106.432 58.7093333333333 80.0053333333333 58.6933333333333 78.192 58.4266666666667M106.6666666666667 34.6666666666667L106.6666666666667 21.3333333333333L93.3333333333333 21.3333333333333L80 21.3333333333333L80 34.6666666666667L80 48L93.3333333333333 48L106.6666666666667 48L106.6666666666667 34.6666666666667" />
+    <glyph glyph-name="server-cog"
       unicode="&#xF10F;"
-      horiz-adv-x="128" d="M45.9573333333333 100.816C44.944 100.3786666666667 43.7066666666667 99.1893333333333 43.28 98.24C42.8053333333333 97.2 42.7573333333333 95.008 43.184 93.9786666666667C43.5786666666667 93.04 46.0053333333333 90.5173333333333 60.4693333333333 76L72.4266666666667 64L60.4693333333333 52C45.8613333333333 37.344 43.5786666666667 34.96 43.1626666666667 33.968C42.7413333333333 32.9653333333334 42.752 31.0453333333333 43.184 30.032C43.6746666666667 28.8746666666667 44.7786666666667 27.7173333333333 45.84 27.248C46.9813333333333 26.7466666666667 48.88 26.6986666666667 49.936 27.1413333333333C51.7226666666667 27.8986666666667 84.0853333333333 60.2346666666667 84.8213333333333 62C85.2053333333333 62.9066666666667 85.2053333333333 65.088 84.8266666666667 65.9946666666667C84.368 67.0933333333333 68.7146666666667 83.0826666666667 56.6933333333333 94.7306666666667C51.888 99.3813333333334 50.384 100.72 49.76 100.896C48.6613333333333 101.2 46.7466666666667 101.1626666666667 45.9573333333333 100.816" />
-    <glyph glyph-name="chevron-right-1"
-      unicode="&#x63;&#x68;&#x65;&#x76;&#x72;&#x6F;&#x6E;&#x2D;&#x72;&#x69;&#x67;&#x68;&#x74;"
-      horiz-adv-x="128" d="M45.9573333333333 100.816C44.944 100.3786666666667 43.7066666666667 99.1893333333333 43.28 98.24C42.8053333333333 97.2 42.7573333333333 95.008 43.184 93.9786666666667C43.5786666666667 93.04 46.0053333333333 90.5173333333333 60.4693333333333 76L72.4266666666667 64L60.4693333333333 52C45.8613333333333 37.344 43.5786666666667 34.96 43.1626666666667 33.968C42.7413333333333 32.9653333333334 42.752 31.0453333333333 43.184 30.032C43.6746666666667 28.8746666666667 44.7786666666667 27.7173333333333 45.84 27.248C46.9813333333333 26.7466666666667 48.88 26.6986666666667 49.936 27.1413333333333C51.7226666666667 27.8986666666667 84.0853333333333 60.2346666666667 84.8213333333333 62C85.2053333333333 62.9066666666667 85.2053333333333 65.088 84.8266666666667 65.9946666666667C84.368 67.0933333333333 68.7146666666667 83.0826666666667 56.6933333333333 94.7306666666667C51.888 99.3813333333334 50.384 100.72 49.76 100.896C48.6613333333333 101.2 46.7466666666667 101.1626666666667 45.9573333333333 100.816" />
-    <glyph glyph-name="mic"
+      horiz-adv-x="128" d="M19.4133333333333 122.464C15.8186666666667 122.0746666666667 12.864 120.6133333333333 10.1226666666667 117.8773333333334C7.9466666666667 115.696 6.7733333333333 113.7226666666667 5.9306666666667 110.816C5.44 109.1306666666667 5.44 109.056 5.44 96C5.44 82.944 5.44 82.8693333333334 5.9306666666667 81.184C6.7733333333333 78.2773333333333 7.9466666666667 76.304 10.1226666666667 74.1226666666667C12.32 71.9306666666667 14.3253333333333 70.7466666666667 17.184 69.952C19.3973333333333 69.3386666666667 24.8213333333333 69.232 26.0266666666667 69.7813333333333C30.2666666666667 71.712 30.2666666666667 77.7493333333333 26.0266666666667 79.5253333333333C25.5946666666667 79.7066666666667 24.128 79.8986666666667 22.5066666666667 79.984C20.304 80.1013333333333 19.5573333333333 80.224 18.88 80.5813333333333C17.7706666666667 81.1626666666667 16.9813333333333 82.0106666666667 16.4426666666667 83.2C16.0213333333333 84.128 16.0106666666667 84.544 16.0106666666667 96C16.0106666666667 107.456 16.0213333333333 107.872 16.4426666666667 108.8C17.0293333333333 110.0906666666667 17.8133333333333 110.8853333333333 19.0933333333333 111.4933333333333L20.16 111.9946666666667L64 111.9946666666667L107.84 111.9946666666667L108.9066666666667 111.4933333333333C110.1866666666667 110.8853333333333 110.9706666666667 110.0906666666667 111.5573333333333 108.8C111.9786666666667 107.872 111.9893333333333 107.456 111.9893333333333 96C111.9893333333333 84.544 111.9786666666667 84.128 111.5573333333333 83.2C111.0186666666667 82.0106666666667 110.2293333333333 81.1626666666667 109.12 80.5813333333333C108.4426666666667 80.224 107.696 80.1013333333333 105.4933333333333 79.984C103.872 79.8986666666667 102.4053333333333 79.7066666666667 101.9733333333333 79.5253333333333C99.248 78.384 98.016 75.1306666666667 99.28 72.416C99.8133333333333 71.264 100.7733333333333 70.3306666666667 101.9733333333333 69.7813333333333C103.1786666666667 69.232 108.6026666666667 69.3386666666667 110.816 69.952C113.6746666666667 70.7466666666667 115.68 71.9306666666667 117.8773333333333 74.1226666666667C120.0533333333334 76.304 121.2266666666667 78.2773333333333 122.0693333333333 81.184C122.56 82.8693333333334 122.56 82.944 122.56 96C122.56 109.056 122.56 109.1306666666667 122.0693333333333 110.816C121.2266666666667 113.7226666666667 120.0533333333334 115.696 117.8773333333333 117.8773333333334C115.7386666666667 120.0106666666667 113.8026666666667 121.1786666666667 110.928 122.064L109.3333333333333 122.5546666666667L65.0666666666667 122.5813333333333C40.72 122.5973333333334 20.176 122.544 19.4133333333333 122.464M30.9333333333333 101.136C26.9013333333333 100.3093333333333 25.3813333333333 95.2106666666667 28.2933333333333 92.2933333333333C29.7706666666667 90.8213333333333 32.4 90.3413333333333 34.24 91.216C35.9946666666667 92.048 37.3333333333333 94.1173333333333 37.3333333333333 96C37.3333333333333 97.8453333333333 35.9893333333333 99.968 34.336 100.7306666666667C33.4133333333333 101.1573333333333 31.9093333333333 101.3333333333333 30.9333333333333 101.136M53.104 88.3733333333333C50.9706666666667 87.2906666666667 49.8346666666667 84.9493333333333 50.3466666666667 82.672C50.4693333333333 82.112 50.6666666666667 81.4826666666667 50.7733333333333 81.28C50.9386666666667 80.976 50.7413333333333 80.6826666666667 49.7546666666667 79.76C49.0826666666667 79.1306666666667 48.0906666666667 78.096 47.5573333333333 77.4666666666667L46.5813333333333 76.32L45.4346666666667 76.5653333333333C42.208 77.2586666666667 39.36 75.1253333333334 39.0933333333333 71.8133333333333C38.9173333333333 69.5893333333333 40.16 67.4773333333333 42.1333333333333 66.6506666666667L42.8053333333333 66.3733333333333L42.832 63.4773333333333L42.8533333333333 60.5813333333333L42.176 60.2986666666667C38.5653333333333 58.784 37.9626666666667 53.6426666666667 41.1146666666667 51.2693333333333C42.6293333333333 50.128 45.1093333333333 49.9093333333333 46.72 50.7733333333333C47.024 50.9386666666667 47.3173333333333 50.7413333333333 48.24 49.7546666666667C48.8693333333333 49.0826666666667 49.904 48.0906666666667 50.5386666666667 47.552L51.6853333333333 46.576L51.424 45.488C50.6453333333333 42.2346666666667 53.1786666666667 39.0293333333333 56.5173333333333 39.0453333333333C58.5226666666667 39.0506666666667 60.384 40.1813333333333 61.2106666666667 41.888L61.6533333333333 42.8053333333333L64.5386666666667 42.832L67.4186666666667 42.8533333333333L67.7013333333333 42.176C69.216 38.5653333333333 74.3573333333333 37.9626666666667 76.7306666666667 41.1146666666667C77.872 42.6293333333333 78.0906666666667 45.1093333333333 77.2266666666667 46.72C77.0613333333333 47.024 77.2586666666667 47.3173333333333 78.2453333333333 48.24C78.9173333333333 48.8693333333333 79.9093333333333 49.8986666666667 80.4426666666667 50.528L81.4133333333333 51.6746666666667L82.5866666666667 51.4293333333333C85.8186666666667 50.7573333333333 88.64 52.88 88.9066666666667 56.1866666666667C89.0826666666667 58.4106666666667 87.84 60.5226666666667 85.8666666666667 61.3493333333333L85.1946666666667 61.6266666666667L85.168 64.5226666666667L85.1466666666667 67.4186666666667L85.824 67.7013333333333C89.4346666666667 69.216 90.0373333333333 74.3573333333333 86.8853333333333 76.7306666666667C85.3706666666667 77.872 82.8906666666667 78.0906666666667 81.28 77.2266666666667C80.976 77.0613333333333 80.6826666666667 77.2586666666667 79.76 78.2453333333333C79.1306666666667 78.9173333333334 78.1013333333333 79.9093333333333 77.472 80.4426666666667L76.3253333333333 81.4133333333333L76.5706666666667 82.5866666666667C77.072 85.0133333333333 76.0053333333333 87.2693333333333 73.8293333333333 88.3733333333333C71.136 89.7386666666667 67.7813333333333 88.56 66.6453333333333 85.8506666666667L66.3733333333333 85.1946666666667L63.4773333333333 85.168L60.5813333333333 85.1466666666667L60.2986666666667 85.824C59.152 88.56 55.808 89.744 53.104 88.3733333333333M66.5386666666667 74.4426666666667C67.0506666666667 74.32 68 73.9733333333333 68.64 73.6693333333333C69.8666666666667 73.0933333333333 72.4906666666667 70.784 72.8906666666667 69.936C73.0186666666667 69.664 73.44 68.768 73.8293333333333 67.9466666666667C75.0186666666667 65.4346666666667 74.96 62.08 73.68 59.3706666666667C73.0933333333333 58.1333333333333 70.7893333333333 55.5093333333333 69.936 55.1093333333333C69.664 54.9813333333333 68.768 54.56 67.9466666666667 54.1706666666667C65.4346666666667 52.9813333333333 62.08 53.04 59.3706666666667 54.32C58.1333333333333 54.9066666666667 55.5093333333333 57.2106666666667 55.1093333333333 58.064C54.9813333333333 58.336 54.56 59.232 54.1706666666667 60.0533333333333C52.9813333333333 62.5653333333333 53.04 65.92 54.32 68.6293333333333C54.9013333333333 69.856 57.2 72.48 58.064 72.896C59.696 73.6906666666667 61.1893333333333 74.3466666666667 61.6533333333333 74.4693333333333C62.4906666666667 74.6986666666667 65.504 74.6773333333333 66.5386666666667 74.4426666666667M19.4133333333333 58.4746666666667C15.7706666666667 58.048 12.8586666666667 56.608 10.1226666666667 53.8773333333333C7.9466666666667 51.696 6.7733333333333 49.7226666666667 5.9306666666667 46.816C5.44 45.1306666666667 5.44 45.056 5.44 32C5.44 18.944 5.44 18.8693333333333 5.9306666666667 17.184C6.7733333333333 14.2773333333333 7.9466666666667 12.304 10.1226666666667 10.1226666666667C12.304 7.9466666666667 14.2773333333333 6.7733333333333 17.184 5.9306666666667L18.88 5.44L64 5.44L109.12 5.44L110.816 5.9306666666667C113.7226666666667 6.7733333333333 115.696 7.9466666666667 117.8773333333333 10.1226666666667C120.0533333333334 12.304 121.2266666666667 14.2773333333333 122.0693333333333 17.184C122.56 18.8693333333333 122.56 18.944 122.56 32C122.56 45.056 122.56 45.1306666666667 122.0693333333333 46.816C121.2266666666667 49.7226666666667 120.0533333333334 51.696 117.8773333333333 53.8773333333333C115.68 56.0693333333333 113.6746666666667 57.2533333333333 110.816 58.048C108.6026666666667 58.6613333333334 103.1786666666667 58.768 101.9733333333333 58.2186666666667C97.7333333333333 56.288 97.7333333333333 50.2506666666667 101.9733333333333 48.4746666666667C102.4053333333333 48.2933333333333 103.872 48.1013333333333 105.4933333333333 48.016C107.696 47.8986666666667 108.4426666666667 47.776 109.12 47.4186666666667C110.2293333333333 46.8373333333333 111.0186666666667 45.9893333333333 111.5573333333333 44.8C111.9786666666667 43.872 111.9893333333333 43.456 111.9893333333333 32C111.9893333333333 20.544 111.9786666666667 20.128 111.5573333333333 19.2C110.9706666666667 17.9093333333333 110.1866666666667 17.1146666666667 108.9066666666667 16.5066666666667L107.84 16.0053333333333L64 16.0053333333333L20.16 16.0053333333333L19.0933333333333 16.5066666666667C17.8133333333333 17.1146666666667 17.0293333333333 17.9093333333333 16.4426666666667 19.2C16.0213333333333 20.128 16.0106666666667 20.544 16.0106666666667 32C16.0106666666667 43.456 16.0213333333333 43.872 16.4426666666667 44.8C16.9813333333333 45.9893333333333 17.7706666666667 46.8373333333333 18.88 47.4186666666667C19.5573333333333 47.776 20.304 47.8986666666667 22.5066666666667 48.016C24.128 48.1013333333333 25.5946666666667 48.2933333333333 26.0266666666667 48.4746666666667C30.2613333333333 50.2506666666667 30.256 56.4106666666667 26.0266666666667 58.192C25.1573333333333 58.56 21.488 58.7146666666667 19.4133333333333 58.4746666666667M30.9333333333333 37.136C26.9013333333333 36.3093333333333 25.3813333333333 31.2106666666667 28.2933333333333 28.2933333333333C29.7706666666667 26.8213333333333 32.4 26.3413333333333 34.24 27.216C35.9946666666667 28.048 37.3333333333333 30.1173333333333 37.3333333333333 32C37.3333333333333 33.8453333333333 35.9893333333333 35.968 34.336 36.7306666666667C33.4133333333333 37.1573333333333 31.9093333333333 37.3333333333333 30.9333333333333 37.136" />
+    <glyph glyph-name="server-cog-1"
+      unicode="&#x73;&#x65;&#x72;&#x76;&#x65;&#x72;&#x2D;&#x63;&#x6F;&#x67;"
+      horiz-adv-x="128" d="M19.4133333333333 122.464C15.8186666666667 122.0746666666667 12.864 120.6133333333333 10.1226666666667 117.8773333333334C7.9466666666667 115.696 6.7733333333333 113.7226666666667 5.9306666666667 110.816C5.44 109.1306666666667 5.44 109.056 5.44 96C5.44 82.944 5.44 82.8693333333334 5.9306666666667 81.184C6.7733333333333 78.2773333333333 7.9466666666667 76.304 10.1226666666667 74.1226666666667C12.32 71.9306666666667 14.3253333333333 70.7466666666667 17.184 69.952C19.3973333333333 69.3386666666667 24.8213333333333 69.232 26.0266666666667 69.7813333333333C30.2666666666667 71.712 30.2666666666667 77.7493333333333 26.0266666666667 79.5253333333333C25.5946666666667 79.7066666666667 24.128 79.8986666666667 22.5066666666667 79.984C20.304 80.1013333333333 19.5573333333333 80.224 18.88 80.5813333333333C17.7706666666667 81.1626666666667 16.9813333333333 82.0106666666667 16.4426666666667 83.2C16.0213333333333 84.128 16.0106666666667 84.544 16.0106666666667 96C16.0106666666667 107.456 16.0213333333333 107.872 16.4426666666667 108.8C17.0293333333333 110.0906666666667 17.8133333333333 110.8853333333333 19.0933333333333 111.4933333333333L20.16 111.9946666666667L64 111.9946666666667L107.84 111.9946666666667L108.9066666666667 111.4933333333333C110.1866666666667 110.8853333333333 110.9706666666667 110.0906666666667 111.5573333333333 108.8C111.9786666666667 107.872 111.9893333333333 107.456 111.9893333333333 96C111.9893333333333 84.544 111.9786666666667 84.128 111.5573333333333 83.2C111.0186666666667 82.0106666666667 110.2293333333333 81.1626666666667 109.12 80.5813333333333C108.4426666666667 80.224 107.696 80.1013333333333 105.4933333333333 79.984C103.872 79.8986666666667 102.4053333333333 79.7066666666667 101.9733333333333 79.5253333333333C99.248 78.384 98.016 75.1306666666667 99.28 72.416C99.8133333333333 71.264 100.7733333333333 70.3306666666667 101.9733333333333 69.7813333333333C103.1786666666667 69.232 108.6026666666667 69.3386666666667 110.816 69.952C113.6746666666667 70.7466666666667 115.68 71.9306666666667 117.8773333333333 74.1226666666667C120.0533333333334 76.304 121.2266666666667 78.2773333333333 122.0693333333333 81.184C122.56 82.8693333333334 122.56 82.944 122.56 96C122.56 109.056 122.56 109.1306666666667 122.0693333333333 110.816C121.2266666666667 113.7226666666667 120.0533333333334 115.696 117.8773333333333 117.8773333333334C115.7386666666667 120.0106666666667 113.8026666666667 121.1786666666667 110.928 122.064L109.3333333333333 122.5546666666667L65.0666666666667 122.5813333333333C40.72 122.5973333333334 20.176 122.544 19.4133333333333 122.464M30.9333333333333 101.136C26.9013333333333 100.3093333333333 25.3813333333333 95.2106666666667 28.2933333333333 92.2933333333333C29.7706666666667 90.8213333333333 32.4 90.3413333333333 34.24 91.216C35.9946666666667 92.048 37.3333333333333 94.1173333333333 37.3333333333333 96C37.3333333333333 97.8453333333333 35.9893333333333 99.968 34.336 100.7306666666667C33.4133333333333 101.1573333333333 31.9093333333333 101.3333333333333 30.9333333333333 101.136M53.104 88.3733333333333C50.9706666666667 87.2906666666667 49.8346666666667 84.9493333333333 50.3466666666667 82.672C50.4693333333333 82.112 50.6666666666667 81.4826666666667 50.7733333333333 81.28C50.9386666666667 80.976 50.7413333333333 80.6826666666667 49.7546666666667 79.76C49.0826666666667 79.1306666666667 48.0906666666667 78.096 47.5573333333333 77.4666666666667L46.5813333333333 76.32L45.4346666666667 76.5653333333333C42.208 77.2586666666667 39.36 75.1253333333334 39.0933333333333 71.8133333333333C38.9173333333333 69.5893333333333 40.16 67.4773333333333 42.1333333333333 66.6506666666667L42.8053333333333 66.3733333333333L42.832 63.4773333333333L42.8533333333333 60.5813333333333L42.176 60.2986666666667C38.5653333333333 58.784 37.9626666666667 53.6426666666667 41.1146666666667 51.2693333333333C42.6293333333333 50.128 45.1093333333333 49.9093333333333 46.72 50.7733333333333C47.024 50.9386666666667 47.3173333333333 50.7413333333333 48.24 49.7546666666667C48.8693333333333 49.0826666666667 49.904 48.0906666666667 50.5386666666667 47.552L51.6853333333333 46.576L51.424 45.488C50.6453333333333 42.2346666666667 53.1786666666667 39.0293333333333 56.5173333333333 39.0453333333333C58.5226666666667 39.0506666666667 60.384 40.1813333333333 61.2106666666667 41.888L61.6533333333333 42.8053333333333L64.5386666666667 42.832L67.4186666666667 42.8533333333333L67.7013333333333 42.176C69.216 38.5653333333333 74.3573333333333 37.9626666666667 76.7306666666667 41.1146666666667C77.872 42.6293333333333 78.0906666666667 45.1093333333333 77.2266666666667 46.72C77.0613333333333 47.024 77.2586666666667 47.3173333333333 78.2453333333333 48.24C78.9173333333333 48.8693333333333 79.9093333333333 49.8986666666667 80.4426666666667 50.528L81.4133333333333 51.6746666666667L82.5866666666667 51.4293333333333C85.8186666666667 50.7573333333333 88.64 52.88 88.9066666666667 56.1866666666667C89.0826666666667 58.4106666666667 87.84 60.5226666666667 85.8666666666667 61.3493333333333L85.1946666666667 61.6266666666667L85.168 64.5226666666667L85.1466666666667 67.4186666666667L85.824 67.7013333333333C89.4346666666667 69.216 90.0373333333333 74.3573333333333 86.8853333333333 76.7306666666667C85.3706666666667 77.872 82.8906666666667 78.0906666666667 81.28 77.2266666666667C80.976 77.0613333333333 80.6826666666667 77.2586666666667 79.76 78.2453333333333C79.1306666666667 78.9173333333334 78.1013333333333 79.9093333333333 77.472 80.4426666666667L76.3253333333333 81.4133333333333L76.5706666666667 82.5866666666667C77.072 85.0133333333333 76.0053333333333 87.2693333333333 73.8293333333333 88.3733333333333C71.136 89.7386666666667 67.7813333333333 88.56 66.6453333333333 85.8506666666667L66.3733333333333 85.1946666666667L63.4773333333333 85.168L60.5813333333333 85.1466666666667L60.2986666666667 85.824C59.152 88.56 55.808 89.744 53.104 88.3733333333333M66.5386666666667 74.4426666666667C67.0506666666667 74.32 68 73.9733333333333 68.64 73.6693333333333C69.8666666666667 73.0933333333333 72.4906666666667 70.784 72.8906666666667 69.936C73.0186666666667 69.664 73.44 68.768 73.8293333333333 67.9466666666667C75.0186666666667 65.4346666666667 74.96 62.08 73.68 59.3706666666667C73.0933333333333 58.1333333333333 70.7893333333333 55.5093333333333 69.936 55.1093333333333C69.664 54.9813333333333 68.768 54.56 67.9466666666667 54.1706666666667C65.4346666666667 52.9813333333333 62.08 53.04 59.3706666666667 54.32C58.1333333333333 54.9066666666667 55.5093333333333 57.2106666666667 55.1093333333333 58.064C54.9813333333333 58.336 54.56 59.232 54.1706666666667 60.0533333333333C52.9813333333333 62.5653333333333 53.04 65.92 54.32 68.6293333333333C54.9013333333333 69.856 57.2 72.48 58.064 72.896C59.696 73.6906666666667 61.1893333333333 74.3466666666667 61.6533333333333 74.4693333333333C62.4906666666667 74.6986666666667 65.504 74.6773333333333 66.5386666666667 74.4426666666667M19.4133333333333 58.4746666666667C15.7706666666667 58.048 12.8586666666667 56.608 10.1226666666667 53.8773333333333C7.9466666666667 51.696 6.7733333333333 49.7226666666667 5.9306666666667 46.816C5.44 45.1306666666667 5.44 45.056 5.44 32C5.44 18.944 5.44 18.8693333333333 5.9306666666667 17.184C6.7733333333333 14.2773333333333 7.9466666666667 12.304 10.1226666666667 10.1226666666667C12.304 7.9466666666667 14.2773333333333 6.7733333333333 17.184 5.9306666666667L18.88 5.44L64 5.44L109.12 5.44L110.816 5.9306666666667C113.7226666666667 6.7733333333333 115.696 7.9466666666667 117.8773333333333 10.1226666666667C120.0533333333334 12.304 121.2266666666667 14.2773333333333 122.0693333333333 17.184C122.56 18.8693333333333 122.56 18.944 122.56 32C122.56 45.056 122.56 45.1306666666667 122.0693333333333 46.816C121.2266666666667 49.7226666666667 120.0533333333334 51.696 117.8773333333333 53.8773333333333C115.68 56.0693333333333 113.6746666666667 57.2533333333333 110.816 58.048C108.6026666666667 58.6613333333334 103.1786666666667 58.768 101.9733333333333 58.2186666666667C97.7333333333333 56.288 97.7333333333333 50.2506666666667 101.9733333333333 48.4746666666667C102.4053333333333 48.2933333333333 103.872 48.1013333333333 105.4933333333333 48.016C107.696 47.8986666666667 108.4426666666667 47.776 109.12 47.4186666666667C110.2293333333333 46.8373333333333 111.0186666666667 45.9893333333333 111.5573333333333 44.8C111.9786666666667 43.872 111.9893333333333 43.456 111.9893333333333 32C111.9893333333333 20.544 111.9786666666667 20.128 111.5573333333333 19.2C110.9706666666667 17.9093333333333 110.1866666666667 17.1146666666667 108.9066666666667 16.5066666666667L107.84 16.0053333333333L64 16.0053333333333L20.16 16.0053333333333L19.0933333333333 16.5066666666667C17.8133333333333 17.1146666666667 17.0293333333333 17.9093333333333 16.4426666666667 19.2C16.0213333333333 20.128 16.0106666666667 20.544 16.0106666666667 32C16.0106666666667 43.456 16.0213333333333 43.872 16.4426666666667 44.8C16.9813333333333 45.9893333333333 17.7706666666667 46.8373333333333 18.88 47.4186666666667C19.5573333333333 47.776 20.304 47.8986666666667 22.5066666666667 48.016C24.128 48.1013333333333 25.5946666666667 48.2933333333333 26.0266666666667 48.4746666666667C30.2613333333333 50.2506666666667 30.256 56.4106666666667 26.0266666666667 58.192C25.1573333333333 58.56 21.488 58.7146666666667 19.4133333333333 58.4746666666667M30.9333333333333 37.136C26.9013333333333 36.3093333333333 25.3813333333333 31.2106666666667 28.2933333333333 28.2933333333333C29.7706666666667 26.8213333333333 32.4 26.3413333333333 34.24 27.216C35.9946666666667 28.048 37.3333333333333 30.1173333333333 37.3333333333333 32C37.3333333333333 33.8453333333333 35.9893333333333 35.968 34.336 36.7306666666667C33.4133333333333 37.1573333333333 31.9093333333333 37.3333333333333 30.9333333333333 37.136" />
+    <glyph glyph-name="server"
       unicode="&#xF110;"
-      horiz-adv-x="128" d="M61.7546666666667 122.4426666666667C52.592 121.5466666666667 45.1466666666667 114.7733333333334 43.152 105.5306666666667C42.8053333333333 103.9306666666667 42.7733333333333 102.0426666666667 42.7733333333333 82.6666666666667C42.7733333333333 63.2906666666667 42.8053333333333 61.4026666666667 43.152 59.8026666666667C44.976 51.3333333333333 51.3386666666667 44.944 59.6853333333333 43.1893333333333C61.8666666666667 42.7306666666667 66.1333333333333 42.7306666666667 68.3146666666667 43.1893333333333C75.6906666666667 44.7413333333333 81.68 50.0373333333333 84.1173333333333 57.1733333333334C85.2373333333333 60.4426666666667 85.2266666666667 60.2293333333333 85.2266666666667 82.6666666666667C85.2266666666667 99.0506666666667 85.168 103.8986666666667 84.944 105.0666666666667C83.5093333333333 112.72 78.128 118.96 70.8266666666667 121.4506666666667C68.08 122.384 64.8053333333333 122.7466666666667 61.7546666666667 122.4426666666667M66.5386666666667 111.776C70.08 110.9546666666667 73.6213333333333 107.4133333333333 74.4426666666667 103.872C74.736 102.592 74.736 62.7413333333333 74.4426666666667 61.4613333333333C73.6213333333333 57.92 70.08 54.3786666666667 66.5386666666667 53.5573333333333C65.3333333333333 53.28 62.6666666666667 53.28 61.4613333333333 53.5573333333333C57.92 54.3786666666667 54.3786666666667 57.92 53.5573333333333 61.4613333333333C53.264 62.7413333333333 53.264 102.592 53.5573333333333 103.872C54.3626666666667 107.36 57.92 110.9546666666667 61.376 111.7653333333333C62.496 112.032 65.408 112.032 66.5386666666667 111.776M25.6 79.8026666666667C24.0373333333333 79.4826666666667 22.7253333333333 78.4586666666667 21.8986666666667 76.912C21.472 76.1066666666667 21.44 75.6853333333334 21.3706666666667 70.4053333333334C21.216 58.5226666666667 22.2773333333333 52.3573333333333 25.696 45.3706666666667C31.616 33.264 42.8586666666667 24.6666666666667 56.0373333333333 22.16L58.6346666666667 21.6693333333333L58.704 15.472C58.768 9.616 58.8 9.232 59.232 8.4213333333333C60.2773333333333 6.4693333333333 61.8773333333333 5.4826666666667 64 5.4826666666667C66.1226666666667 5.4826666666667 67.7226666666667 6.4693333333333 68.768 8.4213333333333C69.2 9.232 69.232 9.616 69.296 15.472L69.3653333333333 21.6693333333333L71.9626666666667 22.16C86.9173333333333 24.992 99.424 35.8613333333333 104.304 50.2666666666667C106.192 55.84 106.7626666666667 60.7946666666667 106.6293333333333 70.544C106.56 75.68 106.5226666666667 76.112 106.1013333333333 76.912C105.0613333333333 78.8586666666667 103.456 79.8506666666667 101.3333333333333 79.8506666666667C99.2106666666667 79.8506666666667 97.6053333333333 78.8586666666667 96.5706666666667 76.912C96.1333333333333 76.0906666666667 96.1066666666667 75.6746666666667 95.9733333333333 67.84C95.8933333333333 63.3226666666667 95.7333333333333 59.1466666666667 95.616 58.56C94.2133333333333 51.584 91.3546666666667 46.128 86.6133333333333 41.3866666666667C80.4746666666667 35.248 72.6613333333333 32.0053333333333 64 32.0053333333333C55.3386666666667 32.0053333333333 47.5253333333333 35.248 41.3866666666667 41.3866666666667C36.6453333333333 46.128 33.7866666666667 51.584 32.384 58.56C32.2666666666667 59.1466666666667 32.1066666666667 63.3226666666667 32.0266666666667 67.84C31.8933333333333 75.6746666666667 31.8666666666667 76.0906666666667 31.4293333333333 76.912C30.256 79.1146666666667 27.9146666666667 80.2773333333333 25.6 79.8026666666667" />
-    <glyph glyph-name="mic-1"
-      unicode="&#x6D;&#x69;&#x63;"
-      horiz-adv-x="128" d="M61.7546666666667 122.4426666666667C52.592 121.5466666666667 45.1466666666667 114.7733333333334 43.152 105.5306666666667C42.8053333333333 103.9306666666667 42.7733333333333 102.0426666666667 42.7733333333333 82.6666666666667C42.7733333333333 63.2906666666667 42.8053333333333 61.4026666666667 43.152 59.8026666666667C44.976 51.3333333333333 51.3386666666667 44.944 59.6853333333333 43.1893333333333C61.8666666666667 42.7306666666667 66.1333333333333 42.7306666666667 68.3146666666667 43.1893333333333C75.6906666666667 44.7413333333333 81.68 50.0373333333333 84.1173333333333 57.1733333333334C85.2373333333333 60.4426666666667 85.2266666666667 60.2293333333333 85.2266666666667 82.6666666666667C85.2266666666667 99.0506666666667 85.168 103.8986666666667 84.944 105.0666666666667C83.5093333333333 112.72 78.128 118.96 70.8266666666667 121.4506666666667C68.08 122.384 64.8053333333333 122.7466666666667 61.7546666666667 122.4426666666667M66.5386666666667 111.776C70.08 110.9546666666667 73.6213333333333 107.4133333333333 74.4426666666667 103.872C74.736 102.592 74.736 62.7413333333333 74.4426666666667 61.4613333333333C73.6213333333333 57.92 70.08 54.3786666666667 66.5386666666667 53.5573333333333C65.3333333333333 53.28 62.6666666666667 53.28 61.4613333333333 53.5573333333333C57.92 54.3786666666667 54.3786666666667 57.92 53.5573333333333 61.4613333333333C53.264 62.7413333333333 53.264 102.592 53.5573333333333 103.872C54.3626666666667 107.36 57.92 110.9546666666667 61.376 111.7653333333333C62.496 112.032 65.408 112.032 66.5386666666667 111.776M25.6 79.8026666666667C24.0373333333333 79.4826666666667 22.7253333333333 78.4586666666667 21.8986666666667 76.912C21.472 76.1066666666667 21.44 75.6853333333334 21.3706666666667 70.4053333333334C21.216 58.5226666666667 22.2773333333333 52.3573333333333 25.696 45.3706666666667C31.616 33.264 42.8586666666667 24.6666666666667 56.0373333333333 22.16L58.6346666666667 21.6693333333333L58.704 15.472C58.768 9.616 58.8 9.232 59.232 8.4213333333333C60.2773333333333 6.4693333333333 61.8773333333333 5.4826666666667 64 5.4826666666667C66.1226666666667 5.4826666666667 67.7226666666667 6.4693333333333 68.768 8.4213333333333C69.2 9.232 69.232 9.616 69.296 15.472L69.3653333333333 21.6693333333333L71.9626666666667 22.16C86.9173333333333 24.992 99.424 35.8613333333333 104.304 50.2666666666667C106.192 55.84 106.7626666666667 60.7946666666667 106.6293333333333 70.544C106.56 75.68 106.5226666666667 76.112 106.1013333333333 76.912C105.0613333333333 78.8586666666667 103.456 79.8506666666667 101.3333333333333 79.8506666666667C99.2106666666667 79.8506666666667 97.6053333333333 78.8586666666667 96.5706666666667 76.912C96.1333333333333 76.0906666666667 96.1066666666667 75.6746666666667 95.9733333333333 67.84C95.8933333333333 63.3226666666667 95.7333333333333 59.1466666666667 95.616 58.56C94.2133333333333 51.584 91.3546666666667 46.128 86.6133333333333 41.3866666666667C80.4746666666667 35.248 72.6613333333333 32.0053333333333 64 32.0053333333333C55.3386666666667 32.0053333333333 47.5253333333333 35.248 41.3866666666667 41.3866666666667C36.6453333333333 46.128 33.7866666666667 51.584 32.384 58.56C32.2666666666667 59.1466666666667 32.1066666666667 63.3226666666667 32.0266666666667 67.84C31.8933333333333 75.6746666666667 31.8666666666667 76.0906666666667 31.4293333333333 76.912C30.256 79.1146666666667 27.9146666666667 80.2773333333333 25.6 79.8026666666667" />
-    <glyph glyph-name="square-power"
+      horiz-adv-x="128" d="M19.4133333333333 122.464C15.8186666666667 122.0746666666667 12.864 120.6133333333333 10.1226666666667 117.8773333333334C7.9466666666667 115.696 6.7733333333333 113.7226666666667 5.9306666666667 110.816C5.44 109.1306666666667 5.44 109.056 5.44 96C5.44 82.944 5.44 82.8693333333334 5.9306666666667 81.184C6.7733333333333 78.2773333333333 7.9466666666667 76.304 10.1226666666667 74.1226666666667C12.304 71.9466666666667 14.2773333333333 70.7733333333333 17.184 69.9306666666667L18.88 69.44L64 69.44L109.12 69.44L110.816 69.9306666666667C113.7226666666667 70.7733333333333 115.696 71.9466666666667 117.8773333333333 74.1226666666667C120.0533333333334 76.304 121.2266666666667 78.2773333333333 122.0693333333333 81.184C122.56 82.8693333333334 122.56 82.944 122.56 96C122.56 109.056 122.56 109.1306666666667 122.0693333333333 110.816C121.2266666666667 113.7226666666667 120.0533333333334 115.696 117.8773333333333 117.8773333333334C115.7386666666667 120.0106666666667 113.8026666666667 121.1786666666667 110.928 122.064L109.3333333333333 122.5546666666667L65.0666666666667 122.5813333333333C40.72 122.5973333333334 20.176 122.544 19.4133333333333 122.464M108.9066666666667 111.4933333333333C110.1866666666667 110.8853333333333 110.9706666666667 110.0906666666667 111.5573333333333 108.8C111.9786666666667 107.872 111.9893333333333 107.456 111.9893333333333 96C111.9893333333333 84.544 111.9786666666667 84.128 111.5573333333333 83.2C110.9706666666667 81.9093333333333 110.1866666666667 81.1146666666667 108.9066666666667 80.5066666666667L107.84 80.0053333333333L64 80.0053333333333L20.16 80.0053333333333L19.0933333333333 80.5066666666667C17.8133333333333 81.1146666666667 17.0293333333333 81.9093333333333 16.4426666666667 83.2C16.0213333333333 84.128 16.0106666666667 84.544 16.0106666666667 96C16.0106666666667 107.456 16.0213333333333 107.872 16.4426666666667 108.8C17.0293333333333 110.0906666666667 17.8133333333333 110.8853333333333 19.0933333333333 111.4933333333333L20.16 111.9946666666667L64 111.9946666666667L107.84 111.9946666666667L108.9066666666667 111.4933333333333M30.9333333333333 101.136C26.9013333333333 100.3093333333333 25.3813333333333 95.2106666666667 28.2933333333333 92.2933333333333C29.7706666666667 90.8213333333333 32.4 90.3413333333333 34.24 91.216C35.9946666666667 92.048 37.3333333333333 94.1173333333333 37.3333333333333 96C37.3333333333333 97.8453333333333 35.9893333333333 99.968 34.336 100.7306666666667C33.4133333333333 101.1573333333333 31.9093333333333 101.3333333333333 30.9333333333333 101.136M19.4133333333333 58.464C15.8186666666667 58.0746666666667 12.864 56.6133333333334 10.1226666666667 53.8773333333333C7.9466666666667 51.696 6.7733333333333 49.7226666666667 5.9306666666667 46.816C5.44 45.1306666666667 5.44 45.056 5.44 32C5.44 18.944 5.44 18.8693333333333 5.9306666666667 17.184C6.7733333333333 14.2773333333333 7.9466666666667 12.304 10.1226666666667 10.1226666666667C12.304 7.9466666666667 14.2773333333333 6.7733333333333 17.184 5.9306666666667L18.88 5.44L64 5.44L109.12 5.44L110.816 5.9306666666667C113.7226666666667 6.7733333333333 115.696 7.9466666666667 117.8773333333333 10.1226666666667C120.0533333333334 12.304 121.2266666666667 14.2773333333333 122.0693333333333 17.184C122.56 18.8693333333333 122.56 18.944 122.56 32C122.56 45.056 122.56 45.1306666666667 122.0693333333333 46.816C121.2266666666667 49.7226666666667 120.0533333333334 51.696 117.8773333333333 53.8773333333333C115.7386666666667 56.0106666666667 113.8026666666667 57.1786666666667 110.928 58.064L109.3333333333333 58.5546666666667L65.0666666666667 58.5813333333333C40.72 58.5973333333333 20.176 58.544 19.4133333333333 58.464M108.9066666666667 47.4933333333333C110.1866666666667 46.8853333333333 110.9706666666667 46.0906666666667 111.5573333333333 44.8C111.9786666666667 43.872 111.9893333333333 43.456 111.9893333333333 32C111.9893333333333 20.544 111.9786666666667 20.128 111.5573333333333 19.2C110.9706666666667 17.9093333333333 110.1866666666667 17.1146666666667 108.9066666666667 16.5066666666667L107.84 16.0053333333333L64 16.0053333333333L20.16 16.0053333333333L19.0933333333333 16.5066666666667C17.8133333333333 17.1146666666667 17.0293333333333 17.9093333333333 16.4426666666667 19.2C16.0213333333333 20.128 16.0106666666667 20.544 16.0106666666667 32C16.0106666666667 43.456 16.0213333333333 43.872 16.4426666666667 44.8C17.0293333333333 46.0906666666667 17.8133333333333 46.8853333333333 19.0933333333333 47.4933333333333L20.16 47.9946666666667L64 47.9946666666667L107.84 47.9946666666667L108.9066666666667 47.4933333333333M30.9333333333333 37.136C26.9013333333333 36.3093333333333 25.3813333333333 31.2106666666667 28.2933333333333 28.2933333333333C29.7706666666667 26.8213333333333 32.4 26.3413333333333 34.24 27.216C35.9946666666667 28.048 37.3333333333333 30.1173333333333 37.3333333333333 32C37.3333333333333 33.8453333333333 35.9893333333333 35.968 34.336 36.7306666666667C33.4133333333333 37.1573333333333 31.9093333333333 37.3333333333333 30.9333333333333 37.136" />
+    <glyph glyph-name="server-1"
+      unicode="&#x73;&#x65;&#x72;&#x76;&#x65;&#x72;"
+      horiz-adv-x="128" d="M19.4133333333333 122.464C15.8186666666667 122.0746666666667 12.864 120.6133333333333 10.1226666666667 117.8773333333334C7.9466666666667 115.696 6.7733333333333 113.7226666666667 5.9306666666667 110.816C5.44 109.1306666666667 5.44 109.056 5.44 96C5.44 82.944 5.44 82.8693333333334 5.9306666666667 81.184C6.7733333333333 78.2773333333333 7.9466666666667 76.304 10.1226666666667 74.1226666666667C12.304 71.9466666666667 14.2773333333333 70.7733333333333 17.184 69.9306666666667L18.88 69.44L64 69.44L109.12 69.44L110.816 69.9306666666667C113.7226666666667 70.7733333333333 115.696 71.9466666666667 117.8773333333333 74.1226666666667C120.0533333333334 76.304 121.2266666666667 78.2773333333333 122.0693333333333 81.184C122.56 82.8693333333334 122.56 82.944 122.56 96C122.56 109.056 122.56 109.1306666666667 122.0693333333333 110.816C121.2266666666667 113.7226666666667 120.0533333333334 115.696 117.8773333333333 117.8773333333334C115.7386666666667 120.0106666666667 113.8026666666667 121.1786666666667 110.928 122.064L109.3333333333333 122.5546666666667L65.0666666666667 122.5813333333333C40.72 122.5973333333334 20.176 122.544 19.4133333333333 122.464M108.9066666666667 111.4933333333333C110.1866666666667 110.8853333333333 110.9706666666667 110.0906666666667 111.5573333333333 108.8C111.9786666666667 107.872 111.9893333333333 107.456 111.9893333333333 96C111.9893333333333 84.544 111.9786666666667 84.128 111.5573333333333 83.2C110.9706666666667 81.9093333333333 110.1866666666667 81.1146666666667 108.9066666666667 80.5066666666667L107.84 80.0053333333333L64 80.0053333333333L20.16 80.0053333333333L19.0933333333333 80.5066666666667C17.8133333333333 81.1146666666667 17.0293333333333 81.9093333333333 16.4426666666667 83.2C16.0213333333333 84.128 16.0106666666667 84.544 16.0106666666667 96C16.0106666666667 107.456 16.0213333333333 107.872 16.4426666666667 108.8C17.0293333333333 110.0906666666667 17.8133333333333 110.8853333333333 19.0933333333333 111.4933333333333L20.16 111.9946666666667L64 111.9946666666667L107.84 111.9946666666667L108.9066666666667 111.4933333333333M30.9333333333333 101.136C26.9013333333333 100.3093333333333 25.3813333333333 95.2106666666667 28.2933333333333 92.2933333333333C29.7706666666667 90.8213333333333 32.4 90.3413333333333 34.24 91.216C35.9946666666667 92.048 37.3333333333333 94.1173333333333 37.3333333333333 96C37.3333333333333 97.8453333333333 35.9893333333333 99.968 34.336 100.7306666666667C33.4133333333333 101.1573333333333 31.9093333333333 101.3333333333333 30.9333333333333 101.136M19.4133333333333 58.464C15.8186666666667 58.0746666666667 12.864 56.6133333333334 10.1226666666667 53.8773333333333C7.9466666666667 51.696 6.7733333333333 49.7226666666667 5.9306666666667 46.816C5.44 45.1306666666667 5.44 45.056 5.44 32C5.44 18.944 5.44 18.8693333333333 5.9306666666667 17.184C6.7733333333333 14.2773333333333 7.9466666666667 12.304 10.1226666666667 10.1226666666667C12.304 7.9466666666667 14.2773333333333 6.7733333333333 17.184 5.9306666666667L18.88 5.44L64 5.44L109.12 5.44L110.816 5.9306666666667C113.7226666666667 6.7733333333333 115.696 7.9466666666667 117.8773333333333 10.1226666666667C120.0533333333334 12.304 121.2266666666667 14.2773333333333 122.0693333333333 17.184C122.56 18.8693333333333 122.56 18.944 122.56 32C122.56 45.056 122.56 45.1306666666667 122.0693333333333 46.816C121.2266666666667 49.7226666666667 120.0533333333334 51.696 117.8773333333333 53.8773333333333C115.7386666666667 56.0106666666667 113.8026666666667 57.1786666666667 110.928 58.064L109.3333333333333 58.5546666666667L65.0666666666667 58.5813333333333C40.72 58.5973333333333 20.176 58.544 19.4133333333333 58.464M108.9066666666667 47.4933333333333C110.1866666666667 46.8853333333333 110.9706666666667 46.0906666666667 111.5573333333333 44.8C111.9786666666667 43.872 111.9893333333333 43.456 111.9893333333333 32C111.9893333333333 20.544 111.9786666666667 20.128 111.5573333333333 19.2C110.9706666666667 17.9093333333333 110.1866666666667 17.1146666666667 108.9066666666667 16.5066666666667L107.84 16.0053333333333L64 16.0053333333333L20.16 16.0053333333333L19.0933333333333 16.5066666666667C17.8133333333333 17.1146666666667 17.0293333333333 17.9093333333333 16.4426666666667 19.2C16.0213333333333 20.128 16.0106666666667 20.544 16.0106666666667 32C16.0106666666667 43.456 16.0213333333333 43.872 16.4426666666667 44.8C17.0293333333333 46.0906666666667 17.8133333333333 46.8853333333333 19.0933333333333 47.4933333333333L20.16 47.9946666666667L64 47.9946666666667L107.84 47.9946666666667L108.9066666666667 47.4933333333333M30.9333333333333 37.136C26.9013333333333 36.3093333333333 25.3813333333333 31.2106666666667 28.2933333333333 28.2933333333333C29.7706666666667 26.8213333333333 32.4 26.3413333333333 34.24 27.216C35.9946666666667 28.048 37.3333333333333 30.1173333333333 37.3333333333333 32C37.3333333333333 33.8453333333333 35.9893333333333 35.968 34.336 36.7306666666667C33.4133333333333 37.1573333333333 31.9093333333333 37.3333333333333 30.9333333333333 37.136" />
+    <glyph glyph-name="arrow-right"
       unicode="&#xF111;"
-      horiz-adv-x="128" d="M24.7466666666667 117.1306666666667C21.152 116.7413333333333 18.1973333333333 115.28 15.456 112.544C13.28 110.3626666666667 12.1066666666667 108.3893333333333 11.264 105.4826666666667L10.7733333333333 103.7866666666667L10.7733333333333 64L10.7733333333333 24.2133333333333L11.264 22.5173333333333C12.1066666666667 19.6106666666667 13.28 17.6373333333333 15.456 15.456C17.6373333333333 13.28 19.6106666666667 12.1066666666667 22.5173333333333 11.264L24.2133333333333 10.7733333333333L64 10.7733333333333L103.7866666666667 10.7733333333333L105.4826666666667 11.264C108.3893333333333 12.1066666666667 110.3626666666667 13.28 112.544 15.456C114.72 17.6373333333333 115.8933333333333 19.6106666666667 116.736 22.5173333333333L117.2266666666667 24.2133333333333L117.2266666666667 64L117.2266666666667 103.7866666666667L116.736 105.4826666666667C115.8933333333333 108.3893333333333 114.72 110.3626666666667 112.544 112.544C110.4053333333333 114.6773333333333 108.4693333333333 115.8453333333333 105.5946666666667 116.7306666666667L104 117.2213333333333L65.0666666666667 117.248C43.6533333333333 117.264 25.5093333333333 117.2106666666667 24.7466666666667 117.1306666666667M103.5733333333333 106.16C104.8533333333333 105.552 105.6373333333333 104.7573333333333 106.224 103.4666666666667C106.656 102.512 106.656 102.2826666666667 106.656 64C106.656 25.7173333333333 106.656 25.488 106.224 24.5333333333333C105.6373333333333 23.2426666666667 104.8533333333333 22.448 103.5733333333333 21.84L102.5066666666667 21.3386666666667L64 21.3386666666667C25.7173333333333 21.344 25.488 21.344 24.5333333333333 21.776C23.2426666666667 22.3626666666667 22.448 23.1466666666667 21.84 24.4266666666667L21.3386666666667 25.4933333333333L21.3386666666667 64C21.344 102.2826666666667 21.344 102.512 21.776 103.4666666666667C22.3626666666667 104.7573333333333 23.1466666666667 105.552 24.4266666666667 106.16L25.4933333333333 106.6613333333333L64 106.6613333333333L102.5066666666667 106.6613333333333L103.5733333333333 106.16M62.9333333333333 95.8026666666667C61.3706666666667 95.4826666666667 60.064 94.4586666666667 59.232 92.912C58.7733333333333 92.0586666666667 58.7733333333333 91.9893333333333 58.7733333333333 77.3333333333333C58.7733333333333 62.6773333333333 58.7733333333333 62.608 59.232 61.7546666666667C60.2773333333333 59.8026666666667 61.8773333333333 58.816 64 58.816C66.1226666666667 58.816 67.7226666666667 59.8026666666667 68.768 61.7546666666667C69.2266666666667 62.608 69.2266666666667 62.6773333333333 69.2266666666667 77.3333333333333C69.2266666666667 91.9893333333333 69.2266666666667 92.0586666666667 68.768 92.912C67.584 95.12 65.248 96.2773333333333 62.9333333333333 95.8026666666667M41.216 85.0293333333333C39.824 84.5813333333333 38.9653333333333 83.8933333333334 38 82.464C36.0106666666667 79.52 34.1813333333333 75.0346666666667 33.3386666666667 71.04C32.7946666666667 68.432 32.7946666666667 60.8213333333333 33.3493333333333 58.24C34.7146666666667 51.84 37.728 46.2933333333333 42.3306666666667 41.6906666666667C46.8853333333333 37.136 52.2826666666667 34.1333333333333 58.24 32.848C65.088 31.36 71.744 32.1226666666667 78.0693333333333 35.1146666666667C81.4346666666667 36.704 84.0853333333333 38.608 86.944 41.472C92.16 46.704 95.104 52.7786666666667 95.9946666666667 60.1546666666667C96.7093333333333 66.0426666666667 95.488 72.8 92.7253333333333 78.2293333333333C92.032 79.5893333333333 89.792 82.944 89.0826666666667 83.68C87.1306666666667 85.7066666666667 83.7546666666667 85.7333333333333 81.6533333333333 83.7386666666667C80.656 82.7893333333333 80.1493333333333 81.5466666666667 80.144 80C80.1333333333333 78.464 80.3573333333333 77.9093333333333 81.8186666666667 75.84C87.5573333333333 67.7173333333333 86.7626666666667 56.5333333333333 79.9306666666667 49.344C74.3253333333333 43.44 66.3893333333333 41.264 58.88 43.568C50.928 46.0053333333333 44.7253333333333 53.2693333333333 43.5306666666667 61.5466666666667C42.7946666666667 66.6506666666667 43.7813333333333 71.408 46.5973333333333 76.3466666666667C47.7386666666667 78.3413333333333 47.84 78.6293333333333 47.8506666666667 79.8453333333333C47.8773333333333 83.4826666666667 44.5226666666667 86.1013333333333 41.216 85.0293333333333" />
-    <glyph glyph-name="square-power-1"
-      unicode="&#x73;&#x71;&#x75;&#x61;&#x72;&#x65;&#x2D;&#x70;&#x6F;&#x77;&#x65;&#x72;"
-      horiz-adv-x="128" d="M24.7466666666667 117.1306666666667C21.152 116.7413333333333 18.1973333333333 115.28 15.456 112.544C13.28 110.3626666666667 12.1066666666667 108.3893333333333 11.264 105.4826666666667L10.7733333333333 103.7866666666667L10.7733333333333 64L10.7733333333333 24.2133333333333L11.264 22.5173333333333C12.1066666666667 19.6106666666667 13.28 17.6373333333333 15.456 15.456C17.6373333333333 13.28 19.6106666666667 12.1066666666667 22.5173333333333 11.264L24.2133333333333 10.7733333333333L64 10.7733333333333L103.7866666666667 10.7733333333333L105.4826666666667 11.264C108.3893333333333 12.1066666666667 110.3626666666667 13.28 112.544 15.456C114.72 17.6373333333333 115.8933333333333 19.6106666666667 116.736 22.5173333333333L117.2266666666667 24.2133333333333L117.2266666666667 64L117.2266666666667 103.7866666666667L116.736 105.4826666666667C115.8933333333333 108.3893333333333 114.72 110.3626666666667 112.544 112.544C110.4053333333333 114.6773333333333 108.4693333333333 115.8453333333333 105.5946666666667 116.7306666666667L104 117.2213333333333L65.0666666666667 117.248C43.6533333333333 117.264 25.5093333333333 117.2106666666667 24.7466666666667 117.1306666666667M103.5733333333333 106.16C104.8533333333333 105.552 105.6373333333333 104.7573333333333 106.224 103.4666666666667C106.656 102.512 106.656 102.2826666666667 106.656 64C106.656 25.7173333333333 106.656 25.488 106.224 24.5333333333333C105.6373333333333 23.2426666666667 104.8533333333333 22.448 103.5733333333333 21.84L102.5066666666667 21.3386666666667L64 21.3386666666667C25.7173333333333 21.344 25.488 21.344 24.5333333333333 21.776C23.2426666666667 22.3626666666667 22.448 23.1466666666667 21.84 24.4266666666667L21.3386666666667 25.4933333333333L21.3386666666667 64C21.344 102.2826666666667 21.344 102.512 21.776 103.4666666666667C22.3626666666667 104.7573333333333 23.1466666666667 105.552 24.4266666666667 106.16L25.4933333333333 106.6613333333333L64 106.6613333333333L102.5066666666667 106.6613333333333L103.5733333333333 106.16M62.9333333333333 95.8026666666667C61.3706666666667 95.4826666666667 60.064 94.4586666666667 59.232 92.912C58.7733333333333 92.0586666666667 58.7733333333333 91.9893333333333 58.7733333333333 77.3333333333333C58.7733333333333 62.6773333333333 58.7733333333333 62.608 59.232 61.7546666666667C60.2773333333333 59.8026666666667 61.8773333333333 58.816 64 58.816C66.1226666666667 58.816 67.7226666666667 59.8026666666667 68.768 61.7546666666667C69.2266666666667 62.608 69.2266666666667 62.6773333333333 69.2266666666667 77.3333333333333C69.2266666666667 91.9893333333333 69.2266666666667 92.0586666666667 68.768 92.912C67.584 95.12 65.248 96.2773333333333 62.9333333333333 95.8026666666667M41.216 85.0293333333333C39.824 84.5813333333333 38.9653333333333 83.8933333333334 38 82.464C36.0106666666667 79.52 34.1813333333333 75.0346666666667 33.3386666666667 71.04C32.7946666666667 68.432 32.7946666666667 60.8213333333333 33.3493333333333 58.24C34.7146666666667 51.84 37.728 46.2933333333333 42.3306666666667 41.6906666666667C46.8853333333333 37.136 52.2826666666667 34.1333333333333 58.24 32.848C65.088 31.36 71.744 32.1226666666667 78.0693333333333 35.1146666666667C81.4346666666667 36.704 84.0853333333333 38.608 86.944 41.472C92.16 46.704 95.104 52.7786666666667 95.9946666666667 60.1546666666667C96.7093333333333 66.0426666666667 95.488 72.8 92.7253333333333 78.2293333333333C92.032 79.5893333333333 89.792 82.944 89.0826666666667 83.68C87.1306666666667 85.7066666666667 83.7546666666667 85.7333333333333 81.6533333333333 83.7386666666667C80.656 82.7893333333333 80.1493333333333 81.5466666666667 80.144 80C80.1333333333333 78.464 80.3573333333333 77.9093333333333 81.8186666666667 75.84C87.5573333333333 67.7173333333333 86.7626666666667 56.5333333333333 79.9306666666667 49.344C74.3253333333333 43.44 66.3893333333333 41.264 58.88 43.568C50.928 46.0053333333333 44.7253333333333 53.2693333333333 43.5306666666667 61.5466666666667C42.7946666666667 66.6506666666667 43.7813333333333 71.408 46.5973333333333 76.3466666666667C47.7386666666667 78.3413333333333 47.84 78.6293333333333 47.8506666666667 79.8453333333333C47.8773333333333 83.4826666666667 44.5226666666667 86.1013333333333 41.216 85.0293333333333" />
-    <glyph glyph-name="circle-check-big"
+      horiz-adv-x="128" d="M61.9573333333333 106.1493333333333C60.944 105.712 59.7066666666667 104.5226666666667 59.28 103.5733333333333C58.8053333333333 102.528 58.7573333333333 100.336 59.184 99.312C59.5733333333333 98.3786666666667 62.064 95.792 76.544 81.2586666666667L88.3626666666667 69.3973333333333L56.7786666666667 69.2853333333333L25.1946666666667 69.1733333333334L24.2773333333333 68.6346666666667C22.3573333333333 67.4986666666667 21.5466666666667 66.128 21.5466666666667 64C21.5466666666667 61.7973333333333 22.5386666666667 60.224 24.5813333333333 59.1786666666667L25.584 58.6666666666667L57.008 58.6666666666667L88.4266666666667 58.6666666666667L76.4693333333333 46.6666666666667C61.8613333333333 32.0106666666667 59.5786666666667 29.6266666666667 59.1626666666667 28.6346666666667C58.7413333333333 27.632 58.752 25.712 59.184 24.6986666666667C59.6746666666667 23.5413333333333 60.7786666666667 22.384 61.84 21.9146666666667C62.976 21.4133333333333 64.88 21.36 65.9306666666667 21.808C67.728 22.5706666666667 105.4186666666667 60.224 106.16 62.0053333333333C106.5386666666667 62.9066666666667 106.5386666666667 65.0933333333333 106.1653333333333 65.9893333333333C105.7013333333333 67.0986666666667 87.136 86.0053333333333 73.3386666666667 99.424C67.9786666666667 104.6346666666667 66.4 106.0533333333333 65.7653333333333 106.2293333333333C64.6613333333333 106.5333333333333 62.7466666666667 106.496 61.9573333333333 106.1493333333333" />
+    <glyph glyph-name="arrow-right-1"
+      unicode="&#x61;&#x72;&#x72;&#x6F;&#x77;&#x2D;&#x72;&#x69;&#x67;&#x68;&#x74;"
+      horiz-adv-x="128" d="M61.9573333333333 106.1493333333333C60.944 105.712 59.7066666666667 104.5226666666667 59.28 103.5733333333333C58.8053333333333 102.528 58.7573333333333 100.336 59.184 99.312C59.5733333333333 98.3786666666667 62.064 95.792 76.544 81.2586666666667L88.3626666666667 69.3973333333333L56.7786666666667 69.2853333333333L25.1946666666667 69.1733333333334L24.2773333333333 68.6346666666667C22.3573333333333 67.4986666666667 21.5466666666667 66.128 21.5466666666667 64C21.5466666666667 61.7973333333333 22.5386666666667 60.224 24.5813333333333 59.1786666666667L25.584 58.6666666666667L57.008 58.6666666666667L88.4266666666667 58.6666666666667L76.4693333333333 46.6666666666667C61.8613333333333 32.0106666666667 59.5786666666667 29.6266666666667 59.1626666666667 28.6346666666667C58.7413333333333 27.632 58.752 25.712 59.184 24.6986666666667C59.6746666666667 23.5413333333333 60.7786666666667 22.384 61.84 21.9146666666667C62.976 21.4133333333333 64.88 21.36 65.9306666666667 21.808C67.728 22.5706666666667 105.4186666666667 60.224 106.16 62.0053333333333C106.5386666666667 62.9066666666667 106.5386666666667 65.0933333333333 106.1653333333333 65.9893333333333C105.7013333333333 67.0986666666667 87.136 86.0053333333333 73.3386666666667 99.424C67.9786666666667 104.6346666666667 66.4 106.0533333333333 65.7653333333333 106.2293333333333C64.6613333333333 106.5333333333333 62.7466666666667 106.496 61.9573333333333 106.1493333333333" />
+    <glyph glyph-name="message-circle-question"
       unicode="&#xF112;"
-      horiz-adv-x="128" d="M60.576 122.432C50.5866666666667 121.936 40.1173333333333 118.432 31.36 112.672C25.4773333333333 108.8 19.1253333333333 102.368 14.912 96.016C10.6506666666667 89.6 7.3333333333333 80.8586666666667 6.0746666666667 72.7466666666667C5.6106666666667 69.744 5.424 61.84 5.7386666666667 58.56C7.056 44.768 12.8533333333333 32.3893333333333 22.512 22.7253333333333C30.192 15.04 39.568 9.7546666666667 50.1333333333333 7.1573333333333C55.28 5.8933333333333 57.4506666666667 5.6586666666667 64 5.6586666666667C70.5493333333333 5.6586666666667 72.72 5.8933333333333 77.8666666666667 7.1573333333333C85.4773333333333 9.0293333333333 92.624 12.352 98.5706666666667 16.7733333333333C101.472 18.9386666666667 102.2026666666667 19.5733333333334 105.1413333333333 22.4693333333333C112.304 29.536 117.1946666666667 37.68 120.1226666666667 47.392C121.808 52.992 122.4266666666667 57.568 122.4853333333333 64.88C122.5333333333333 71.0506666666667 122.4746666666667 71.328 120.7146666666667 72.832C118.784 74.4853333333333 115.7333333333333 74.464 113.872 72.784C112.2933333333333 71.3653333333333 112.1813333333333 70.864 111.9573333333333 64.3306666666667C111.744 57.936 111.3386666666667 55.0933333333333 109.968 50.3306666666667C105.7813333333333 35.7866666666667 94.272 23.7386666666667 79.792 18.7466666666667C73.9146666666667 16.72 70.496 16.1386666666667 64.32 16.1226666666667C59.072 16.1066666666667 57.3386666666667 16.2986666666667 52.7466666666667 17.408C40.896 20.2773333333333 30.8106666666667 27.344 24.0053333333333 37.5466666666667C14.6506666666667 51.5733333333333 13.4506666666667 69.888 20.9013333333333 85.0666666666667C27.216 97.9253333333333 38.752 107.184 52.8586666666667 110.7146666666667C58.992 112.2506666666667 67.216 112.384 73.6693333333333 111.0453333333333C75.8773333333333 110.5866666666667 79.3813333333333 109.5093333333333 83.4133333333333 108.0533333333333C85.1946666666667 107.408 86.6133333333333 107.408 87.9626666666667 108.048C90.9653333333333 109.472 91.8453333333333 113.6586666666667 89.6533333333333 116.0853333333334C87.4293333333333 118.5493333333333 78.2453333333333 121.424 70.08 122.2133333333334C66.7626666666667 122.5333333333333 63.9146666666667 122.6026666666667 60.576 122.432M115.2266666666667 111.456C114.3626666666667 111.0826666666667 110.4533333333333 107.2533333333333 84.1173333333333 80.9813333333333L64.0266666666667 60.9333333333333L57.872 67.0026666666667C54.4853333333333 70.336 51.3013333333333 73.3493333333333 50.8 73.696C49.0933333333333 74.864 46.2666666666667 74.6666666666667 44.624 73.2586666666667C43.0186666666667 71.888 42.3626666666667 69.2746666666667 43.152 67.392C43.8826666666667 65.6373333333334 60.2613333333333 49.232 62.0106666666667 48.5066666666667C62.9066666666667 48.128 65.0933333333333 48.128 65.9893333333333 48.5013333333333C67.7333333333333 49.232 121.4346666666667 102.9333333333333 122.1653333333333 104.6773333333333C122.5546666666667 105.6106666666667 122.528 107.776 122.1226666666667 108.752C121.3546666666667 110.592 119.4346666666667 111.792 117.2853333333333 111.776C116.5493333333333 111.776 115.6213333333333 111.6266666666667 115.2266666666667 111.456" />
-    <glyph glyph-name="circle-check-big-1"
-      unicode="&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x63;&#x68;&#x65;&#x63;&#x6B;&#x2D;&#x62;&#x69;&#x67;"
-      horiz-adv-x="128" d="M60.576 122.432C50.5866666666667 121.936 40.1173333333333 118.432 31.36 112.672C25.4773333333333 108.8 19.1253333333333 102.368 14.912 96.016C10.6506666666667 89.6 7.3333333333333 80.8586666666667 6.0746666666667 72.7466666666667C5.6106666666667 69.744 5.424 61.84 5.7386666666667 58.56C7.056 44.768 12.8533333333333 32.3893333333333 22.512 22.7253333333333C30.192 15.04 39.568 9.7546666666667 50.1333333333333 7.1573333333333C55.28 5.8933333333333 57.4506666666667 5.6586666666667 64 5.6586666666667C70.5493333333333 5.6586666666667 72.72 5.8933333333333 77.8666666666667 7.1573333333333C85.4773333333333 9.0293333333333 92.624 12.352 98.5706666666667 16.7733333333333C101.472 18.9386666666667 102.2026666666667 19.5733333333334 105.1413333333333 22.4693333333333C112.304 29.536 117.1946666666667 37.68 120.1226666666667 47.392C121.808 52.992 122.4266666666667 57.568 122.4853333333333 64.88C122.5333333333333 71.0506666666667 122.4746666666667 71.328 120.7146666666667 72.832C118.784 74.4853333333333 115.7333333333333 74.464 113.872 72.784C112.2933333333333 71.3653333333333 112.1813333333333 70.864 111.9573333333333 64.3306666666667C111.744 57.936 111.3386666666667 55.0933333333333 109.968 50.3306666666667C105.7813333333333 35.7866666666667 94.272 23.7386666666667 79.792 18.7466666666667C73.9146666666667 16.72 70.496 16.1386666666667 64.32 16.1226666666667C59.072 16.1066666666667 57.3386666666667 16.2986666666667 52.7466666666667 17.408C40.896 20.2773333333333 30.8106666666667 27.344 24.0053333333333 37.5466666666667C14.6506666666667 51.5733333333333 13.4506666666667 69.888 20.9013333333333 85.0666666666667C27.216 97.9253333333333 38.752 107.184 52.8586666666667 110.7146666666667C58.992 112.2506666666667 67.216 112.384 73.6693333333333 111.0453333333333C75.8773333333333 110.5866666666667 79.3813333333333 109.5093333333333 83.4133333333333 108.0533333333333C85.1946666666667 107.408 86.6133333333333 107.408 87.9626666666667 108.048C90.9653333333333 109.472 91.8453333333333 113.6586666666667 89.6533333333333 116.0853333333334C87.4293333333333 118.5493333333333 78.2453333333333 121.424 70.08 122.2133333333334C66.7626666666667 122.5333333333333 63.9146666666667 122.6026666666667 60.576 122.432M115.2266666666667 111.456C114.3626666666667 111.0826666666667 110.4533333333333 107.2533333333333 84.1173333333333 80.9813333333333L64.0266666666667 60.9333333333333L57.872 67.0026666666667C54.4853333333333 70.336 51.3013333333333 73.3493333333333 50.8 73.696C49.0933333333333 74.864 46.2666666666667 74.6666666666667 44.624 73.2586666666667C43.0186666666667 71.888 42.3626666666667 69.2746666666667 43.152 67.392C43.8826666666667 65.6373333333334 60.2613333333333 49.232 62.0106666666667 48.5066666666667C62.9066666666667 48.128 65.0933333333333 48.128 65.9893333333333 48.5013333333333C67.7333333333333 49.232 121.4346666666667 102.9333333333333 122.1653333333333 104.6773333333333C122.5546666666667 105.6106666666667 122.528 107.776 122.1226666666667 108.752C121.3546666666667 110.592 119.4346666666667 111.792 117.2853333333333 111.776C116.5493333333333 111.776 115.6213333333333 111.6266666666667 115.2266666666667 111.456" />
-    <glyph glyph-name="circle-dot"
+      horiz-adv-x="128" d="M58.24 116.9706666666667C57.8293333333333 116.928 56.192 116.6613333333333 54.6026666666667 116.3733333333333C43.7546666666667 114.4266666666667 33.9306666666667 109.2693333333333 26.1333333333333 101.44C18.4533333333333 93.7226666666667 13.152 83.232 11.4773333333333 72.4373333333333C11.0986666666667 69.984 11.0133333333333 68.5066666666667 11.008 64.32C11.0026666666667 56.0373333333333 11.8293333333333 51.456 14.6346666666667 44.16L15.5786666666667 41.7066666666667L10.5653333333333 26.7946666666667C5.0933333333333 10.528 5.056 10.3786666666667 5.9466666666667 8.4266666666667C6.432 7.36 7.7973333333333 6.1066666666667 8.8586666666667 5.76C10.592 5.184 11.632 5.4666666666667 27.056 10.6506666666667L41.7546666666667 15.5946666666667L43.8613333333333 14.7573333333333C47.9466666666667 13.1306666666667 52.5226666666667 11.888 56.6453333333333 11.2746666666667C57.6426666666667 11.1306666666667 60.816 11.024 64.32 11.0293333333333C69.8773333333333 11.0293333333333 70.496 11.072 73.1893333333333 11.5893333333333C85.4133333333333 13.9466666666667 95.2053333333333 19.344 103.4613333333333 28.2666666666667C111.36 36.8053333333333 116.5066666666667 48.9866666666667 117.1146666666667 60.5546666666667C117.6426666666667 70.7146666666667 115.792 79.8026666666667 111.4506666666667 88.32C106.6986666666667 97.648 98.1813333333333 106.2346666666667 88.72 111.232C83.1733333333333 114.1653333333333 76.2826666666667 116.2506666666667 70.0053333333333 116.896C67.968 117.104 59.9786666666667 117.1573333333333 58.24 116.9706666666667M70.8266666666667 106.144C75.4293333333333 105.3653333333333 79.2 104.112 83.392 101.9786666666667C87.6 99.8293333333333 90.7466666666667 97.5626666666667 94.08 94.2613333333333C106.96 81.536 110.3466666666667 61.6 102.3786666666667 45.408C100.2133333333333 41.0186666666667 98.048 37.9253333333333 94.7253333333333 34.48C87.0186666666667 26.5013333333334 77.0293333333333 21.968 65.92 21.4133333333333C59.3653333333333 21.088 52.64 22.416 46.1066666666667 25.3333333333333C44 26.2773333333333 43.7226666666667 26.3466666666667 42.1333333333333 26.336C40.5066666666667 26.32 39.936 26.1546666666667 30.032 22.8266666666667C24.3146666666667 20.9066666666667 19.5626666666667 19.4026666666667 19.4773333333333 19.4933333333333C19.392 19.5786666666667 20.7786666666667 23.9893333333334 22.5546666666667 29.2906666666667C24.336 34.592 25.952 39.5573333333333 26.144 40.32C26.656 42.336 26.48 43.4346666666667 25.12 46.6346666666667C22.8746666666667 51.9306666666667 21.9573333333333 55.6 21.5306666666667 61.0026666666667C20.9866666666667 67.9786666666667 22.4 75.7386666666667 25.3706666666667 82.0266666666667C27.5626666666667 86.6773333333333 30.1866666666667 90.384 33.8986666666667 94.096C40.8853333333333 101.0773333333333 49.4506666666667 105.2746666666667 59.0933333333333 106.448C61.424 106.7306666666667 68.4373333333333 106.5493333333333 70.8266666666667 106.144M58.5493333333333 95.28C51.7546666666667 93.4773333333333 46.624 89.1946666666667 44.16 83.2746666666667C42.9813333333333 80.4426666666667 43.0666666666667 78.4746666666667 44.448 76.7146666666667C45.952 74.7946666666667 49.152 74.2933333333333 51.312 75.632C52.1813333333333 76.1706666666667 52.5173333333333 76.592 53.4986666666667 78.4C54.9173333333333 81.0133333333333 55.808 82.128 57.4293333333333 83.3226666666667C60.5333333333333 85.6053333333333 64.72 85.9626666666667 68.2346666666667 84.24C70.8586666666667 82.9546666666667 73.2106666666667 80.0586666666667 73.9413333333333 77.2106666666667C74.7306666666667 74.1333333333333 73.968 71.8453333333333 71.296 69.296C69.3866666666667 67.4666666666667 67.1786666666667 66.0746666666667 63.136 64.1493333333334C60.1546666666667 62.7253333333333 59.344 62.0906666666667 58.784 60.752C58.3306666666667 59.664 58.3626666666667 57.4933333333333 58.8533333333333 56.416C59.44 55.1306666666667 60.7893333333333 54.08 62.432 53.6373333333333C63.8026666666667 53.264 63.84 53.264 65.3493333333333 53.744C69.0186666666667 54.9013333333333 74.5333333333333 58.0586666666667 77.9466666666667 60.944C81.0133333333333 63.5413333333333 83.3813333333333 67.232 84.2933333333333 70.8266666666667C84.688 72.4 84.736 73.0186666666667 84.6346666666667 75.728C84.5066666666667 79.1626666666667 84.1226666666667 80.8746666666667 82.8906666666667 83.5466666666667C80.352 89.04 75.1893333333333 93.4506666666667 69.296 95.1626666666667C68.0533333333333 95.5253333333333 66.9866666666667 95.6373333333334 64.1066666666667 95.7066666666667C60.7946666666667 95.7866666666667 60.3146666666667 95.7493333333333 58.5493333333333 95.28M61.712 42.0053333333333C59.9253333333333 41.1253333333333 58.8373333333333 39.36 58.832 37.3386666666667C58.8213333333333 35.7653333333333 59.3706666666667 34.512 60.5013333333333 33.52C62.672 31.6053333333333 65.8506666666667 31.7066666666667 67.7653333333333 33.7386666666667C68.8533333333333 34.9013333333333 69.2106666666667 35.792 69.2106666666667 37.3333333333333C69.2106666666667 39.456 67.9893333333333 41.328 66.0853333333333 42.1226666666667C64.9226666666667 42.608 62.8106666666667 42.5493333333334 61.712 42.0053333333333" />
+    <glyph glyph-name="message-circle-question-1"
+      unicode="&#x6D;&#x65;&#x73;&#x73;&#x61;&#x67;&#x65;&#x2D;&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x71;&#x75;&#x65;&#x73;&#x74;&#x69;&#x6F;&#x6E;"
+      horiz-adv-x="128" d="M58.24 116.9706666666667C57.8293333333333 116.928 56.192 116.6613333333333 54.6026666666667 116.3733333333333C43.7546666666667 114.4266666666667 33.9306666666667 109.2693333333333 26.1333333333333 101.44C18.4533333333333 93.7226666666667 13.152 83.232 11.4773333333333 72.4373333333333C11.0986666666667 69.984 11.0133333333333 68.5066666666667 11.008 64.32C11.0026666666667 56.0373333333333 11.8293333333333 51.456 14.6346666666667 44.16L15.5786666666667 41.7066666666667L10.5653333333333 26.7946666666667C5.0933333333333 10.528 5.056 10.3786666666667 5.9466666666667 8.4266666666667C6.432 7.36 7.7973333333333 6.1066666666667 8.8586666666667 5.76C10.592 5.184 11.632 5.4666666666667 27.056 10.6506666666667L41.7546666666667 15.5946666666667L43.8613333333333 14.7573333333333C47.9466666666667 13.1306666666667 52.5226666666667 11.888 56.6453333333333 11.2746666666667C57.6426666666667 11.1306666666667 60.816 11.024 64.32 11.0293333333333C69.8773333333333 11.0293333333333 70.496 11.072 73.1893333333333 11.5893333333333C85.4133333333333 13.9466666666667 95.2053333333333 19.344 103.4613333333333 28.2666666666667C111.36 36.8053333333333 116.5066666666667 48.9866666666667 117.1146666666667 60.5546666666667C117.6426666666667 70.7146666666667 115.792 79.8026666666667 111.4506666666667 88.32C106.6986666666667 97.648 98.1813333333333 106.2346666666667 88.72 111.232C83.1733333333333 114.1653333333333 76.2826666666667 116.2506666666667 70.0053333333333 116.896C67.968 117.104 59.9786666666667 117.1573333333333 58.24 116.9706666666667M70.8266666666667 106.144C75.4293333333333 105.3653333333333 79.2 104.112 83.392 101.9786666666667C87.6 99.8293333333333 90.7466666666667 97.5626666666667 94.08 94.2613333333333C106.96 81.536 110.3466666666667 61.6 102.3786666666667 45.408C100.2133333333333 41.0186666666667 98.048 37.9253333333333 94.7253333333333 34.48C87.0186666666667 26.5013333333334 77.0293333333333 21.968 65.92 21.4133333333333C59.3653333333333 21.088 52.64 22.416 46.1066666666667 25.3333333333333C44 26.2773333333333 43.7226666666667 26.3466666666667 42.1333333333333 26.336C40.5066666666667 26.32 39.936 26.1546666666667 30.032 22.8266666666667C24.3146666666667 20.9066666666667 19.5626666666667 19.4026666666667 19.4773333333333 19.4933333333333C19.392 19.5786666666667 20.7786666666667 23.9893333333334 22.5546666666667 29.2906666666667C24.336 34.592 25.952 39.5573333333333 26.144 40.32C26.656 42.336 26.48 43.4346666666667 25.12 46.6346666666667C22.8746666666667 51.9306666666667 21.9573333333333 55.6 21.5306666666667 61.0026666666667C20.9866666666667 67.9786666666667 22.4 75.7386666666667 25.3706666666667 82.0266666666667C27.5626666666667 86.6773333333333 30.1866666666667 90.384 33.8986666666667 94.096C40.8853333333333 101.0773333333333 49.4506666666667 105.2746666666667 59.0933333333333 106.448C61.424 106.7306666666667 68.4373333333333 106.5493333333333 70.8266666666667 106.144M58.5493333333333 95.28C51.7546666666667 93.4773333333333 46.624 89.1946666666667 44.16 83.2746666666667C42.9813333333333 80.4426666666667 43.0666666666667 78.4746666666667 44.448 76.7146666666667C45.952 74.7946666666667 49.152 74.2933333333333 51.312 75.632C52.1813333333333 76.1706666666667 52.5173333333333 76.592 53.4986666666667 78.4C54.9173333333333 81.0133333333333 55.808 82.128 57.4293333333333 83.3226666666667C60.5333333333333 85.6053333333333 64.72 85.9626666666667 68.2346666666667 84.24C70.8586666666667 82.9546666666667 73.2106666666667 80.0586666666667 73.9413333333333 77.2106666666667C74.7306666666667 74.1333333333333 73.968 71.8453333333333 71.296 69.296C69.3866666666667 67.4666666666667 67.1786666666667 66.0746666666667 63.136 64.1493333333334C60.1546666666667 62.7253333333333 59.344 62.0906666666667 58.784 60.752C58.3306666666667 59.664 58.3626666666667 57.4933333333333 58.8533333333333 56.416C59.44 55.1306666666667 60.7893333333333 54.08 62.432 53.6373333333333C63.8026666666667 53.264 63.84 53.264 65.3493333333333 53.744C69.0186666666667 54.9013333333333 74.5333333333333 58.0586666666667 77.9466666666667 60.944C81.0133333333333 63.5413333333333 83.3813333333333 67.232 84.2933333333333 70.8266666666667C84.688 72.4 84.736 73.0186666666667 84.6346666666667 75.728C84.5066666666667 79.1626666666667 84.1226666666667 80.8746666666667 82.8906666666667 83.5466666666667C80.352 89.04 75.1893333333333 93.4506666666667 69.296 95.1626666666667C68.0533333333333 95.5253333333333 66.9866666666667 95.6373333333334 64.1066666666667 95.7066666666667C60.7946666666667 95.7866666666667 60.3146666666667 95.7493333333333 58.5493333333333 95.28M61.712 42.0053333333333C59.9253333333333 41.1253333333333 58.8373333333333 39.36 58.832 37.3386666666667C58.8213333333333 35.7653333333333 59.3706666666667 34.512 60.5013333333333 33.52C62.672 31.6053333333333 65.8506666666667 31.7066666666667 67.7653333333333 33.7386666666667C68.8533333333333 34.9013333333333 69.2106666666667 35.792 69.2106666666667 37.3333333333333C69.2106666666667 39.456 67.9893333333333 41.328 66.0853333333333 42.1226666666667C64.9226666666667 42.608 62.8106666666667 42.5493333333334 61.712 42.0053333333333" />
+    <glyph glyph-name="x"
       unicode="&#xF113;"
-      horiz-adv-x="128" d="M60.16 122.4373333333333C52.3573333333333 121.952 45.3546666666667 120.064 38.08 116.48C31.904 113.44 27.4186666666667 110.2293333333333 22.5973333333333 105.4026666666667C17.7706666666667 100.5813333333333 14.56 96.096 11.52 89.92C7.824 82.4213333333333 6.0533333333333 75.7013333333333 5.5466666666667 67.2693333333333C4.9333333333333 57.1413333333333 6.928 47.392 11.52 38.08C14.56 31.904 17.7706666666667 27.4186666666667 22.5973333333333 22.5973333333333C27.4133333333333 17.7813333333333 31.888 14.576 38.08 11.5093333333333C46.4693333333333 7.36 54.464 5.5093333333333 64 5.5093333333333C73.536 5.5093333333333 81.5306666666667 7.36 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M62.192 74.4373333333333C60.256 74.144 58.0053333333333 72.9706666666667 56.5173333333333 71.4826666666667C51.424 66.3893333333333 52.896 57.5573333333333 59.3493333333333 54.5066666666667C65.8773333333333 51.4186666666667 73.4613333333333 55.408 74.448 62.4533333333334C75.456 69.6373333333334 69.4293333333333 75.5306666666667 62.192 74.4373333333333" />
-    <glyph glyph-name="circle-dot-1"
-      unicode="&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x64;&#x6F;&#x74;"
-      horiz-adv-x="128" d="M60.16 122.4373333333333C52.3573333333333 121.952 45.3546666666667 120.064 38.08 116.48C31.904 113.44 27.4186666666667 110.2293333333333 22.5973333333333 105.4026666666667C17.7706666666667 100.5813333333333 14.56 96.096 11.52 89.92C7.824 82.4213333333333 6.0533333333333 75.7013333333333 5.5466666666667 67.2693333333333C4.9333333333333 57.1413333333333 6.928 47.392 11.52 38.08C14.56 31.904 17.7706666666667 27.4186666666667 22.5973333333333 22.5973333333333C27.4133333333333 17.7813333333333 31.888 14.576 38.08 11.5093333333333C46.4693333333333 7.36 54.464 5.5093333333333 64 5.5093333333333C73.536 5.5093333333333 81.5306666666667 7.36 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M62.192 74.4373333333333C60.256 74.144 58.0053333333333 72.9706666666667 56.5173333333333 71.4826666666667C51.424 66.3893333333333 52.896 57.5573333333333 59.3493333333333 54.5066666666667C65.8773333333333 51.4186666666667 73.4613333333333 55.408 74.448 62.4533333333334C75.456 69.6373333333334 69.4293333333333 75.5306666666667 62.192 74.4373333333333" />
-    <glyph glyph-name="panel-right"
+      horiz-adv-x="128" d="M29.9573333333333 100.816C28.944 100.3786666666667 27.7066666666667 99.1893333333333 27.28 98.24C26.8053333333333 97.2 26.7573333333333 95.008 27.184 93.9786666666667C27.5786666666667 93.04 30.0053333333333 90.5173333333333 44.4693333333333 76L56.4266666666667 64L44.4693333333333 52C29.8613333333333 37.344 27.5786666666667 34.96 27.1626666666667 33.968C26.7413333333333 32.9653333333334 26.752 31.0453333333333 27.184 30.032C27.6053333333333 29.04 28.672 27.808 29.472 27.3973333333333C30.48 26.8746666666667 32 26.6773333333333 33.136 26.9173333333333C33.8666666666667 27.072 34.5386666666667 27.4506666666667 35.4826666666667 28.2293333333333C36.208 28.832 42.9226666666667 35.4133333333333 50.4 42.8533333333333L64 56.384L77.6 42.8533333333333C85.0826666666667 35.4133333333333 91.792 28.832 92.5173333333333 28.2293333333333C94.0533333333333 26.96 95.28 26.5813333333333 96.9013333333333 26.8906666666667C98.2453333333333 27.1413333333333 98.9973333333333 27.552 99.808 28.4746666666667C100.7413333333333 29.536 101.152 30.6186666666667 101.1573333333333 32.0106666666667C101.168 34.3893333333333 101.856 33.6106666666667 83.424 52.1066666666667L71.5733333333333 64L83.424 75.8933333333334C98.08 90.6026666666667 100.4266666666667 93.0453333333333 100.8373333333333 94.0266666666667C101.3173333333333 95.1786666666667 101.2533333333333 96.9973333333333 100.688 98.2026666666667C99.8026666666667 100.0906666666667 98.08 101.12 95.808 101.12C93.5733333333333 101.12 94.2933333333333 101.76 76 83.5306666666667L64 71.5733333333333L52.32 83.216C36.6453333333333 98.832 34.7786666666667 100.6133333333334 33.7706666666667 100.8906666666667C32.6613333333333 101.2 30.752 101.1626666666667 29.9573333333333 100.816" />
+    <glyph glyph-name="x-1"
+      unicode="&#x78;"
+      horiz-adv-x="128" d="M29.9573333333333 100.816C28.944 100.3786666666667 27.7066666666667 99.1893333333333 27.28 98.24C26.8053333333333 97.2 26.7573333333333 95.008 27.184 93.9786666666667C27.5786666666667 93.04 30.0053333333333 90.5173333333333 44.4693333333333 76L56.4266666666667 64L44.4693333333333 52C29.8613333333333 37.344 27.5786666666667 34.96 27.1626666666667 33.968C26.7413333333333 32.9653333333334 26.752 31.0453333333333 27.184 30.032C27.6053333333333 29.04 28.672 27.808 29.472 27.3973333333333C30.48 26.8746666666667 32 26.6773333333333 33.136 26.9173333333333C33.8666666666667 27.072 34.5386666666667 27.4506666666667 35.4826666666667 28.2293333333333C36.208 28.832 42.9226666666667 35.4133333333333 50.4 42.8533333333333L64 56.384L77.6 42.8533333333333C85.0826666666667 35.4133333333333 91.792 28.832 92.5173333333333 28.2293333333333C94.0533333333333 26.96 95.28 26.5813333333333 96.9013333333333 26.8906666666667C98.2453333333333 27.1413333333333 98.9973333333333 27.552 99.808 28.4746666666667C100.7413333333333 29.536 101.152 30.6186666666667 101.1573333333333 32.0106666666667C101.168 34.3893333333333 101.856 33.6106666666667 83.424 52.1066666666667L71.5733333333333 64L83.424 75.8933333333334C98.08 90.6026666666667 100.4266666666667 93.0453333333333 100.8373333333333 94.0266666666667C101.3173333333333 95.1786666666667 101.2533333333333 96.9973333333333 100.688 98.2026666666667C99.8026666666667 100.0906666666667 98.08 101.12 95.808 101.12C93.5733333333333 101.12 94.2933333333333 101.76 76 83.5306666666667L64 71.5733333333333L52.32 83.216C36.6453333333333 98.832 34.7786666666667 100.6133333333334 33.7706666666667 100.8906666666667C32.6613333333333 101.2 30.752 101.1626666666667 29.9573333333333 100.816" />
+    <glyph glyph-name="circle-pause"
       unicode="&#xF114;"
-      horiz-adv-x="128" d="M22.848 116.7893333333333C19.0346666666667 115.9626666666667 14.5706666666667 112.4853333333333 12.6133333333333 108.8213333333333C12.2613333333333 108.1546666666667 11.6746666666667 106.704 11.3173333333333 105.6L10.6666666666667 103.5893333333333L10.6666666666667 64L10.6666666666667 24.4106666666667L11.3173333333333 22.4C12.448 18.9066666666667 13.9253333333333 16.6933333333333 16.6666666666667 14.3626666666667C18.3146666666667 12.9653333333333 19.872 12.1386666666667 22.4 11.3173333333333L24.4106666666667 10.6666666666667L64 10.6666666666667L103.5893333333333 10.6666666666667L105.6 11.3173333333333C108.128 12.1386666666667 109.6213333333333 12.9333333333333 111.28 14.352C114.096 16.7573333333333 115.5573333333333 18.928 116.6826666666667 22.4L117.3333333333333 24.4106666666667L117.3333333333333 64L117.3333333333333 103.5893333333333L116.6826666666667 105.6C115.5413333333334 109.12 114.1493333333333 111.1946666666667 111.28 113.648C109.7706666666667 114.9386666666667 108.2666666666667 115.776 106.0693333333333 116.5653333333333L104.5066666666667 117.12L64.3626666666667 117.104C30.9653333333333 117.088 23.984 117.0346666666667 22.848 116.7893333333333M74.6666666666667 63.9946666666667L74.6666666666667 21.3173333333333L49.8666666666667 21.3813333333333L25.0666666666667 21.44L24.0426666666667 22.0426666666667C22.9066666666667 22.7093333333333 21.872 23.9893333333334 21.5306666666667 25.152C21.376 25.6853333333333 21.328 37.7813333333333 21.3706666666667 64.32L21.44 102.72L21.936 103.728C22.496 104.864 23.3813333333333 105.696 24.64 106.2666666666667C25.4506666666667 106.64 26.7466666666667 106.656 50.08 106.6613333333333L74.6666666666667 106.6666666666667L74.6666666666667 63.9946666666667M103.9413333333333 105.968C105.04 105.3226666666667 105.8346666666667 104.4053333333333 106.3413333333333 103.1946666666667C106.6293333333333 102.5013333333333 106.6666666666667 98.0053333333333 106.6666666666667 64C106.6666666666667 29.9946666666667 106.6293333333333 25.4986666666667 106.3413333333333 24.8053333333333C105.8346666666667 23.5946666666667 105.04 22.6773333333333 103.9413333333333 22.032L102.9333333333333 21.44L94.1333333333333 21.376L85.3333333333333 21.312L85.3333333333333 64.0053333333333L85.3333333333333 106.6986666666667L94.1333333333333 106.6293333333333L102.9333333333333 106.56L103.9413333333333 105.968" />
-    <glyph glyph-name="panel-right-1"
-      unicode="&#x70;&#x61;&#x6E;&#x65;&#x6C;&#x2D;&#x72;&#x69;&#x67;&#x68;&#x74;"
-      horiz-adv-x="128" d="M22.848 116.7893333333333C19.0346666666667 115.9626666666667 14.5706666666667 112.4853333333333 12.6133333333333 108.8213333333333C12.2613333333333 108.1546666666667 11.6746666666667 106.704 11.3173333333333 105.6L10.6666666666667 103.5893333333333L10.6666666666667 64L10.6666666666667 24.4106666666667L11.3173333333333 22.4C12.448 18.9066666666667 13.9253333333333 16.6933333333333 16.6666666666667 14.3626666666667C18.3146666666667 12.9653333333333 19.872 12.1386666666667 22.4 11.3173333333333L24.4106666666667 10.6666666666667L64 10.6666666666667L103.5893333333333 10.6666666666667L105.6 11.3173333333333C108.128 12.1386666666667 109.6213333333333 12.9333333333333 111.28 14.352C114.096 16.7573333333333 115.5573333333333 18.928 116.6826666666667 22.4L117.3333333333333 24.4106666666667L117.3333333333333 64L117.3333333333333 103.5893333333333L116.6826666666667 105.6C115.5413333333334 109.12 114.1493333333333 111.1946666666667 111.28 113.648C109.7706666666667 114.9386666666667 108.2666666666667 115.776 106.0693333333333 116.5653333333333L104.5066666666667 117.12L64.3626666666667 117.104C30.9653333333333 117.088 23.984 117.0346666666667 22.848 116.7893333333333M74.6666666666667 63.9946666666667L74.6666666666667 21.3173333333333L49.8666666666667 21.3813333333333L25.0666666666667 21.44L24.0426666666667 22.0426666666667C22.9066666666667 22.7093333333333 21.872 23.9893333333334 21.5306666666667 25.152C21.376 25.6853333333333 21.328 37.7813333333333 21.3706666666667 64.32L21.44 102.72L21.936 103.728C22.496 104.864 23.3813333333333 105.696 24.64 106.2666666666667C25.4506666666667 106.64 26.7466666666667 106.656 50.08 106.6613333333333L74.6666666666667 106.6666666666667L74.6666666666667 63.9946666666667M103.9413333333333 105.968C105.04 105.3226666666667 105.8346666666667 104.4053333333333 106.3413333333333 103.1946666666667C106.6293333333333 102.5013333333333 106.6666666666667 98.0053333333333 106.6666666666667 64C106.6666666666667 29.9946666666667 106.6293333333333 25.4986666666667 106.3413333333333 24.8053333333333C105.8346666666667 23.5946666666667 105.04 22.6773333333333 103.9413333333333 22.032L102.9333333333333 21.44L94.1333333333333 21.376L85.3333333333333 21.312L85.3333333333333 64.0053333333333L85.3333333333333 106.6986666666667L94.1333333333333 106.6293333333333L102.9333333333333 106.56L103.9413333333333 105.968" />
-    <glyph glyph-name="user"
+      horiz-adv-x="128" d="M60.16 122.4373333333333C48.3626666666667 121.7066666666667 36.6826666666667 117.1786666666667 27.312 109.712C24.704 107.632 20.368 103.296 18.288 100.688C13.088 94.16 9.0293333333333 85.904 7.0666666666667 77.8346666666667C4.9173333333333 69.0346666666667 4.9173333333333 58.9653333333333 7.0666666666667 50.1653333333333C9.0293333333333 42.096 13.088 33.84 18.288 27.312C20.368 24.704 24.704 20.368 27.312 18.288C32.192 14.4 39.0506666666667 10.608 44.7253333333333 8.6666666666667C59.7493333333333 3.52 75.8186666666667 4.5333333333333 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M52.2666666666667 85.136C50.704 84.816 49.3973333333333 83.792 48.5653333333333 82.2453333333333C48.1066666666667 81.3866666666667 48.1066666666667 81.3813333333334 48.1066666666667 64C48.1066666666667 46.6186666666667 48.1066666666667 46.6133333333333 48.5653333333333 45.7546666666667C49.6106666666667 43.8026666666667 51.2106666666667 42.816 53.3333333333333 42.816C55.456 42.816 57.056 43.8026666666667 58.1013333333333 45.7546666666667C58.56 46.6133333333333 58.56 46.6186666666667 58.56 64C58.56 81.3813333333334 58.56 81.3866666666667 58.1013333333333 82.2453333333333C56.9173333333333 84.4533333333334 54.5813333333333 85.6106666666667 52.2666666666667 85.136M73.6 85.136C72.0373333333333 84.816 70.7306666666667 83.792 69.8986666666667 82.2453333333333C69.44 81.3866666666667 69.44 81.3813333333334 69.44 64C69.44 46.6186666666667 69.44 46.6133333333333 69.8986666666667 45.7546666666667C70.944 43.8026666666667 72.544 42.816 74.6666666666667 42.816C76.7893333333333 42.816 78.3893333333333 43.8026666666667 79.4346666666667 45.7546666666667C79.8933333333333 46.6133333333333 79.8933333333333 46.6186666666667 79.8933333333333 64C79.8933333333333 81.3813333333334 79.8933333333333 81.3866666666667 79.4346666666667 82.2453333333333C78.2506666666667 84.4533333333334 75.9146666666667 85.6106666666667 73.6 85.136" />
+    <glyph glyph-name="circle-pause-1"
+      unicode="&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x70;&#x61;&#x75;&#x73;&#x65;"
+      horiz-adv-x="128" d="M60.16 122.4373333333333C48.3626666666667 121.7066666666667 36.6826666666667 117.1786666666667 27.312 109.712C24.704 107.632 20.368 103.296 18.288 100.688C13.088 94.16 9.0293333333333 85.904 7.0666666666667 77.8346666666667C4.9173333333333 69.0346666666667 4.9173333333333 58.9653333333333 7.0666666666667 50.1653333333333C9.0293333333333 42.096 13.088 33.84 18.288 27.312C20.368 24.704 24.704 20.368 27.312 18.288C32.192 14.4 39.0506666666667 10.608 44.7253333333333 8.6666666666667C59.7493333333333 3.52 75.8186666666667 4.5333333333333 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M52.2666666666667 85.136C50.704 84.816 49.3973333333333 83.792 48.5653333333333 82.2453333333333C48.1066666666667 81.3866666666667 48.1066666666667 81.3813333333334 48.1066666666667 64C48.1066666666667 46.6186666666667 48.1066666666667 46.6133333333333 48.5653333333333 45.7546666666667C49.6106666666667 43.8026666666667 51.2106666666667 42.816 53.3333333333333 42.816C55.456 42.816 57.056 43.8026666666667 58.1013333333333 45.7546666666667C58.56 46.6133333333333 58.56 46.6186666666667 58.56 64C58.56 81.3813333333334 58.56 81.3866666666667 58.1013333333333 82.2453333333333C56.9173333333333 84.4533333333334 54.5813333333333 85.6106666666667 52.2666666666667 85.136M73.6 85.136C72.0373333333333 84.816 70.7306666666667 83.792 69.8986666666667 82.2453333333333C69.44 81.3866666666667 69.44 81.3813333333334 69.44 64C69.44 46.6186666666667 69.44 46.6133333333333 69.8986666666667 45.7546666666667C70.944 43.8026666666667 72.544 42.816 74.6666666666667 42.816C76.7893333333333 42.816 78.3893333333333 43.8026666666667 79.4346666666667 45.7546666666667C79.8933333333333 46.6133333333333 79.8933333333333 46.6186666666667 79.8933333333333 64C79.8933333333333 81.3813333333334 79.8933333333333 81.3866666666667 79.4346666666667 82.2453333333333C78.2506666666667 84.4533333333334 75.9146666666667 85.6106666666667 73.6 85.136" />
+    <glyph glyph-name="file-text"
       unicode="&#xF115;"
-      horiz-adv-x="128" d="M59.84 116.8853333333333C54.9706666666667 116.1813333333333 49.2213333333333 113.3066666666667 45.5466666666667 109.7333333333333C38.7626666666667 103.136 36.0053333333333 93.7226666666667 38.176 84.5866666666667C40.6186666666667 74.2986666666667 49.088 66.2933333333333 59.3866666666667 64.5386666666667C61.8133333333333 64.1226666666667 66.1866666666667 64.1226666666667 68.6133333333333 64.5386666666667C79.5413333333333 66.4 88.2133333333333 75.0933333333333 90.1333333333333 86.1226666666667C90.544 88.464 90.544 92.8693333333334 90.1333333333333 95.2106666666667C88.2133333333333 106.2346666666667 79.3973333333333 115.0186666666667 68.4746666666667 116.7893333333333C66.3093333333333 117.1413333333333 61.9573333333333 117.1893333333333 59.84 116.8853333333333M67.9466666666667 106.2186666666667C69.5306666666667 105.9146666666667 72.672 104.2933333333333 74.1866666666667 103.0026666666667C76.624 100.928 78.6133333333333 97.9573333333333 79.4453333333333 95.1626666666667C79.9253333333333 93.5306666666667 79.9253333333333 87.8026666666667 79.4453333333333 86.1706666666667C78.256 82.1813333333333 75.0453333333333 78.3466666666667 71.264 76.4C68.4213333333333 74.9386666666667 67.7226666666667 74.7893333333333 63.8933333333333 74.8053333333333C60.5866666666667 74.816 60.4213333333333 74.8373333333333 58.624 75.504C55.7226666666667 76.5813333333333 52.5173333333333 79.0666666666667 50.784 81.584C49.856 82.9333333333333 48.9386666666667 84.9546666666667 48.5013333333333 86.6133333333334C48.0106666666667 88.496 48.0053333333333 92.8 48.5013333333333 94.8C49.6266666666667 99.392 54.2186666666667 104.384 58.6186666666667 105.7973333333333C61.1573333333333 106.6133333333334 65.008 106.7893333333333 67.9466666666667 106.2186666666667M48.2133333333333 53.1306666666667C42.6026666666667 52.9333333333333 40.1226666666667 52.3733333333333 36.16 50.3946666666667C33.856 49.248 32.832 48.5706666666667 30.72 46.8C27.0613333333333 43.7333333333333 24.176 39.3493333333333 22.6613333333333 34.56C21.5893333333333 31.1786666666667 21.4773333333333 29.9786666666667 21.456 21.9733333333333C21.44 14.816 21.4506666666667 14.592 21.8986666666667 13.76C22.9333333333333 11.8453333333333 24.5386666666667 10.88 26.6666666666667 10.88C28.8053333333333 10.88 30.432 11.8666666666667 31.4133333333333 13.76C31.824 14.56 31.8666666666667 15.1253333333333 32.0213333333333 22.4C32.1653333333333 29.2693333333333 32.2346666666667 30.3253333333333 32.5973333333333 31.3653333333333C34.336 36.336 37.808 39.9253333333333 42.704 41.8133333333333L44.3573333333333 42.4533333333334L63.9893333333333 42.4533333333334L83.616 42.4533333333334L84.9706666666667 41.9466666666667C90.0693333333333 40.0266666666667 93.6533333333333 36.384 95.4026666666667 31.36C95.76 30.3306666666667 95.8293333333333 29.2373333333333 95.9786666666667 22.4C96.1333333333333 15.1306666666667 96.176 14.5546666666667 96.5866666666667 13.76C97.568 11.8666666666667 99.1946666666667 10.88 101.3333333333333 10.88C103.4613333333333 10.88 105.0666666666667 11.8453333333333 106.1013333333333 13.76C106.5493333333333 14.592 106.56 14.8053333333333 106.5333333333333 22.08C106.5066666666667 30.1013333333333 106.432 30.9386666666667 105.3546666666667 34.4533333333334C102.4426666666667 44 94.304 51.1306666666667 84.4106666666667 52.816C82.7946666666667 53.0933333333333 79.8346666666667 53.1626666666667 67.52 53.216C59.3066666666667 53.2533333333333 50.6186666666667 53.216 48.2133333333333 53.1306666666667" />
-    <glyph glyph-name="user-1"
-      unicode="&#x75;&#x73;&#x65;&#x72;"
-      horiz-adv-x="128" d="M59.84 116.8853333333333C54.9706666666667 116.1813333333333 49.2213333333333 113.3066666666667 45.5466666666667 109.7333333333333C38.7626666666667 103.136 36.0053333333333 93.7226666666667 38.176 84.5866666666667C40.6186666666667 74.2986666666667 49.088 66.2933333333333 59.3866666666667 64.5386666666667C61.8133333333333 64.1226666666667 66.1866666666667 64.1226666666667 68.6133333333333 64.5386666666667C79.5413333333333 66.4 88.2133333333333 75.0933333333333 90.1333333333333 86.1226666666667C90.544 88.464 90.544 92.8693333333334 90.1333333333333 95.2106666666667C88.2133333333333 106.2346666666667 79.3973333333333 115.0186666666667 68.4746666666667 116.7893333333333C66.3093333333333 117.1413333333333 61.9573333333333 117.1893333333333 59.84 116.8853333333333M67.9466666666667 106.2186666666667C69.5306666666667 105.9146666666667 72.672 104.2933333333333 74.1866666666667 103.0026666666667C76.624 100.928 78.6133333333333 97.9573333333333 79.4453333333333 95.1626666666667C79.9253333333333 93.5306666666667 79.9253333333333 87.8026666666667 79.4453333333333 86.1706666666667C78.256 82.1813333333333 75.0453333333333 78.3466666666667 71.264 76.4C68.4213333333333 74.9386666666667 67.7226666666667 74.7893333333333 63.8933333333333 74.8053333333333C60.5866666666667 74.816 60.4213333333333 74.8373333333333 58.624 75.504C55.7226666666667 76.5813333333333 52.5173333333333 79.0666666666667 50.784 81.584C49.856 82.9333333333333 48.9386666666667 84.9546666666667 48.5013333333333 86.6133333333334C48.0106666666667 88.496 48.0053333333333 92.8 48.5013333333333 94.8C49.6266666666667 99.392 54.2186666666667 104.384 58.6186666666667 105.7973333333333C61.1573333333333 106.6133333333334 65.008 106.7893333333333 67.9466666666667 106.2186666666667M48.2133333333333 53.1306666666667C42.6026666666667 52.9333333333333 40.1226666666667 52.3733333333333 36.16 50.3946666666667C33.856 49.248 32.832 48.5706666666667 30.72 46.8C27.0613333333333 43.7333333333333 24.176 39.3493333333333 22.6613333333333 34.56C21.5893333333333 31.1786666666667 21.4773333333333 29.9786666666667 21.456 21.9733333333333C21.44 14.816 21.4506666666667 14.592 21.8986666666667 13.76C22.9333333333333 11.8453333333333 24.5386666666667 10.88 26.6666666666667 10.88C28.8053333333333 10.88 30.432 11.8666666666667 31.4133333333333 13.76C31.824 14.56 31.8666666666667 15.1253333333333 32.0213333333333 22.4C32.1653333333333 29.2693333333333 32.2346666666667 30.3253333333333 32.5973333333333 31.3653333333333C34.336 36.336 37.808 39.9253333333333 42.704 41.8133333333333L44.3573333333333 42.4533333333334L63.9893333333333 42.4533333333334L83.616 42.4533333333334L84.9706666666667 41.9466666666667C90.0693333333333 40.0266666666667 93.6533333333333 36.384 95.4026666666667 31.36C95.76 30.3306666666667 95.8293333333333 29.2373333333333 95.9786666666667 22.4C96.1333333333333 15.1306666666667 96.176 14.5546666666667 96.5866666666667 13.76C97.568 11.8666666666667 99.1946666666667 10.88 101.3333333333333 10.88C103.4613333333333 10.88 105.0666666666667 11.8453333333333 106.1013333333333 13.76C106.5493333333333 14.592 106.56 14.8053333333333 106.5333333333333 22.08C106.5066666666667 30.1013333333333 106.432 30.9386666666667 105.3546666666667 34.4533333333334C102.4426666666667 44 94.304 51.1306666666667 84.4106666666667 52.816C82.7946666666667 53.0933333333333 79.8346666666667 53.1626666666667 67.52 53.216C59.3066666666667 53.2533333333333 50.6186666666667 53.216 48.2133333333333 53.1306666666667" />
-    <glyph glyph-name="circle-stop-locked"
+      horiz-adv-x="128" d="M38.5066666666667 122.4746666666667C28.7306666666667 122.3466666666667 28.4426666666667 122.3306666666667 27.0933333333333 121.8506666666667C24.2453333333333 120.832 21.696 119.0346666666667 19.6213333333333 116.5813333333333C18.2933333333333 115.008 17.4613333333333 113.424 16.6506666666667 110.9333333333333L16 108.9226666666667L16 64L16 19.0773333333333L16.6506666666667 17.0666666666667C17.7813333333333 13.5733333333334 19.2586666666667 11.36 22 9.0293333333333C23.648 7.632 25.2053333333333 6.8053333333333 27.7333333333333 5.984L29.744 5.3333333333333L64 5.3333333333333L98.256 5.3333333333333L100.2666666666667 5.984C103.7386666666667 7.1093333333333 105.9093333333333 8.5706666666667 108.3146666666667 11.3866666666667C109.7333333333333 13.0453333333333 110.528 14.5386666666667 111.3493333333333 17.0666666666667L112 19.0773333333333L111.9946666666667 55.3493333333333C111.9893333333333 90.4533333333333 111.9786666666667 91.6533333333333 111.5893333333333 92.512C111.3493333333333 93.0346666666667 109.744 94.9226666666667 107.6746666666667 97.0986666666667C102.128 102.9493333333333 83.8346666666667 120.9973333333333 82.6826666666667 121.76L81.632 122.4533333333333L70.9493333333333 122.4533333333333C65.072 122.4533333333333 57.6266666666667 122.4906666666667 54.4 122.5333333333333C51.1733333333333 122.576 44.0213333333333 122.5493333333333 38.5066666666667 122.4746666666667M69.392 102.88C69.4613333333333 97.3333333333333 69.6 93.2586666666667 69.7546666666667 92.48C70.0853333333333 90.7573333333333 71.6213333333333 87.6586666666667 72.9546666666667 86.032C73.5466666666667 85.3013333333333 74.6346666666667 84.2133333333333 75.3653333333333 83.6213333333333C76.992 82.288 80.0906666666667 80.752 81.8133333333333 80.4213333333333C82.5813333333333 80.272 86.7253333333333 80.128 92.2133333333333 80.0586666666667L101.3333333333333 79.9413333333334L101.3333333333333 50.096C101.3333333333333 23.7813333333333 101.296 20.16 101.008 19.472C100.5013333333333 18.2613333333333 99.7066666666667 17.344 98.608 16.6986666666667L97.6 16.1066666666667L64 16.1066666666667L30.4 16.1066666666667L29.376 16.7093333333333C28.24 17.376 27.2053333333333 18.656 26.864 19.8186666666667C26.7093333333333 20.352 26.6613333333333 34.0533333333333 26.704 64.32L26.7733333333333 108.0533333333333L27.2693333333333 109.0613333333333C27.8293333333333 110.1973333333333 28.7146666666667 111.0293333333333 29.9733333333333 111.6C30.7786666666667 111.968 31.9093333333333 111.9893333333333 50.0533333333333 111.9946666666667L69.2746666666667 112L69.392 102.88M98.7733333333333 90.816C98.7733333333333 90.72 95.392 90.672 91.2533333333333 90.7093333333333L83.7333333333333 90.7733333333333L82.7093333333333 91.376C81.4346666666667 92.1226666666667 80.528 93.3546666666667 80.2293333333333 94.7413333333333C80.0906666666667 95.376 80 98.624 80 102.784L80 109.76L89.3866666666667 100.3733333333333C94.5493333333333 95.2106666666667 98.7733333333333 90.912 98.7733333333333 90.816M42.6666666666667 85.1413333333333C40.5706666666667 84.9706666666667 39.808 84.6293333333333 38.7413333333333 83.3813333333334C37.856 82.3466666666667 37.552 81.4293333333334 37.5466666666667 79.8346666666667C37.5466666666667 77.872 38.5706666666667 76.24 40.4266666666667 75.232C41.248 74.7893333333333 41.5146666666667 74.7733333333333 48 74.7733333333333C54.4853333333333 74.7733333333333 54.752 74.7893333333333 55.5733333333333 75.232C57.488 76.2666666666667 58.4533333333333 77.872 58.4533333333333 80C58.4533333333333 82.1013333333333 57.6373333333333 83.5093333333333 55.7866666666667 84.5866666666667C54.9706666666667 85.0666666666667 54.6986666666667 85.0933333333333 49.7066666666667 85.1893333333333C46.832 85.248 43.664 85.2266666666667 42.6666666666667 85.1413333333333M46.9333333333333 63.808C40.112 63.664 40.128 63.6693333333333 38.7413333333333 62.048C37.856 61.0133333333333 37.552 60.096 37.5466666666667 58.5013333333333C37.5466666666667 56.4693333333333 38.5973333333333 54.864 40.5813333333333 53.8453333333333L41.584 53.3333333333333L64 53.3333333333333L86.416 53.3333333333333L87.4186666666667 53.8453333333333C89.4613333333333 54.8906666666667 90.4533333333333 56.464 90.4533333333333 58.6666666666667C90.4533333333333 60.7733333333333 89.632 62.1866666666667 87.7866666666667 63.248L86.9333333333333 63.744L69.9733333333333 63.8346666666667C60.6453333333333 63.888 50.2773333333333 63.872 46.9333333333333 63.808M46.9333333333333 42.4746666666667C40.112 42.3306666666667 40.128 42.336 38.7413333333333 40.7146666666667C37.856 39.68 37.552 38.7626666666667 37.5466666666667 37.168C37.5466666666667 35.136 38.5973333333333 33.5306666666667 40.5813333333333 32.512L41.584 32L64 32L86.416 32L87.4186666666667 32.512C89.4613333333333 33.5573333333333 90.4533333333333 35.1306666666667 90.4533333333333 37.3333333333333C90.4533333333333 39.44 89.632 40.8533333333333 87.7866666666667 41.9146666666667L86.9333333333333 42.4106666666667L69.9733333333333 42.5013333333334C60.6453333333333 42.5546666666667 50.2773333333333 42.5386666666667 46.9333333333333 42.4746666666667" />
+    <glyph glyph-name="file-text-1"
+      unicode="&#x66;&#x69;&#x6C;&#x65;&#x2D;&#x74;&#x65;&#x78;&#x74;"
+      horiz-adv-x="128" d="M38.5066666666667 122.4746666666667C28.7306666666667 122.3466666666667 28.4426666666667 122.3306666666667 27.0933333333333 121.8506666666667C24.2453333333333 120.832 21.696 119.0346666666667 19.6213333333333 116.5813333333333C18.2933333333333 115.008 17.4613333333333 113.424 16.6506666666667 110.9333333333333L16 108.9226666666667L16 64L16 19.0773333333333L16.6506666666667 17.0666666666667C17.7813333333333 13.5733333333334 19.2586666666667 11.36 22 9.0293333333333C23.648 7.632 25.2053333333333 6.8053333333333 27.7333333333333 5.984L29.744 5.3333333333333L64 5.3333333333333L98.256 5.3333333333333L100.2666666666667 5.984C103.7386666666667 7.1093333333333 105.9093333333333 8.5706666666667 108.3146666666667 11.3866666666667C109.7333333333333 13.0453333333333 110.528 14.5386666666667 111.3493333333333 17.0666666666667L112 19.0773333333333L111.9946666666667 55.3493333333333C111.9893333333333 90.4533333333333 111.9786666666667 91.6533333333333 111.5893333333333 92.512C111.3493333333333 93.0346666666667 109.744 94.9226666666667 107.6746666666667 97.0986666666667C102.128 102.9493333333333 83.8346666666667 120.9973333333333 82.6826666666667 121.76L81.632 122.4533333333333L70.9493333333333 122.4533333333333C65.072 122.4533333333333 57.6266666666667 122.4906666666667 54.4 122.5333333333333C51.1733333333333 122.576 44.0213333333333 122.5493333333333 38.5066666666667 122.4746666666667M69.392 102.88C69.4613333333333 97.3333333333333 69.6 93.2586666666667 69.7546666666667 92.48C70.0853333333333 90.7573333333333 71.6213333333333 87.6586666666667 72.9546666666667 86.032C73.5466666666667 85.3013333333333 74.6346666666667 84.2133333333333 75.3653333333333 83.6213333333333C76.992 82.288 80.0906666666667 80.752 81.8133333333333 80.4213333333333C82.5813333333333 80.272 86.7253333333333 80.128 92.2133333333333 80.0586666666667L101.3333333333333 79.9413333333334L101.3333333333333 50.096C101.3333333333333 23.7813333333333 101.296 20.16 101.008 19.472C100.5013333333333 18.2613333333333 99.7066666666667 17.344 98.608 16.6986666666667L97.6 16.1066666666667L64 16.1066666666667L30.4 16.1066666666667L29.376 16.7093333333333C28.24 17.376 27.2053333333333 18.656 26.864 19.8186666666667C26.7093333333333 20.352 26.6613333333333 34.0533333333333 26.704 64.32L26.7733333333333 108.0533333333333L27.2693333333333 109.0613333333333C27.8293333333333 110.1973333333333 28.7146666666667 111.0293333333333 29.9733333333333 111.6C30.7786666666667 111.968 31.9093333333333 111.9893333333333 50.0533333333333 111.9946666666667L69.2746666666667 112L69.392 102.88M98.7733333333333 90.816C98.7733333333333 90.72 95.392 90.672 91.2533333333333 90.7093333333333L83.7333333333333 90.7733333333333L82.7093333333333 91.376C81.4346666666667 92.1226666666667 80.528 93.3546666666667 80.2293333333333 94.7413333333333C80.0906666666667 95.376 80 98.624 80 102.784L80 109.76L89.3866666666667 100.3733333333333C94.5493333333333 95.2106666666667 98.7733333333333 90.912 98.7733333333333 90.816M42.6666666666667 85.1413333333333C40.5706666666667 84.9706666666667 39.808 84.6293333333333 38.7413333333333 83.3813333333334C37.856 82.3466666666667 37.552 81.4293333333334 37.5466666666667 79.8346666666667C37.5466666666667 77.872 38.5706666666667 76.24 40.4266666666667 75.232C41.248 74.7893333333333 41.5146666666667 74.7733333333333 48 74.7733333333333C54.4853333333333 74.7733333333333 54.752 74.7893333333333 55.5733333333333 75.232C57.488 76.2666666666667 58.4533333333333 77.872 58.4533333333333 80C58.4533333333333 82.1013333333333 57.6373333333333 83.5093333333333 55.7866666666667 84.5866666666667C54.9706666666667 85.0666666666667 54.6986666666667 85.0933333333333 49.7066666666667 85.1893333333333C46.832 85.248 43.664 85.2266666666667 42.6666666666667 85.1413333333333M46.9333333333333 63.808C40.112 63.664 40.128 63.6693333333333 38.7413333333333 62.048C37.856 61.0133333333333 37.552 60.096 37.5466666666667 58.5013333333333C37.5466666666667 56.4693333333333 38.5973333333333 54.864 40.5813333333333 53.8453333333333L41.584 53.3333333333333L64 53.3333333333333L86.416 53.3333333333333L87.4186666666667 53.8453333333333C89.4613333333333 54.8906666666667 90.4533333333333 56.464 90.4533333333333 58.6666666666667C90.4533333333333 60.7733333333333 89.632 62.1866666666667 87.7866666666667 63.248L86.9333333333333 63.744L69.9733333333333 63.8346666666667C60.6453333333333 63.888 50.2773333333333 63.872 46.9333333333333 63.808M46.9333333333333 42.4746666666667C40.112 42.3306666666667 40.128 42.336 38.7413333333333 40.7146666666667C37.856 39.68 37.552 38.7626666666667 37.5466666666667 37.168C37.5466666666667 35.136 38.5973333333333 33.5306666666667 40.5813333333333 32.512L41.584 32L64 32L86.416 32L87.4186666666667 32.512C89.4613333333333 33.5573333333333 90.4533333333333 35.1306666666667 90.4533333333333 37.3333333333333C90.4533333333333 39.44 89.632 40.8533333333333 87.7866666666667 41.9146666666667L86.9333333333333 42.4106666666667L69.9733333333333 42.5013333333334C60.6453333333333 42.5546666666667 50.2773333333333 42.5386666666667 46.9333333333333 42.4746666666667" />
+    <glyph glyph-name="chevron-left"
       unicode="&#xF116;"
-      horiz-adv-x="128" d="M62.4 109.4293333333333C50.9226666666667 108.6506666666667 39.7066666666667 103.3653333333333 31.808 95.024C25.024 87.856 20.832 79.216 19.2906666666667 69.2266666666667C18.7946666666667 66.0106666666667 18.7946666666667 59.2 19.2906666666667 56.032C20.8533333333333 46.0266666666667 25.0506666666667 37.4293333333333 31.7866666666667 30.4213333333333C39.6586666666667 22.2346666666667 49.312 17.392 60.3306666666667 16.1013333333333C64.3733333333333 15.632 66.4693333333333 15.68 67.632 16.2666666666667C70.1013333333333 17.5146666666667 70.6933333333333 20.656 68.8533333333333 22.7466666666667C67.8026666666667 23.9466666666667 67.248 24.1173333333333 63.8186666666667 24.3253333333333C62.1013333333333 24.432 59.648 24.7146666666667 58.3733333333333 24.9653333333333C42.6826666666667 28 30.2293333333333 40.912 27.824 56.64C25.9413333333333 68.9386666666667 29.808 80.9386666666667 38.464 89.648C47.8933333333333 99.136 61.1573333333333 103.0293333333333 74.224 100.128C79.9253333333333 98.864 85.296 96.2346666666667 90.1333333333333 92.3466666666667C93.9786666666667 89.2533333333333 98.0213333333333 84.1386666666667 100.1973333333333 79.616C100.7466666666667 78.48 101.3813333333333 77.2693333333333 101.616 76.9333333333333C102.128 76.1866666666667 103.9466666666667 75.312 104.96 75.312C106.6666666666667 75.3173333333333 108.56 76.8213333333333 109.024 78.5386666666667C109.3386666666667 79.7066666666667 109.072 80.736 107.776 83.3813333333334C105.5466666666667 87.9306666666667 103.184 91.3173333333333 99.7333333333333 94.912C92.576 102.3626666666667 83.5733333333333 107.1946666666667 73.664 108.896C71.9573333333333 109.1946666666667 65.9626666666667 109.6906666666667 65.0666666666667 109.616C64.8906666666667 109.6053333333333 63.6906666666667 109.52 62.4 109.4293333333333M51.776 79.488C50.688 79.1893333333333 49.68 78.3786666666667 49.0986666666667 77.3333333333333C48.7786666666667 76.7573333333333 48.7466666666667 75.344 48.7466666666667 62.72L48.7466666666667 48.7466666666667L49.264 47.8453333333333C49.5466666666667 47.344 50.1653333333333 46.672 50.6346666666667 46.352L51.4826666666667 45.76L65.4773333333333 45.7013333333333L79.4666666666667 45.6426666666667L80.4213333333333 46.128C80.9866666666667 46.416 81.648 46.992 82.0213333333333 47.536L82.6666666666667 48.464L82.7306666666667 62.1493333333334C82.7733333333333 71.6266666666667 82.7253333333333 76.0853333333333 82.56 76.6453333333333C82.288 77.5893333333333 81.2746666666667 78.8053333333333 80.3413333333333 79.3173333333333C79.744 79.648 78.432 79.6853333333334 66.24 79.7226666666667C55.7066666666667 79.76 52.576 79.7066666666667 51.776 79.488M74.24 62.72L74.24 54.1866666666667L65.7066666666667 54.1866666666667L57.1733333333333 54.1866666666667L57.1733333333333 62.72L57.1733333333333 71.2533333333333L65.7066666666667 71.2533333333333L74.24 71.2533333333333L74.24 62.72M100.5866666666667 61.4346666666667C96.7466666666667 60.9226666666667 93.104 58.3733333333333 91.136 54.8266666666667C90.0693333333333 52.9066666666667 89.7546666666667 51.4346666666667 89.616 47.7866666666667L89.4933333333333 44.48L88.2453333333333 44.3253333333333C84.912 43.9093333333333 81.9306666666667 41.024 81.2853333333333 37.5733333333334C80.992 36.016 81.0026666666667 23.248 81.3013333333333 21.648C81.7173333333333 19.3813333333333 83.0026666666667 17.4506666666667 84.9546666666667 16.1546666666667C87.1573333333333 14.6933333333333 86.832 14.72 102.4 14.72C117.968 14.72 117.6426666666667 14.6933333333333 119.8453333333333 16.1546666666667C121.7973333333333 17.4506666666667 123.0826666666667 19.3813333333333 123.4986666666667 21.648C123.7973333333333 23.248 123.808 36.016 123.5146666666667 37.5733333333334C122.8693333333333 41.0026666666667 119.872 43.9146666666667 116.5546666666667 44.3253333333333L115.3066666666667 44.48L115.184 47.7866666666667C115.0453333333333 51.4346666666667 114.7306666666667 52.9066666666667 113.664 54.8266666666667C111.0666666666667 59.5146666666667 105.8666666666667 62.144 100.5866666666667 61.4346666666667M104.672 52.3946666666667C105.1253333333333 52.0906666666667 105.7333333333333 51.4933333333333 106.0266666666667 51.0613333333333C106.5173333333333 50.336 106.5653333333333 50.048 106.6293333333333 47.4293333333333L106.6986666666667 44.5866666666667L102.4 44.5866666666667L98.1013333333333 44.5866666666667L98.1706666666667 47.4346666666667C98.2346666666667 50.128 98.272 50.3253333333333 98.8213333333333 51.1146666666667C99.376 51.9146666666667 100.304 52.624 101.2266666666667 52.9493333333333C102.0586666666667 53.248 103.8186666666667 52.96 104.672 52.3946666666667M115.2 29.6533333333333L115.2 23.2533333333333L102.4 23.2533333333333L89.6 23.2533333333333L89.6 29.6533333333333L89.6 36.0533333333333L102.4 36.0533333333333L115.2 36.0533333333333L115.2 29.6533333333333" />
-    <glyph glyph-name="circle-stop-locked-1"
-      unicode="&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x73;&#x74;&#x6F;&#x70;&#x2D;&#x6C;&#x6F;&#x63;&#x6B;&#x65;&#x64;"
-      horiz-adv-x="128" d="M62.4 109.4293333333333C50.9226666666667 108.6506666666667 39.7066666666667 103.3653333333333 31.808 95.024C25.024 87.856 20.832 79.216 19.2906666666667 69.2266666666667C18.7946666666667 66.0106666666667 18.7946666666667 59.2 19.2906666666667 56.032C20.8533333333333 46.0266666666667 25.0506666666667 37.4293333333333 31.7866666666667 30.4213333333333C39.6586666666667 22.2346666666667 49.312 17.392 60.3306666666667 16.1013333333333C64.3733333333333 15.632 66.4693333333333 15.68 67.632 16.2666666666667C70.1013333333333 17.5146666666667 70.6933333333333 20.656 68.8533333333333 22.7466666666667C67.8026666666667 23.9466666666667 67.248 24.1173333333333 63.8186666666667 24.3253333333333C62.1013333333333 24.432 59.648 24.7146666666667 58.3733333333333 24.9653333333333C42.6826666666667 28 30.2293333333333 40.912 27.824 56.64C25.9413333333333 68.9386666666667 29.808 80.9386666666667 38.464 89.648C47.8933333333333 99.136 61.1573333333333 103.0293333333333 74.224 100.128C79.9253333333333 98.864 85.296 96.2346666666667 90.1333333333333 92.3466666666667C93.9786666666667 89.2533333333333 98.0213333333333 84.1386666666667 100.1973333333333 79.616C100.7466666666667 78.48 101.3813333333333 77.2693333333333 101.616 76.9333333333333C102.128 76.1866666666667 103.9466666666667 75.312 104.96 75.312C106.6666666666667 75.3173333333333 108.56 76.8213333333333 109.024 78.5386666666667C109.3386666666667 79.7066666666667 109.072 80.736 107.776 83.3813333333334C105.5466666666667 87.9306666666667 103.184 91.3173333333333 99.7333333333333 94.912C92.576 102.3626666666667 83.5733333333333 107.1946666666667 73.664 108.896C71.9573333333333 109.1946666666667 65.9626666666667 109.6906666666667 65.0666666666667 109.616C64.8906666666667 109.6053333333333 63.6906666666667 109.52 62.4 109.4293333333333M51.776 79.488C50.688 79.1893333333333 49.68 78.3786666666667 49.0986666666667 77.3333333333333C48.7786666666667 76.7573333333333 48.7466666666667 75.344 48.7466666666667 62.72L48.7466666666667 48.7466666666667L49.264 47.8453333333333C49.5466666666667 47.344 50.1653333333333 46.672 50.6346666666667 46.352L51.4826666666667 45.76L65.4773333333333 45.7013333333333L79.4666666666667 45.6426666666667L80.4213333333333 46.128C80.9866666666667 46.416 81.648 46.992 82.0213333333333 47.536L82.6666666666667 48.464L82.7306666666667 62.1493333333334C82.7733333333333 71.6266666666667 82.7253333333333 76.0853333333333 82.56 76.6453333333333C82.288 77.5893333333333 81.2746666666667 78.8053333333333 80.3413333333333 79.3173333333333C79.744 79.648 78.432 79.6853333333334 66.24 79.7226666666667C55.7066666666667 79.76 52.576 79.7066666666667 51.776 79.488M74.24 62.72L74.24 54.1866666666667L65.7066666666667 54.1866666666667L57.1733333333333 54.1866666666667L57.1733333333333 62.72L57.1733333333333 71.2533333333333L65.7066666666667 71.2533333333333L74.24 71.2533333333333L74.24 62.72M100.5866666666667 61.4346666666667C96.7466666666667 60.9226666666667 93.104 58.3733333333333 91.136 54.8266666666667C90.0693333333333 52.9066666666667 89.7546666666667 51.4346666666667 89.616 47.7866666666667L89.4933333333333 44.48L88.2453333333333 44.3253333333333C84.912 43.9093333333333 81.9306666666667 41.024 81.2853333333333 37.5733333333334C80.992 36.016 81.0026666666667 23.248 81.3013333333333 21.648C81.7173333333333 19.3813333333333 83.0026666666667 17.4506666666667 84.9546666666667 16.1546666666667C87.1573333333333 14.6933333333333 86.832 14.72 102.4 14.72C117.968 14.72 117.6426666666667 14.6933333333333 119.8453333333333 16.1546666666667C121.7973333333333 17.4506666666667 123.0826666666667 19.3813333333333 123.4986666666667 21.648C123.7973333333333 23.248 123.808 36.016 123.5146666666667 37.5733333333334C122.8693333333333 41.0026666666667 119.872 43.9146666666667 116.5546666666667 44.3253333333333L115.3066666666667 44.48L115.184 47.7866666666667C115.0453333333333 51.4346666666667 114.7306666666667 52.9066666666667 113.664 54.8266666666667C111.0666666666667 59.5146666666667 105.8666666666667 62.144 100.5866666666667 61.4346666666667M104.672 52.3946666666667C105.1253333333333 52.0906666666667 105.7333333333333 51.4933333333333 106.0266666666667 51.0613333333333C106.5173333333333 50.336 106.5653333333333 50.048 106.6293333333333 47.4293333333333L106.6986666666667 44.5866666666667L102.4 44.5866666666667L98.1013333333333 44.5866666666667L98.1706666666667 47.4346666666667C98.2346666666667 50.128 98.272 50.3253333333333 98.8213333333333 51.1146666666667C99.376 51.9146666666667 100.304 52.624 101.2266666666667 52.9493333333333C102.0586666666667 53.248 103.8186666666667 52.96 104.672 52.3946666666667M115.2 29.6533333333333L115.2 23.2533333333333L102.4 23.2533333333333L89.6 23.2533333333333L89.6 29.6533333333333L89.6 36.0533333333333L102.4 36.0533333333333L115.2 36.0533333333333L115.2 29.6533333333333" />
-    <glyph glyph-name="sliders-horizontal"
+      horiz-adv-x="128" d="M78.9333333333333 101.136C78.5226666666667 101.0506666666667 77.8506666666667 100.8106666666667 77.44 100.6026666666667C76.2666666666667 100.0053333333333 43.8773333333333 67.5093333333333 43.296 66.3466666666667C42.6346666666667 65.024 42.6346666666667 62.976 43.296 61.6533333333333C43.9733333333333 60.2933333333333 76.2933333333333 27.9733333333333 77.6533333333333 27.296C79.584 26.3306666666667 82.1653333333333 26.7573333333333 83.7066666666667 28.2933333333333C85.2426666666667 29.8346666666667 85.6693333333333 32.416 84.704 34.3466666666667C84.3626666666667 35.0293333333333 80.0533333333333 39.4826666666667 69.904 49.6533333333333L55.5786666666667 64L69.904 78.3466666666667C80.0533333333333 88.5173333333333 84.3626666666667 92.9706666666667 84.704 93.6533333333333C85.344 94.9386666666667 85.3653333333333 97.0293333333333 84.7466666666667 98.2453333333333C83.632 100.4266666666667 81.2533333333333 101.6106666666667 78.9333333333333 101.136" />
+    <glyph glyph-name="chevron-left-1"
+      unicode="&#x63;&#x68;&#x65;&#x76;&#x72;&#x6F;&#x6E;&#x2D;&#x6C;&#x65;&#x66;&#x74;"
+      horiz-adv-x="128" d="M78.9333333333333 101.136C78.5226666666667 101.0506666666667 77.8506666666667 100.8106666666667 77.44 100.6026666666667C76.2666666666667 100.0053333333333 43.8773333333333 67.5093333333333 43.296 66.3466666666667C42.6346666666667 65.024 42.6346666666667 62.976 43.296 61.6533333333333C43.9733333333333 60.2933333333333 76.2933333333333 27.9733333333333 77.6533333333333 27.296C79.584 26.3306666666667 82.1653333333333 26.7573333333333 83.7066666666667 28.2933333333333C85.2426666666667 29.8346666666667 85.6693333333333 32.416 84.704 34.3466666666667C84.3626666666667 35.0293333333333 80.0533333333333 39.4826666666667 69.904 49.6533333333333L55.5786666666667 64L69.904 78.3466666666667C80.0533333333333 88.5173333333333 84.3626666666667 92.9706666666667 84.704 93.6533333333333C85.344 94.9386666666667 85.3653333333333 97.0293333333333 84.7466666666667 98.2453333333333C83.632 100.4266666666667 81.2533333333333 101.6106666666667 78.9333333333333 101.136" />
+    <glyph glyph-name="copy-plus"
       unicode="&#xF117;"
-      horiz-adv-x="128" d="M72.624 122.1493333333333C71.6533333333333 121.728 70.4373333333333 120.5866666666667 69.9093333333333 119.5946666666667C69.44 118.7253333333334 69.44 118.6613333333333 69.44 106.6666666666667C69.44 94.7146666666667 69.4453333333333 94.608 69.8986666666667 93.76C70.9333333333333 91.8453333333333 72.5386666666667 90.88 74.6666666666667 90.88C76.192 90.88 77.28 91.2853333333333 78.2613333333333 92.224C79.6426666666667 93.5466666666667 79.8453333333333 94.2453333333333 79.9573333333333 97.9573333333333L80.0533333333333 101.296L96.72 101.3706666666667C113.312 101.4453333333333 113.392 101.4453333333333 114.24 101.904C116.1706666666667 102.944 117.1253333333333 104.5386666666667 117.1146666666667 106.7146666666667C117.1093333333333 108.3626666666667 116.624 109.5093333333333 115.5146666666667 110.48C113.9146666666667 111.888 114.8266666666667 111.8133333333333 96.624 111.9466666666667L80.0533333333333 112.064L79.9573333333333 115.392C79.872 118.2186666666667 79.792 118.848 79.4133333333333 119.5733333333334C78.8853333333333 120.5973333333334 78.0586666666667 121.3973333333333 76.912 122.0053333333334C75.9093333333333 122.5333333333333 73.6746666666667 122.608 72.624 122.1493333333333M19.6266666666667 111.808C13.52 111.664 13.4453333333333 111.648 12.0746666666667 110.048C11.1893333333333 109.0133333333333 10.8853333333333 108.096 10.88 106.5013333333333C10.88 104.4693333333333 11.9306666666667 102.864 13.9146666666667 101.8453333333333L14.9173333333333 101.3333333333333L34.6666666666667 101.3333333333333L54.416 101.3333333333333L55.4186666666667 101.8453333333333C57.4613333333333 102.8906666666667 58.4533333333333 104.464 58.4533333333333 106.6666666666667C58.4533333333333 108.7733333333333 57.632 110.1866666666667 55.7866666666667 111.248L54.9333333333333 111.744L40 111.84C31.7866666666667 111.888 22.6186666666667 111.8773333333333 19.6266666666667 111.808M40.624 79.4826666666667C39.6373333333333 79.056 38.432 77.9093333333333 37.9253333333333 76.928C37.5413333333333 76.1813333333333 37.4613333333333 75.568 37.376 72.7253333333333L37.28 69.3973333333333L26.0426666666667 69.28C13.7173333333333 69.152 14.048 69.1893333333333 12.4853333333333 67.8133333333333C11.376 66.8426666666667 10.8906666666667 65.696 10.8853333333333 64.048C10.8746666666667 61.872 11.8346666666667 60.272 13.76 59.2373333333333C14.5973333333333 58.7893333333333 14.832 58.7786666666667 25.9466666666667 58.704L37.28 58.6293333333333L37.376 55.2853333333333C37.488 51.5786666666667 37.6906666666667 50.88 39.072 49.5573333333333C40.0533333333333 48.6186666666667 41.1413333333333 48.2133333333333 42.6666666666667 48.2133333333333C44.7946666666667 48.2133333333333 46.4 49.1786666666667 47.4346666666667 51.0933333333333C47.888 51.9413333333334 47.8933333333333 52.048 47.8933333333333 64C47.8933333333333 75.9413333333334 47.888 76.0586666666667 47.4346666666667 76.9066666666667C46.8746666666667 77.9413333333334 46.048 78.736 44.912 79.3386666666667C43.9093333333333 79.8666666666667 41.6746666666667 79.9413333333334 40.624 79.4826666666667M69.0133333333333 69.136C61.36 68.9973333333333 61.4826666666667 69.024 60.0746666666667 67.3813333333334C59.1893333333333 66.3466666666667 58.8853333333333 65.4293333333334 58.88 63.8346666666667C58.88 61.8026666666667 59.9306666666667 60.1973333333334 61.9146666666667 59.1786666666667L62.9173333333333 58.6666666666667L88 58.6666666666667L113.0826666666667 58.6666666666667L114.0853333333333 59.1786666666667C116.128 60.224 117.12 61.7973333333333 117.12 64C117.12 66.1066666666667 116.2986666666667 67.52 114.4533333333333 68.5813333333333L113.6 69.0773333333333L94.72 69.168C84.336 69.2213333333333 72.768 69.2053333333333 69.0133333333333 69.136M83.2906666666667 36.816C82.32 36.3946666666667 81.104 35.2533333333333 80.576 34.2613333333333C80.1066666666667 33.392 80.1066666666667 33.328 80.1066666666667 21.3333333333333C80.1066666666667 9.3813333333333 80.112 9.2746666666667 80.5653333333333 8.4266666666667C81.6 6.512 83.2053333333333 5.5466666666667 85.3333333333333 5.5466666666667C86.8586666666667 5.5466666666667 87.9466666666667 5.952 88.928 6.8906666666667C90.3093333333333 8.2133333333333 90.512 8.912 90.624 12.6186666666667L90.72 15.9626666666667L102.0533333333333 16.0373333333334C113.168 16.112 113.4026666666667 16.1226666666667 114.24 16.5706666666667C116.1653333333333 17.6053333333333 117.1253333333333 19.2053333333333 117.1146666666667 21.3813333333333C117.1093333333333 23.0293333333333 116.624 24.176 115.5146666666667 25.1466666666667C113.952 26.5226666666667 114.2826666666667 26.4853333333333 101.9573333333333 26.6133333333333L90.72 26.7306666666667L90.624 30.0586666666667C90.5386666666667 32.8853333333333 90.4586666666667 33.5146666666667 90.08 34.24C89.552 35.264 88.7253333333333 36.064 87.5786666666667 36.672C86.576 37.2 84.3413333333333 37.2746666666667 83.2906666666667 36.816M21.0133333333333 26.4693333333333C13.36 26.3306666666667 13.4826666666667 26.3573333333333 12.0746666666667 24.7146666666667C11.1893333333333 23.68 10.8853333333333 22.7626666666667 10.88 21.168C10.88 19.136 11.9306666666667 17.5306666666667 13.9146666666667 16.512L14.9173333333333 16L40 16L65.0826666666667 16L66.0853333333333 16.512C68.128 17.5573333333333 69.12 19.1306666666667 69.12 21.3333333333333C69.12 23.44 68.2986666666667 24.8533333333333 66.4533333333333 25.9146666666667L65.6 26.4106666666667L46.72 26.5013333333334C36.336 26.5546666666667 24.768 26.5386666666667 21.0133333333333 26.4693333333333" />
-    <glyph glyph-name="sliders-horizontal-1"
-      unicode="&#x73;&#x6C;&#x69;&#x64;&#x65;&#x72;&#x73;&#x2D;&#x68;&#x6F;&#x72;&#x69;&#x7A;&#x6F;&#x6E;&#x74;&#x61;&#x6C;"
-      horiz-adv-x="128" d="M72.624 122.1493333333333C71.6533333333333 121.728 70.4373333333333 120.5866666666667 69.9093333333333 119.5946666666667C69.44 118.7253333333334 69.44 118.6613333333333 69.44 106.6666666666667C69.44 94.7146666666667 69.4453333333333 94.608 69.8986666666667 93.76C70.9333333333333 91.8453333333333 72.5386666666667 90.88 74.6666666666667 90.88C76.192 90.88 77.28 91.2853333333333 78.2613333333333 92.224C79.6426666666667 93.5466666666667 79.8453333333333 94.2453333333333 79.9573333333333 97.9573333333333L80.0533333333333 101.296L96.72 101.3706666666667C113.312 101.4453333333333 113.392 101.4453333333333 114.24 101.904C116.1706666666667 102.944 117.1253333333333 104.5386666666667 117.1146666666667 106.7146666666667C117.1093333333333 108.3626666666667 116.624 109.5093333333333 115.5146666666667 110.48C113.9146666666667 111.888 114.8266666666667 111.8133333333333 96.624 111.9466666666667L80.0533333333333 112.064L79.9573333333333 115.392C79.872 118.2186666666667 79.792 118.848 79.4133333333333 119.5733333333334C78.8853333333333 120.5973333333334 78.0586666666667 121.3973333333333 76.912 122.0053333333334C75.9093333333333 122.5333333333333 73.6746666666667 122.608 72.624 122.1493333333333M19.6266666666667 111.808C13.52 111.664 13.4453333333333 111.648 12.0746666666667 110.048C11.1893333333333 109.0133333333333 10.8853333333333 108.096 10.88 106.5013333333333C10.88 104.4693333333333 11.9306666666667 102.864 13.9146666666667 101.8453333333333L14.9173333333333 101.3333333333333L34.6666666666667 101.3333333333333L54.416 101.3333333333333L55.4186666666667 101.8453333333333C57.4613333333333 102.8906666666667 58.4533333333333 104.464 58.4533333333333 106.6666666666667C58.4533333333333 108.7733333333333 57.632 110.1866666666667 55.7866666666667 111.248L54.9333333333333 111.744L40 111.84C31.7866666666667 111.888 22.6186666666667 111.8773333333333 19.6266666666667 111.808M40.624 79.4826666666667C39.6373333333333 79.056 38.432 77.9093333333333 37.9253333333333 76.928C37.5413333333333 76.1813333333333 37.4613333333333 75.568 37.376 72.7253333333333L37.28 69.3973333333333L26.0426666666667 69.28C13.7173333333333 69.152 14.048 69.1893333333333 12.4853333333333 67.8133333333333C11.376 66.8426666666667 10.8906666666667 65.696 10.8853333333333 64.048C10.8746666666667 61.872 11.8346666666667 60.272 13.76 59.2373333333333C14.5973333333333 58.7893333333333 14.832 58.7786666666667 25.9466666666667 58.704L37.28 58.6293333333333L37.376 55.2853333333333C37.488 51.5786666666667 37.6906666666667 50.88 39.072 49.5573333333333C40.0533333333333 48.6186666666667 41.1413333333333 48.2133333333333 42.6666666666667 48.2133333333333C44.7946666666667 48.2133333333333 46.4 49.1786666666667 47.4346666666667 51.0933333333333C47.888 51.9413333333334 47.8933333333333 52.048 47.8933333333333 64C47.8933333333333 75.9413333333334 47.888 76.0586666666667 47.4346666666667 76.9066666666667C46.8746666666667 77.9413333333334 46.048 78.736 44.912 79.3386666666667C43.9093333333333 79.8666666666667 41.6746666666667 79.9413333333334 40.624 79.4826666666667M69.0133333333333 69.136C61.36 68.9973333333333 61.4826666666667 69.024 60.0746666666667 67.3813333333334C59.1893333333333 66.3466666666667 58.8853333333333 65.4293333333334 58.88 63.8346666666667C58.88 61.8026666666667 59.9306666666667 60.1973333333334 61.9146666666667 59.1786666666667L62.9173333333333 58.6666666666667L88 58.6666666666667L113.0826666666667 58.6666666666667L114.0853333333333 59.1786666666667C116.128 60.224 117.12 61.7973333333333 117.12 64C117.12 66.1066666666667 116.2986666666667 67.52 114.4533333333333 68.5813333333333L113.6 69.0773333333333L94.72 69.168C84.336 69.2213333333333 72.768 69.2053333333333 69.0133333333333 69.136M83.2906666666667 36.816C82.32 36.3946666666667 81.104 35.2533333333333 80.576 34.2613333333333C80.1066666666667 33.392 80.1066666666667 33.328 80.1066666666667 21.3333333333333C80.1066666666667 9.3813333333333 80.112 9.2746666666667 80.5653333333333 8.4266666666667C81.6 6.512 83.2053333333333 5.5466666666667 85.3333333333333 5.5466666666667C86.8586666666667 5.5466666666667 87.9466666666667 5.952 88.928 6.8906666666667C90.3093333333333 8.2133333333333 90.512 8.912 90.624 12.6186666666667L90.72 15.9626666666667L102.0533333333333 16.0373333333334C113.168 16.112 113.4026666666667 16.1226666666667 114.24 16.5706666666667C116.1653333333333 17.6053333333333 117.1253333333333 19.2053333333333 117.1146666666667 21.3813333333333C117.1093333333333 23.0293333333333 116.624 24.176 115.5146666666667 25.1466666666667C113.952 26.5226666666667 114.2826666666667 26.4853333333333 101.9573333333333 26.6133333333333L90.72 26.7306666666667L90.624 30.0586666666667C90.5386666666667 32.8853333333333 90.4586666666667 33.5146666666667 90.08 34.24C89.552 35.264 88.7253333333333 36.064 87.5786666666667 36.672C86.576 37.2 84.3413333333333 37.2746666666667 83.2906666666667 36.816M21.0133333333333 26.4693333333333C13.36 26.3306666666667 13.4826666666667 26.3573333333333 12.0746666666667 24.7146666666667C11.1893333333333 23.68 10.8853333333333 22.7626666666667 10.88 21.168C10.88 19.136 11.9306666666667 17.5306666666667 13.9146666666667 16.512L14.9173333333333 16L40 16L65.0826666666667 16L66.0853333333333 16.512C68.128 17.5573333333333 69.12 19.1306666666667 69.12 21.3333333333333C69.12 23.44 68.2986666666667 24.8533333333333 66.4533333333333 25.9146666666667L65.6 26.4106666666667L46.72 26.5013333333334C36.336 26.5546666666667 24.768 26.5386666666667 21.0133333333333 26.4693333333333" />
-    <glyph glyph-name="panel-left"
+      horiz-adv-x="128" d="M19.3066666666667 122.448C13.0933333333333 121.7386666666667 7.744 117.0933333333333 5.936 110.8266666666667L5.44 109.12L5.44 80L5.44 50.88L5.936 49.1733333333333C6.7626666666667 46.3093333333333 7.952 44.3146666666667 10.1333333333333 42.1333333333333C13.2213333333333 39.0453333333333 16.64 37.552 20.7466666666667 37.4933333333333C22.3626666666667 37.472 22.8746666666667 37.552 23.5786666666667 37.9146666666667C25.5146666666667 38.9173333333333 26.5173333333333 40.5386666666667 26.5173333333333 42.6666666666667C26.5173333333333 45.584 24.624 47.5733333333333 21.5306666666667 47.904C18.9813333333333 48.176 17.4186666666667 49.168 16.5066666666667 51.0933333333333L16.0053333333333 52.16L16.0053333333333 80C16.0106666666667 107.5466666666667 16.016 107.8506666666667 16.4426666666667 108.8C17.0293333333333 110.0906666666667 17.8133333333333 110.8853333333333 19.0933333333333 111.4933333333333L20.16 111.9946666666667L48 111.9946666666667L75.84 111.9946666666667L76.9066666666667 111.4933333333333C78.832 110.5813333333333 79.824 109.0186666666667 80.096 106.4693333333333C80.4266666666667 103.376 82.416 101.4826666666667 85.3333333333333 101.4826666666667C87.4613333333333 101.4826666666667 89.0826666666667 102.4853333333333 90.0853333333333 104.4213333333333C90.448 105.12 90.5226666666667 105.632 90.5013333333333 107.2C90.4373333333333 111.3706666666667 88.9546666666667 114.7786666666667 85.8666666666667 117.8666666666667C83.728 120.0053333333334 81.7546666666667 121.2 78.9333333333333 122.0586666666667L77.3333333333333 122.5493333333333L49.0666666666667 122.5813333333333C33.52 122.6026666666667 20.128 122.5386666666667 19.3066666666667 122.448M51.4133333333333 90.464C47.8133333333333 90.0693333333333 44.864 88.6133333333334 42.1226666666667 85.8773333333333C39.9466666666667 83.696 38.7733333333333 81.7226666666667 37.9306666666667 78.816L37.44 77.12L37.44 48L37.44 18.88L37.9306666666667 17.184C38.7733333333333 14.2773333333333 39.9466666666667 12.304 42.1226666666667 10.1226666666667C44.304 7.9466666666667 46.2773333333333 6.7733333333333 49.184 5.9306666666667L50.88 5.44L80 5.44L109.12 5.44L110.816 5.9306666666667C113.7226666666667 6.7733333333333 115.696 7.9466666666667 117.8773333333333 10.1226666666667C120.0533333333334 12.304 121.2266666666667 14.2773333333333 122.0693333333333 17.184L122.56 18.88L122.56 48L122.56 77.12L122.0693333333333 78.816C121.2266666666667 81.7226666666667 120.0533333333334 83.696 117.8773333333333 85.8773333333333C115.7386666666667 88.0106666666667 113.7973333333333 89.184 110.928 90.0586666666667L109.3333333333333 90.5493333333333L81.0666666666667 90.5813333333333C65.52 90.5973333333333 52.176 90.544 51.4133333333333 90.464M108.9066666666667 79.4933333333333C110.1866666666667 78.8853333333333 110.9706666666667 78.0906666666667 111.5573333333333 76.8C111.984 75.8506666666667 111.9893333333333 75.5466666666667 111.9946666666667 48L111.9946666666667 20.16L111.4933333333333 19.0933333333333C110.8853333333333 17.8133333333333 110.0906666666667 17.0293333333333 108.8 16.4426666666667C107.8506666666667 16.016 107.552 16.0106666666667 80 16.0106666666667C52.448 16.0106666666667 52.1493333333333 16.016 51.2 16.4426666666667C49.9093333333333 17.0293333333333 49.1146666666667 17.8133333333333 48.5066666666667 19.0933333333333L48.0053333333333 20.16L48.0053333333333 48C48.0106666666667 75.5466666666667 48.016 75.8506666666667 48.4426666666667 76.8C49.0293333333333 78.0906666666667 49.8133333333333 78.8853333333333 51.0933333333333 79.4933333333333L52.16 79.9946666666667L80 79.9946666666667L107.84 79.9946666666667L108.9066666666667 79.4933333333333M78.9333333333333 69.136C77.3706666666667 68.816 76.0586666666667 67.792 75.232 66.2453333333333C74.8 65.4346666666667 74.7733333333333 65.04 74.704 59.376L74.6346666666667 53.3653333333333L68.624 53.296C62.96 53.2266666666667 62.5653333333333 53.2 61.7546666666667 52.768C59.8026666666667 51.7226666666667 58.816 50.1226666666667 58.816 48C58.816 45.8773333333333 59.8026666666667 44.2773333333333 61.7546666666667 43.232C62.5653333333333 42.8 62.96 42.7733333333333 68.624 42.704L74.6346666666667 42.6346666666667L74.704 36.624C74.7733333333333 30.96 74.8 30.5653333333333 75.232 29.7546666666667C76.2773333333333 27.8026666666667 77.8773333333333 26.816 80 26.816C82.1226666666667 26.816 83.7226666666667 27.8026666666667 84.768 29.7546666666667C85.2 30.5653333333333 85.2266666666667 30.96 85.296 36.624L85.3653333333333 42.6346666666667L91.376 42.704C97.04 42.7733333333333 97.4346666666667 42.8 98.2453333333333 43.232C100.1973333333333 44.2773333333333 101.184 45.8773333333333 101.184 48C101.184 50.1226666666667 100.1973333333333 51.7226666666667 98.2453333333333 52.768C97.4346666666667 53.2 97.04 53.2266666666667 91.376 53.296L85.3653333333333 53.3653333333333L85.296 59.376C85.2266666666667 65.04 85.2 65.4346666666667 84.768 66.2453333333333C83.5893333333333 68.4533333333334 81.248 69.6106666666667 78.9333333333333 69.136" />
+    <glyph glyph-name="copy-plus-1"
+      unicode="&#x63;&#x6F;&#x70;&#x79;&#x2D;&#x70;&#x6C;&#x75;&#x73;"
+      horiz-adv-x="128" d="M19.3066666666667 122.448C13.0933333333333 121.7386666666667 7.744 117.0933333333333 5.936 110.8266666666667L5.44 109.12L5.44 80L5.44 50.88L5.936 49.1733333333333C6.7626666666667 46.3093333333333 7.952 44.3146666666667 10.1333333333333 42.1333333333333C13.2213333333333 39.0453333333333 16.64 37.552 20.7466666666667 37.4933333333333C22.3626666666667 37.472 22.8746666666667 37.552 23.5786666666667 37.9146666666667C25.5146666666667 38.9173333333333 26.5173333333333 40.5386666666667 26.5173333333333 42.6666666666667C26.5173333333333 45.584 24.624 47.5733333333333 21.5306666666667 47.904C18.9813333333333 48.176 17.4186666666667 49.168 16.5066666666667 51.0933333333333L16.0053333333333 52.16L16.0053333333333 80C16.0106666666667 107.5466666666667 16.016 107.8506666666667 16.4426666666667 108.8C17.0293333333333 110.0906666666667 17.8133333333333 110.8853333333333 19.0933333333333 111.4933333333333L20.16 111.9946666666667L48 111.9946666666667L75.84 111.9946666666667L76.9066666666667 111.4933333333333C78.832 110.5813333333333 79.824 109.0186666666667 80.096 106.4693333333333C80.4266666666667 103.376 82.416 101.4826666666667 85.3333333333333 101.4826666666667C87.4613333333333 101.4826666666667 89.0826666666667 102.4853333333333 90.0853333333333 104.4213333333333C90.448 105.12 90.5226666666667 105.632 90.5013333333333 107.2C90.4373333333333 111.3706666666667 88.9546666666667 114.7786666666667 85.8666666666667 117.8666666666667C83.728 120.0053333333334 81.7546666666667 121.2 78.9333333333333 122.0586666666667L77.3333333333333 122.5493333333333L49.0666666666667 122.5813333333333C33.52 122.6026666666667 20.128 122.5386666666667 19.3066666666667 122.448M51.4133333333333 90.464C47.8133333333333 90.0693333333333 44.864 88.6133333333334 42.1226666666667 85.8773333333333C39.9466666666667 83.696 38.7733333333333 81.7226666666667 37.9306666666667 78.816L37.44 77.12L37.44 48L37.44 18.88L37.9306666666667 17.184C38.7733333333333 14.2773333333333 39.9466666666667 12.304 42.1226666666667 10.1226666666667C44.304 7.9466666666667 46.2773333333333 6.7733333333333 49.184 5.9306666666667L50.88 5.44L80 5.44L109.12 5.44L110.816 5.9306666666667C113.7226666666667 6.7733333333333 115.696 7.9466666666667 117.8773333333333 10.1226666666667C120.0533333333334 12.304 121.2266666666667 14.2773333333333 122.0693333333333 17.184L122.56 18.88L122.56 48L122.56 77.12L122.0693333333333 78.816C121.2266666666667 81.7226666666667 120.0533333333334 83.696 117.8773333333333 85.8773333333333C115.7386666666667 88.0106666666667 113.7973333333333 89.184 110.928 90.0586666666667L109.3333333333333 90.5493333333333L81.0666666666667 90.5813333333333C65.52 90.5973333333333 52.176 90.544 51.4133333333333 90.464M108.9066666666667 79.4933333333333C110.1866666666667 78.8853333333333 110.9706666666667 78.0906666666667 111.5573333333333 76.8C111.984 75.8506666666667 111.9893333333333 75.5466666666667 111.9946666666667 48L111.9946666666667 20.16L111.4933333333333 19.0933333333333C110.8853333333333 17.8133333333333 110.0906666666667 17.0293333333333 108.8 16.4426666666667C107.8506666666667 16.016 107.552 16.0106666666667 80 16.0106666666667C52.448 16.0106666666667 52.1493333333333 16.016 51.2 16.4426666666667C49.9093333333333 17.0293333333333 49.1146666666667 17.8133333333333 48.5066666666667 19.0933333333333L48.0053333333333 20.16L48.0053333333333 48C48.0106666666667 75.5466666666667 48.016 75.8506666666667 48.4426666666667 76.8C49.0293333333333 78.0906666666667 49.8133333333333 78.8853333333333 51.0933333333333 79.4933333333333L52.16 79.9946666666667L80 79.9946666666667L107.84 79.9946666666667L108.9066666666667 79.4933333333333M78.9333333333333 69.136C77.3706666666667 68.816 76.0586666666667 67.792 75.232 66.2453333333333C74.8 65.4346666666667 74.7733333333333 65.04 74.704 59.376L74.6346666666667 53.3653333333333L68.624 53.296C62.96 53.2266666666667 62.5653333333333 53.2 61.7546666666667 52.768C59.8026666666667 51.7226666666667 58.816 50.1226666666667 58.816 48C58.816 45.8773333333333 59.8026666666667 44.2773333333333 61.7546666666667 43.232C62.5653333333333 42.8 62.96 42.7733333333333 68.624 42.704L74.6346666666667 42.6346666666667L74.704 36.624C74.7733333333333 30.96 74.8 30.5653333333333 75.232 29.7546666666667C76.2773333333333 27.8026666666667 77.8773333333333 26.816 80 26.816C82.1226666666667 26.816 83.7226666666667 27.8026666666667 84.768 29.7546666666667C85.2 30.5653333333333 85.2266666666667 30.96 85.296 36.624L85.3653333333333 42.6346666666667L91.376 42.704C97.04 42.7733333333333 97.4346666666667 42.8 98.2453333333333 43.232C100.1973333333333 44.2773333333333 101.184 45.8773333333333 101.184 48C101.184 50.1226666666667 100.1973333333333 51.7226666666667 98.2453333333333 52.768C97.4346666666667 53.2 97.04 53.2266666666667 91.376 53.296L85.3653333333333 53.3653333333333L85.296 59.376C85.2266666666667 65.04 85.2 65.4346666666667 84.768 66.2453333333333C83.5893333333333 68.4533333333334 81.248 69.6106666666667 78.9333333333333 69.136" />
+    <glyph glyph-name="pause"
       unicode="&#xF118;"
-      horiz-adv-x="128" d="M22.848 116.7893333333333C19.0346666666667 115.9626666666667 14.5706666666667 112.4853333333333 12.6133333333333 108.8213333333333C12.2613333333333 108.1546666666667 11.6746666666667 106.704 11.3173333333333 105.6L10.6666666666667 103.5893333333333L10.6666666666667 64L10.6666666666667 24.4106666666667L11.3173333333333 22.4C12.448 18.9066666666667 13.9253333333333 16.6933333333333 16.6666666666667 14.3626666666667C18.3146666666667 12.9653333333333 19.872 12.1386666666667 22.4 11.3173333333333L24.4106666666667 10.6666666666667L64 10.6666666666667L103.5893333333333 10.6666666666667L105.6 11.3173333333333C108.128 12.1386666666667 109.6213333333333 12.9333333333333 111.28 14.352C114.096 16.7573333333333 115.5573333333333 18.928 116.6826666666667 22.4L117.3333333333333 24.4106666666667L117.3333333333333 64L117.3333333333333 103.5893333333333L116.6826666666667 105.6C115.5413333333334 109.12 114.1493333333333 111.1946666666667 111.28 113.648C109.7706666666667 114.9386666666667 108.2666666666667 115.776 106.0693333333333 116.5653333333333L104.5066666666667 117.12L64.3626666666667 117.104C30.9653333333333 117.088 23.984 117.0346666666667 22.848 116.7893333333333M42.6666666666667 63.9893333333333L42.6666666666667 21.312L33.8666666666667 21.376L25.0666666666667 21.44L24.0586666666667 22.032C22.96 22.6773333333333 22.1653333333333 23.5946666666667 21.6586666666667 24.8053333333333C21.3706666666667 25.4986666666667 21.3333333333333 29.7546666666667 21.3493333333333 61.9146666666667C21.36 81.8933333333334 21.4346666666667 99.4026666666667 21.5146666666667 100.8266666666667C21.648 103.1466666666667 21.7226666666667 103.4986666666667 22.2453333333333 104.288C22.9706666666667 105.376 24.1653333333333 106.192 25.4026666666667 106.4373333333333C25.9253333333333 106.5386666666667 30.0213333333333 106.6293333333333 34.5066666666667 106.6453333333333L42.6666666666667 106.6666666666667L42.6666666666667 63.9893333333333M103.728 106.064C104.864 105.504 105.696 104.6186666666667 106.2666666666667 103.36C106.64 102.544 106.656 100.8053333333333 106.6613333333333 64.048C106.6666666666667 29.9893333333334 106.6293333333333 25.4986666666667 106.3413333333333 24.8053333333333C105.8346666666667 23.5946666666667 105.04 22.6773333333333 103.9413333333333 22.032L102.9333333333333 21.44L78.1333333333333 21.3813333333333L53.3333333333333 21.3173333333333L53.3333333333333 64.0053333333333L53.3333333333333 106.688L78.0266666666667 106.624L102.72 106.56L103.728 106.064" />
-    <glyph glyph-name="panel-left-1"
-      unicode="&#x70;&#x61;&#x6E;&#x65;&#x6C;&#x2D;&#x6C;&#x65;&#x66;&#x74;"
-      horiz-adv-x="128" d="M22.848 116.7893333333333C19.0346666666667 115.9626666666667 14.5706666666667 112.4853333333333 12.6133333333333 108.8213333333333C12.2613333333333 108.1546666666667 11.6746666666667 106.704 11.3173333333333 105.6L10.6666666666667 103.5893333333333L10.6666666666667 64L10.6666666666667 24.4106666666667L11.3173333333333 22.4C12.448 18.9066666666667 13.9253333333333 16.6933333333333 16.6666666666667 14.3626666666667C18.3146666666667 12.9653333333333 19.872 12.1386666666667 22.4 11.3173333333333L24.4106666666667 10.6666666666667L64 10.6666666666667L103.5893333333333 10.6666666666667L105.6 11.3173333333333C108.128 12.1386666666667 109.6213333333333 12.9333333333333 111.28 14.352C114.096 16.7573333333333 115.5573333333333 18.928 116.6826666666667 22.4L117.3333333333333 24.4106666666667L117.3333333333333 64L117.3333333333333 103.5893333333333L116.6826666666667 105.6C115.5413333333334 109.12 114.1493333333333 111.1946666666667 111.28 113.648C109.7706666666667 114.9386666666667 108.2666666666667 115.776 106.0693333333333 116.5653333333333L104.5066666666667 117.12L64.3626666666667 117.104C30.9653333333333 117.088 23.984 117.0346666666667 22.848 116.7893333333333M42.6666666666667 63.9893333333333L42.6666666666667 21.312L33.8666666666667 21.376L25.0666666666667 21.44L24.0586666666667 22.032C22.96 22.6773333333333 22.1653333333333 23.5946666666667 21.6586666666667 24.8053333333333C21.3706666666667 25.4986666666667 21.3333333333333 29.7546666666667 21.3493333333333 61.9146666666667C21.36 81.8933333333334 21.4346666666667 99.4026666666667 21.5146666666667 100.8266666666667C21.648 103.1466666666667 21.7226666666667 103.4986666666667 22.2453333333333 104.288C22.9706666666667 105.376 24.1653333333333 106.192 25.4026666666667 106.4373333333333C25.9253333333333 106.5386666666667 30.0213333333333 106.6293333333333 34.5066666666667 106.6453333333333L42.6666666666667 106.6666666666667L42.6666666666667 63.9893333333333M103.728 106.064C104.864 105.504 105.696 104.6186666666667 106.2666666666667 103.36C106.64 102.544 106.656 100.8053333333333 106.6613333333333 64.048C106.6666666666667 29.9893333333334 106.6293333333333 25.4986666666667 106.3413333333333 24.8053333333333C105.8346666666667 23.5946666666667 105.04 22.6773333333333 103.9413333333333 22.032L102.9333333333333 21.44L78.1333333333333 21.3813333333333L53.3333333333333 21.3173333333333L53.3333333333333 64.0053333333333L53.3333333333333 106.688L78.0266666666667 106.624L102.72 106.56L103.728 106.064" />
-    <glyph glyph-name="pencil-line"
+      horiz-adv-x="128" d="M36.6933333333333 111.7973333333333C33.536 111.5306666666667 31.84 110.752 29.8506666666667 108.6613333333333C28.432 107.1733333333333 27.6906666666667 105.9413333333333 27.1626666666667 104.2133333333333C26.7893333333333 102.992 26.7733333333333 101.1093333333333 26.7733333333333 64L26.7733333333333 25.0666666666667L27.2426666666667 23.5733333333334C28.3146666666667 20.1813333333333 30.848 17.648 34.24 16.576C35.6533333333333 16.1333333333333 36.1066666666667 16.1066666666667 42.6666666666667 16.1066666666667C49.2266666666667 16.1066666666667 49.68 16.1333333333333 51.0933333333333 16.576C54.4853333333333 17.648 57.0186666666667 20.1813333333333 58.0906666666667 23.5733333333334L58.56 25.0666666666667L58.56 64L58.56 102.9333333333333L58.0906666666667 104.4266666666667C57.0453333333333 107.7333333333333 54.5546666666667 110.24 51.2106666666667 111.36C49.9626666666667 111.776 49.2853333333333 111.8293333333333 44.2773333333333 111.8933333333333C41.2213333333333 111.936 37.808 111.888 36.6933333333333 111.7973333333333M79.36 111.7973333333333C76.2026666666667 111.5306666666667 74.5066666666667 110.752 72.5173333333333 108.6613333333333C71.0986666666667 107.1733333333333 70.3573333333333 105.9413333333333 69.8293333333333 104.2133333333333C69.456 102.992 69.44 101.1093333333333 69.44 64L69.44 25.0666666666667L69.9093333333333 23.5733333333334C70.9813333333333 20.1813333333333 73.5146666666667 17.648 76.9066666666667 16.576C78.32 16.1333333333333 78.7733333333333 16.1066666666667 85.3333333333333 16.1066666666667C91.9146666666667 16.1066666666667 92.3413333333333 16.1333333333333 93.76 16.5813333333333C95.6 17.168 96.5333333333333 17.728 97.952 19.0986666666667C99.392 20.4853333333333 100.176 21.7386666666667 100.7573333333333 23.5733333333334L101.2266666666667 25.0666666666667L101.2266666666667 64L101.2266666666667 102.9333333333333L100.7573333333333 104.4266666666667C99.712 107.7333333333333 97.2213333333333 110.24 93.8773333333333 111.36C92.6293333333333 111.776 91.952 111.8293333333333 86.944 111.8933333333333C83.888 111.936 80.4746666666667 111.888 79.36 111.7973333333333M48 64L48 26.6666666666667L42.6666666666667 26.6666666666667L37.3333333333333 26.6666666666667L37.3333333333333 64L37.3333333333333 101.3333333333333L42.6666666666667 101.3333333333333L48 101.3333333333333L48 64M90.6666666666667 64L90.6666666666667 26.6666666666667L85.3333333333333 26.6666666666667L80 26.6666666666667L80 64L80 101.3333333333333L85.3333333333333 101.3333333333333L90.6666666666667 101.3333333333333L90.6666666666667 64" />
+    <glyph glyph-name="pause-1"
+      unicode="&#x70;&#x61;&#x75;&#x73;&#x65;"
+      horiz-adv-x="128" d="M36.6933333333333 111.7973333333333C33.536 111.5306666666667 31.84 110.752 29.8506666666667 108.6613333333333C28.432 107.1733333333333 27.6906666666667 105.9413333333333 27.1626666666667 104.2133333333333C26.7893333333333 102.992 26.7733333333333 101.1093333333333 26.7733333333333 64L26.7733333333333 25.0666666666667L27.2426666666667 23.5733333333334C28.3146666666667 20.1813333333333 30.848 17.648 34.24 16.576C35.6533333333333 16.1333333333333 36.1066666666667 16.1066666666667 42.6666666666667 16.1066666666667C49.2266666666667 16.1066666666667 49.68 16.1333333333333 51.0933333333333 16.576C54.4853333333333 17.648 57.0186666666667 20.1813333333333 58.0906666666667 23.5733333333334L58.56 25.0666666666667L58.56 64L58.56 102.9333333333333L58.0906666666667 104.4266666666667C57.0453333333333 107.7333333333333 54.5546666666667 110.24 51.2106666666667 111.36C49.9626666666667 111.776 49.2853333333333 111.8293333333333 44.2773333333333 111.8933333333333C41.2213333333333 111.936 37.808 111.888 36.6933333333333 111.7973333333333M79.36 111.7973333333333C76.2026666666667 111.5306666666667 74.5066666666667 110.752 72.5173333333333 108.6613333333333C71.0986666666667 107.1733333333333 70.3573333333333 105.9413333333333 69.8293333333333 104.2133333333333C69.456 102.992 69.44 101.1093333333333 69.44 64L69.44 25.0666666666667L69.9093333333333 23.5733333333334C70.9813333333333 20.1813333333333 73.5146666666667 17.648 76.9066666666667 16.576C78.32 16.1333333333333 78.7733333333333 16.1066666666667 85.3333333333333 16.1066666666667C91.9146666666667 16.1066666666667 92.3413333333333 16.1333333333333 93.76 16.5813333333333C95.6 17.168 96.5333333333333 17.728 97.952 19.0986666666667C99.392 20.4853333333333 100.176 21.7386666666667 100.7573333333333 23.5733333333334L101.2266666666667 25.0666666666667L101.2266666666667 64L101.2266666666667 102.9333333333333L100.7573333333333 104.4266666666667C99.712 107.7333333333333 97.2213333333333 110.24 93.8773333333333 111.36C92.6293333333333 111.776 91.952 111.8293333333333 86.944 111.8933333333333C83.888 111.936 80.4746666666667 111.888 79.36 111.7973333333333M48 64L48 26.6666666666667L42.6666666666667 26.6666666666667L37.3333333333333 26.6666666666667L37.3333333333333 64L37.3333333333333 101.3333333333333L42.6666666666667 101.3333333333333L48 101.3333333333333L48 64M90.6666666666667 64L90.6666666666667 26.6666666666667L85.3333333333333 26.6666666666667L80 26.6666666666667L80 64L80 101.3333333333333L85.3333333333333 101.3333333333333L90.6666666666667 101.3333333333333L90.6666666666667 64" />
+    <glyph glyph-name="book-marked"
       unicode="&#xF119;"
-      horiz-adv-x="128" d="M91.7813333333333 117.328C89.7173333333333 116.7893333333333 87.8826666666667 115.888 86.0746666666667 114.5333333333333C84.4373333333333 113.3066666666667 45.7866666666667 74.8586666666667 27.9306666666667 56.6933333333333L16.656 45.2213333333333L16.2133333333333 43.744C14.6026666666667 38.3306666666667 10.88 22.4693333333333 10.88 21.0186666666667C10.88 18.9546666666667 12.4373333333333 16.9546666666667 14.5226666666667 16.336C15.5573333333333 16.0266666666667 15.7813333333333 16.032 17.792 16.4373333333333C20.5866666666667 17.0026666666667 38.5173333333333 21.5093333333333 39.376 21.8666666666667C39.744 22.016 45.3546666666667 27.3653333333333 51.9626666666667 33.872C69.3226666666667 50.944 107.9146666666667 89.7066666666667 109.0506666666667 91.2C110.416 93.0026666666667 111.248 94.5706666666667 111.824 96.4266666666667C112.2613333333333 97.8346666666667 112.32 98.4533333333333 112.3146666666667 101.5466666666667C112.3093333333333 104.8106666666667 112.272 105.1786666666667 111.744 106.624C110.8533333333333 109.0826666666667 109.5626666666667 111.0666666666667 107.5413333333333 113.0773333333333C105.984 114.624 105.3653333333333 115.0666666666667 103.4666666666667 116.0053333333334C102.144 116.6613333333333 100.5866666666667 117.2426666666667 99.664 117.4346666666667C97.4666666666667 117.8933333333333 93.7333333333333 117.84 91.7813333333333 117.328M97.8346666666667 106.992C100.048 106.336 101.7226666666667 104.1386666666667 101.92 101.632C102.0853333333333 99.5786666666667 101.4506666666667 98.4373333333333 98.464 95.3973333333333L96.016 92.9066666666667L91.792 97.1253333333334L87.5733333333333 101.3493333333333L90.064 103.7973333333333C93.536 107.2106666666667 95.0293333333333 107.824 97.8346666666667 106.992M84.2666666666667 89.4933333333333L88.4266666666667 85.3333333333333L61.456 58.3626666666667L34.4853333333333 31.3866666666667L29.0933333333333 30.048C26.128 29.312 23.632 28.7786666666667 23.5413333333333 28.864C23.456 28.9546666666667 23.984 31.4453333333333 24.7093333333333 34.4053333333333L26.0373333333333 39.7866666666667L52.9653333333333 66.72C67.776 81.5306666666667 79.9413333333333 93.6533333333333 80 93.6533333333333C80.064 93.6533333333333 81.9786666666667 91.7813333333333 84.2666666666667 89.4933333333333M69.0133333333333 26.4693333333333C61.36 26.3306666666667 61.4826666666667 26.3573333333333 60.0746666666667 24.7146666666667C59.1893333333333 23.68 58.8853333333333 22.7626666666667 58.88 21.168C58.88 19.136 59.9306666666667 17.5306666666667 61.9146666666667 16.512L62.9173333333333 16L88 16L113.0826666666667 16L114.0853333333333 16.512C116.128 17.5573333333333 117.12 19.1306666666667 117.12 21.3333333333333C117.12 23.44 116.2986666666667 24.8533333333333 114.4533333333333 25.9146666666667L113.6 26.4106666666667L94.72 26.5013333333334C84.336 26.5546666666667 72.768 26.5386666666667 69.0133333333333 26.4693333333333" />
-    <glyph glyph-name="pencil-line-1"
-      unicode="&#x70;&#x65;&#x6E;&#x63;&#x69;&#x6C;&#x2D;&#x6C;&#x69;&#x6E;&#x65;"
-      horiz-adv-x="128" d="M91.7813333333333 117.328C89.7173333333333 116.7893333333333 87.8826666666667 115.888 86.0746666666667 114.5333333333333C84.4373333333333 113.3066666666667 45.7866666666667 74.8586666666667 27.9306666666667 56.6933333333333L16.656 45.2213333333333L16.2133333333333 43.744C14.6026666666667 38.3306666666667 10.88 22.4693333333333 10.88 21.0186666666667C10.88 18.9546666666667 12.4373333333333 16.9546666666667 14.5226666666667 16.336C15.5573333333333 16.0266666666667 15.7813333333333 16.032 17.792 16.4373333333333C20.5866666666667 17.0026666666667 38.5173333333333 21.5093333333333 39.376 21.8666666666667C39.744 22.016 45.3546666666667 27.3653333333333 51.9626666666667 33.872C69.3226666666667 50.944 107.9146666666667 89.7066666666667 109.0506666666667 91.2C110.416 93.0026666666667 111.248 94.5706666666667 111.824 96.4266666666667C112.2613333333333 97.8346666666667 112.32 98.4533333333333 112.3146666666667 101.5466666666667C112.3093333333333 104.8106666666667 112.272 105.1786666666667 111.744 106.624C110.8533333333333 109.0826666666667 109.5626666666667 111.0666666666667 107.5413333333333 113.0773333333333C105.984 114.624 105.3653333333333 115.0666666666667 103.4666666666667 116.0053333333334C102.144 116.6613333333333 100.5866666666667 117.2426666666667 99.664 117.4346666666667C97.4666666666667 117.8933333333333 93.7333333333333 117.84 91.7813333333333 117.328M97.8346666666667 106.992C100.048 106.336 101.7226666666667 104.1386666666667 101.92 101.632C102.0853333333333 99.5786666666667 101.4506666666667 98.4373333333333 98.464 95.3973333333333L96.016 92.9066666666667L91.792 97.1253333333334L87.5733333333333 101.3493333333333L90.064 103.7973333333333C93.536 107.2106666666667 95.0293333333333 107.824 97.8346666666667 106.992M84.2666666666667 89.4933333333333L88.4266666666667 85.3333333333333L61.456 58.3626666666667L34.4853333333333 31.3866666666667L29.0933333333333 30.048C26.128 29.312 23.632 28.7786666666667 23.5413333333333 28.864C23.456 28.9546666666667 23.984 31.4453333333333 24.7093333333333 34.4053333333333L26.0373333333333 39.7866666666667L52.9653333333333 66.72C67.776 81.5306666666667 79.9413333333333 93.6533333333333 80 93.6533333333333C80.064 93.6533333333333 81.9786666666667 91.7813333333333 84.2666666666667 89.4933333333333M69.0133333333333 26.4693333333333C61.36 26.3306666666667 61.4826666666667 26.3573333333333 60.0746666666667 24.7146666666667C59.1893333333333 23.68 58.8853333333333 22.7626666666667 58.88 21.168C58.88 19.136 59.9306666666667 17.5306666666667 61.9146666666667 16.512L62.9173333333333 16L88 16L113.0826666666667 16L114.0853333333333 16.512C116.128 17.5573333333333 117.12 19.1306666666667 117.12 21.3333333333333C117.12 23.44 116.2986666666667 24.8533333333333 114.4533333333333 25.9146666666667L113.6 26.4106666666667L94.72 26.5013333333334C84.336 26.5546666666667 72.768 26.5386666666667 69.0133333333333 26.4693333333333" />
-    <glyph glyph-name="info"
+      horiz-adv-x="128" d="M44.9066666666667 122.4426666666667C32.4213333333333 122.336 30.912 122.288 29.76 121.9413333333333C22.992 119.9253333333333 17.9573333333333 114.5333333333333 16.496 107.7333333333333C16.128 106.0106666666667 16.1066666666667 103.808 16.1066666666667 64.1066666666667C16.1066666666667 19.0613333333334 16.0533333333333 21.2213333333333 17.2053333333333 17.8346666666667C19.232 11.8506666666667 24.272 7.3813333333333 30.7306666666667 5.84C32.2133333333333 5.488 34.8 5.4613333333333 70.016 5.392L107.7173333333333 5.3173333333333L108.736 5.84C109.952 6.4586666666667 110.9333333333333 7.4506666666667 111.552 8.6826666666667L112 9.584L112 64L112 118.416L111.4826666666667 119.44C110.944 120.496 109.872 121.584 108.848 122.1013333333333C108.368 122.3466666666667 104.064 122.4106666666667 83.52 122.48C69.9093333333333 122.5226666666667 52.5333333333333 122.5066666666667 44.9066666666667 122.4426666666667M48.0373333333333 92.64L48.1066666666667 73.28L48.5706666666667 72.4106666666667C49.168 71.296 50.5013333333333 70.096 51.5093333333333 69.7653333333333C51.952 69.616 52.9386666666667 69.536 53.728 69.584C54.9173333333333 69.648 55.3173333333333 69.7813333333333 56.2133333333333 70.3946666666667C56.8 70.7946666666667 59.9893333333333 73.808 63.3013333333333 77.088L69.3226666666667 83.0506666666667L75.472 76.992C78.8533333333333 73.6586666666667 82.0373333333333 70.6453333333333 82.544 70.2986666666667C83.3013333333333 69.7813333333333 83.7386666666667 69.648 84.944 69.5786666666667C86.8213333333333 69.4773333333333 88.0213333333333 69.9093333333333 89.072 71.0773333333333C90.6453333333333 72.816 90.5386666666667 71.344 90.624 92.7466666666667L90.704 112L96.016 112L101.3333333333333 112L101.3333333333333 77.3706666666667L101.3333333333333 42.736L67.5733333333333 42.592C49.008 42.512 32.9013333333333 42.3573333333333 31.7866666666667 42.2453333333333C30.3626666666667 42.1066666666667 29.2906666666667 41.856 28.1813333333333 41.3973333333333L26.6026666666667 40.7413333333333L26.72 73.568C26.8373333333333 106.2666666666667 26.8373333333333 106.3893333333333 27.28 107.2586666666667C27.8986666666667 108.464 29.9786666666667 110.6613333333333 31.0026666666667 111.184C32.24 111.8133333333333 33.904 111.9413333333333 41.3173333333333 111.9733333333333L47.9626666666667 112L48.0373333333333 92.64M80 99.808L80 87.6106666666667L76.64 90.9066666666667C74.7893333333333 92.7253333333333 72.8 94.5386666666667 72.2133333333333 94.944C71.2 95.6426666666667 71.0506666666667 95.68 69.3333333333333 95.68C67.616 95.68 67.4666666666667 95.6426666666667 66.4533333333333 94.944C65.8666666666667 94.5386666666667 63.8773333333333 92.7253333333333 62.0266666666667 90.9066666666667L58.6666666666667 87.6106666666667L58.6666666666667 99.808L58.6666666666667 112L69.3333333333333 112L80 112L80 99.808M101.3333333333333 24L101.3333333333333 16L67.04 16L32.7466666666667 16.0053333333333L31.616 16.528C30.1546666666667 17.2106666666667 28.1066666666667 19.1733333333333 27.4186666666667 20.5493333333334C26.9386666666667 21.5093333333333 26.88 21.888 26.8853333333333 23.9893333333334C26.8906666666667 26.8373333333333 27.1306666666667 27.488 28.912 29.408C30.832 31.4826666666667 31.232 31.6266666666667 35.52 31.792C37.5146666666667 31.8666666666667 53.136 31.9413333333334 70.24 31.9626666666667L101.3333333333333 32L101.3333333333333 24" />
+    <glyph glyph-name="book-marked-1"
+      unicode="&#x62;&#x6F;&#x6F;&#x6B;&#x2D;&#x6D;&#x61;&#x72;&#x6B;&#x65;&#x64;"
+      horiz-adv-x="128" d="M44.9066666666667 122.4426666666667C32.4213333333333 122.336 30.912 122.288 29.76 121.9413333333333C22.992 119.9253333333333 17.9573333333333 114.5333333333333 16.496 107.7333333333333C16.128 106.0106666666667 16.1066666666667 103.808 16.1066666666667 64.1066666666667C16.1066666666667 19.0613333333334 16.0533333333333 21.2213333333333 17.2053333333333 17.8346666666667C19.232 11.8506666666667 24.272 7.3813333333333 30.7306666666667 5.84C32.2133333333333 5.488 34.8 5.4613333333333 70.016 5.392L107.7173333333333 5.3173333333333L108.736 5.84C109.952 6.4586666666667 110.9333333333333 7.4506666666667 111.552 8.6826666666667L112 9.584L112 64L112 118.416L111.4826666666667 119.44C110.944 120.496 109.872 121.584 108.848 122.1013333333333C108.368 122.3466666666667 104.064 122.4106666666667 83.52 122.48C69.9093333333333 122.5226666666667 52.5333333333333 122.5066666666667 44.9066666666667 122.4426666666667M48.0373333333333 92.64L48.1066666666667 73.28L48.5706666666667 72.4106666666667C49.168 71.296 50.5013333333333 70.096 51.5093333333333 69.7653333333333C51.952 69.616 52.9386666666667 69.536 53.728 69.584C54.9173333333333 69.648 55.3173333333333 69.7813333333333 56.2133333333333 70.3946666666667C56.8 70.7946666666667 59.9893333333333 73.808 63.3013333333333 77.088L69.3226666666667 83.0506666666667L75.472 76.992C78.8533333333333 73.6586666666667 82.0373333333333 70.6453333333333 82.544 70.2986666666667C83.3013333333333 69.7813333333333 83.7386666666667 69.648 84.944 69.5786666666667C86.8213333333333 69.4773333333333 88.0213333333333 69.9093333333333 89.072 71.0773333333333C90.6453333333333 72.816 90.5386666666667 71.344 90.624 92.7466666666667L90.704 112L96.016 112L101.3333333333333 112L101.3333333333333 77.3706666666667L101.3333333333333 42.736L67.5733333333333 42.592C49.008 42.512 32.9013333333333 42.3573333333333 31.7866666666667 42.2453333333333C30.3626666666667 42.1066666666667 29.2906666666667 41.856 28.1813333333333 41.3973333333333L26.6026666666667 40.7413333333333L26.72 73.568C26.8373333333333 106.2666666666667 26.8373333333333 106.3893333333333 27.28 107.2586666666667C27.8986666666667 108.464 29.9786666666667 110.6613333333333 31.0026666666667 111.184C32.24 111.8133333333333 33.904 111.9413333333333 41.3173333333333 111.9733333333333L47.9626666666667 112L48.0373333333333 92.64M80 99.808L80 87.6106666666667L76.64 90.9066666666667C74.7893333333333 92.7253333333333 72.8 94.5386666666667 72.2133333333333 94.944C71.2 95.6426666666667 71.0506666666667 95.68 69.3333333333333 95.68C67.616 95.68 67.4666666666667 95.6426666666667 66.4533333333333 94.944C65.8666666666667 94.5386666666667 63.8773333333333 92.7253333333333 62.0266666666667 90.9066666666667L58.6666666666667 87.6106666666667L58.6666666666667 99.808L58.6666666666667 112L69.3333333333333 112L80 112L80 99.808M101.3333333333333 24L101.3333333333333 16L67.04 16L32.7466666666667 16.0053333333333L31.616 16.528C30.1546666666667 17.2106666666667 28.1066666666667 19.1733333333333 27.4186666666667 20.5493333333334C26.9386666666667 21.5093333333333 26.88 21.888 26.8853333333333 23.9893333333334C26.8906666666667 26.8373333333333 27.1306666666667 27.488 28.912 29.408C30.832 31.4826666666667 31.232 31.6266666666667 35.52 31.792C37.5146666666667 31.8666666666667 53.136 31.9413333333334 70.24 31.9626666666667L101.3333333333333 32L101.3333333333333 24" />
+    <glyph glyph-name="moon"
       unicode="&#xF11A;"
-      horiz-adv-x="128" d="M60.16 122.4373333333333C48.3626666666667 121.7066666666667 36.6826666666667 117.1786666666667 27.312 109.712C24.704 107.632 20.368 103.296 18.288 100.688C13.088 94.16 9.0293333333333 85.904 7.0666666666667 77.8346666666667C4.9173333333333 69.0346666666667 4.9173333333333 58.9653333333333 7.0666666666667 50.1653333333333C9.0293333333333 42.096 13.088 33.84 18.288 27.312C20.368 24.704 24.704 20.368 27.312 18.288C32.192 14.4 39.0506666666667 10.608 44.7253333333333 8.6666666666667C59.7493333333333 3.52 75.8186666666667 4.5333333333333 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M62.9333333333333 90.4693333333333C58.9013333333333 89.6426666666667 57.3813333333333 84.544 60.2933333333333 81.6266666666667C61.7706666666667 80.1546666666667 64.4 79.6746666666667 66.24 80.5493333333333C67.9946666666667 81.3813333333334 69.3333333333333 83.4506666666667 69.3333333333333 85.3333333333333C69.3333333333333 87.1786666666667 67.9893333333333 89.3013333333333 66.336 90.064C65.4133333333333 90.4906666666667 63.9093333333333 90.6666666666667 62.9333333333333 90.4693333333333M62.9333333333333 69.136C61.3706666666667 68.816 60.064 67.792 59.232 66.2453333333333C58.7786666666667 65.3973333333333 58.7733333333333 65.2586666666667 58.7733333333333 53.3333333333333C58.7733333333333 41.408 58.7786666666667 41.2693333333333 59.232 40.4213333333333C60.2773333333333 38.4693333333333 61.8773333333333 37.4826666666667 64 37.4826666666667C66.1226666666667 37.4826666666667 67.7226666666667 38.4693333333333 68.768 40.4213333333333C69.2213333333333 41.2693333333333 69.2266666666667 41.408 69.2266666666667 53.3333333333333C69.2266666666667 65.2586666666667 69.2213333333333 65.3973333333333 68.768 66.2453333333333C67.584 68.4533333333334 65.248 69.6106666666667 62.9333333333333 69.136" />
-    <glyph glyph-name="info-1"
-      unicode="&#x69;&#x6E;&#x66;&#x6F;"
-      horiz-adv-x="128" d="M60.16 122.4373333333333C48.3626666666667 121.7066666666667 36.6826666666667 117.1786666666667 27.312 109.712C24.704 107.632 20.368 103.296 18.288 100.688C13.088 94.16 9.0293333333333 85.904 7.0666666666667 77.8346666666667C4.9173333333333 69.0346666666667 4.9173333333333 58.9653333333333 7.0666666666667 50.1653333333333C9.0293333333333 42.096 13.088 33.84 18.288 27.312C20.368 24.704 24.704 20.368 27.312 18.288C32.192 14.4 39.0506666666667 10.608 44.7253333333333 8.6666666666667C59.7493333333333 3.52 75.8186666666667 4.5333333333333 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M62.9333333333333 90.4693333333333C58.9013333333333 89.6426666666667 57.3813333333333 84.544 60.2933333333333 81.6266666666667C61.7706666666667 80.1546666666667 64.4 79.6746666666667 66.24 80.5493333333333C67.9946666666667 81.3813333333334 69.3333333333333 83.4506666666667 69.3333333333333 85.3333333333333C69.3333333333333 87.1786666666667 67.9893333333333 89.3013333333333 66.336 90.064C65.4133333333333 90.4906666666667 63.9093333333333 90.6666666666667 62.9333333333333 90.4693333333333M62.9333333333333 69.136C61.3706666666667 68.816 60.064 67.792 59.232 66.2453333333333C58.7786666666667 65.3973333333333 58.7733333333333 65.2586666666667 58.7733333333333 53.3333333333333C58.7733333333333 41.408 58.7786666666667 41.2693333333333 59.232 40.4213333333333C60.2773333333333 38.4693333333333 61.8773333333333 37.4826666666667 64 37.4826666666667C66.1226666666667 37.4826666666667 67.7226666666667 38.4693333333333 68.768 40.4213333333333C69.2213333333333 41.2693333333333 69.2266666666667 41.408 69.2266666666667 53.3333333333333C69.2266666666667 65.2586666666667 69.2213333333333 65.3973333333333 68.768 66.2453333333333C67.584 68.4533333333334 65.248 69.6106666666667 62.9333333333333 69.136" />
-    <glyph glyph-name="database-off"
+      horiz-adv-x="128" d="M58.7733333333333 116.976C50.3146666666667 115.92 43.8453333333333 113.8186666666667 37.2586666666667 110C25.7546666666667 103.3173333333333 17.568 93.1413333333333 13.3706666666667 80.304C11.5253333333333 74.6506666666667 10.88 70.3946666666667 10.8853333333333 63.8986666666667C10.8906666666667 57.2213333333333 11.5946666666667 52.8906666666667 13.68 46.7626666666667C19.0986666666667 30.8106666666667 31.4666666666667 18.672 47.728 13.36C53.344 11.5253333333334 57.616 10.88 64.1013333333333 10.8853333333333C70.56 10.8906666666667 74.5386666666667 11.4986666666667 80.2826666666667 13.3706666666667C88.624 16.08 95.5733333333333 20.2986666666667 101.536 26.2773333333333C111.0613333333333 35.8293333333333 116.6613333333333 48.4853333333333 117.0613333333333 61.3653333333333C117.1733333333333 65.0453333333333 117.1573333333333 65.2853333333333 116.7093333333333 66.2026666666667C116.1226666666667 67.4186666666667 114.8373333333333 68.5973333333333 113.776 68.8906666666667C112.6453333333333 69.2053333333333 110.8426666666667 69.1786666666667 110.0213333333333 68.832C109.6426666666667 68.672 108.3253333333333 67.7066666666667 107.0933333333333 66.688C103.1306666666667 63.3973333333333 100.4533333333333 61.888 96.2933333333333 60.608C92.7893333333333 59.5253333333333 90.592 59.2373333333333 86.9333333333333 59.3813333333334C82.544 59.552 79.568 60.2613333333333 75.6213333333333 62.0746666666667C67.5413333333333 65.7866666666667 61.264 74.0426666666667 59.7173333333333 82.9866666666667C59.3546666666667 85.0933333333333 59.344 91.248 59.696 92.9066666666667C60.896 98.48 63.2106666666667 103.1413333333333 66.7893333333333 107.2C68.5066666666667 109.1466666666667 69.1146666666667 110.4373333333333 69.1146666666667 112.1066666666667C69.1093333333333 112.8853333333333 68.96 113.7226666666667 68.72 114.24C68.224 115.3386666666667 66.816 116.6026666666667 65.776 116.8906666666667C65.0186666666667 117.0986666666667 60.2346666666667 117.1573333333333 58.7733333333333 116.976M52.4106666666667 104.8C52.3466666666667 104.592 51.8986666666667 103.392 51.424 102.1226666666667C49.5946666666667 97.2906666666667 48.7893333333333 92.928 48.7946666666667 87.8933333333334C48.8106666666667 72.7413333333333 57.28 59.2426666666667 70.9066666666667 52.6773333333333C81.0613333333333 47.7813333333333 92.2026666666667 47.4666666666667 103.1093333333333 51.776C104.144 52.1813333333333 105.0293333333333 52.48 105.072 52.4373333333333C105.4133333333333 52.1013333333333 102.2773333333333 44.832 100.56 41.968C97.584 37.0133333333334 92.5813333333333 31.7813333333333 87.6426666666667 28.4693333333333C82.9173333333333 25.3013333333333 76.8426666666667 22.864 71.1893333333333 21.8773333333333C66.864 21.1253333333333 59.392 21.264 55.3013333333333 22.176C42.48 25.0293333333333 31.7013333333333 33.3066666666667 25.9733333333333 44.6933333333333C23.216 50.1813333333333 21.9626666666667 54.7413333333333 21.52 60.88C20.9706666666667 68.6133333333334 22.2453333333333 75.4773333333333 25.504 82.304C27.824 87.152 30.4906666666667 90.8586666666667 34.3786666666667 94.6186666666667C38.9066666666667 99.0026666666667 43.568 101.9146666666667 49.92 104.3146666666667C52.496 105.2853333333333 52.5706666666667 105.3013333333333 52.4106666666667 104.8" />
+    <glyph glyph-name="moon-1"
+      unicode="&#x6D;&#x6F;&#x6F;&#x6E;"
+      horiz-adv-x="128" d="M58.7733333333333 116.976C50.3146666666667 115.92 43.8453333333333 113.8186666666667 37.2586666666667 110C25.7546666666667 103.3173333333333 17.568 93.1413333333333 13.3706666666667 80.304C11.5253333333333 74.6506666666667 10.88 70.3946666666667 10.8853333333333 63.8986666666667C10.8906666666667 57.2213333333333 11.5946666666667 52.8906666666667 13.68 46.7626666666667C19.0986666666667 30.8106666666667 31.4666666666667 18.672 47.728 13.36C53.344 11.5253333333334 57.616 10.88 64.1013333333333 10.8853333333333C70.56 10.8906666666667 74.5386666666667 11.4986666666667 80.2826666666667 13.3706666666667C88.624 16.08 95.5733333333333 20.2986666666667 101.536 26.2773333333333C111.0613333333333 35.8293333333333 116.6613333333333 48.4853333333333 117.0613333333333 61.3653333333333C117.1733333333333 65.0453333333333 117.1573333333333 65.2853333333333 116.7093333333333 66.2026666666667C116.1226666666667 67.4186666666667 114.8373333333333 68.5973333333333 113.776 68.8906666666667C112.6453333333333 69.2053333333333 110.8426666666667 69.1786666666667 110.0213333333333 68.832C109.6426666666667 68.672 108.3253333333333 67.7066666666667 107.0933333333333 66.688C103.1306666666667 63.3973333333333 100.4533333333333 61.888 96.2933333333333 60.608C92.7893333333333 59.5253333333333 90.592 59.2373333333333 86.9333333333333 59.3813333333334C82.544 59.552 79.568 60.2613333333333 75.6213333333333 62.0746666666667C67.5413333333333 65.7866666666667 61.264 74.0426666666667 59.7173333333333 82.9866666666667C59.3546666666667 85.0933333333333 59.344 91.248 59.696 92.9066666666667C60.896 98.48 63.2106666666667 103.1413333333333 66.7893333333333 107.2C68.5066666666667 109.1466666666667 69.1146666666667 110.4373333333333 69.1146666666667 112.1066666666667C69.1093333333333 112.8853333333333 68.96 113.7226666666667 68.72 114.24C68.224 115.3386666666667 66.816 116.6026666666667 65.776 116.8906666666667C65.0186666666667 117.0986666666667 60.2346666666667 117.1573333333333 58.7733333333333 116.976M52.4106666666667 104.8C52.3466666666667 104.592 51.8986666666667 103.392 51.424 102.1226666666667C49.5946666666667 97.2906666666667 48.7893333333333 92.928 48.7946666666667 87.8933333333334C48.8106666666667 72.7413333333333 57.28 59.2426666666667 70.9066666666667 52.6773333333333C81.0613333333333 47.7813333333333 92.2026666666667 47.4666666666667 103.1093333333333 51.776C104.144 52.1813333333333 105.0293333333333 52.48 105.072 52.4373333333333C105.4133333333333 52.1013333333333 102.2773333333333 44.832 100.56 41.968C97.584 37.0133333333334 92.5813333333333 31.7813333333333 87.6426666666667 28.4693333333333C82.9173333333333 25.3013333333333 76.8426666666667 22.864 71.1893333333333 21.8773333333333C66.864 21.1253333333333 59.392 21.264 55.3013333333333 22.176C42.48 25.0293333333333 31.7013333333333 33.3066666666667 25.9733333333333 44.6933333333333C23.216 50.1813333333333 21.9626666666667 54.7413333333333 21.52 60.88C20.9706666666667 68.6133333333334 22.2453333333333 75.4773333333333 25.504 82.304C27.824 87.152 30.4906666666667 90.8586666666667 34.3786666666667 94.6186666666667C38.9066666666667 99.0026666666667 43.568 101.9146666666667 49.92 104.3146666666667C52.496 105.2853333333333 52.5706666666667 105.3013333333333 52.4106666666667 104.8" />
+    <glyph glyph-name="network"
       unicode="&#xF11B;"
-      horiz-adv-x="128" d="M60.16 125.0425263157895C46.0871111111111 124.645052631579 33.6497777777778 122.469052631579 24.3555555555556 118.784C20.3591111111111 117.1941052631579 17.7066666666667 115.6311578947369 15.2248888888889 113.3945263157895C13.248 111.616 12.0888888888889 109.952 11.4062222222222 107.9309473684211L10.88 106.3545263157895L10.88 69.0256842105263C10.8871111111111 28.0993684210526 10.8017777777778 30.848 12.1671111111111 28.2206315789474C13.5253333333333 25.6 17.5217777777778 22.2989473684211 21.7457777777778 20.2846315789474C28.5155555555556 17.0644210526316 38.1866666666667 14.7132631578947 49.2017777777778 13.6016842105263C51.2782222222222 13.3861052631579 51.712 13.3995789473684 52.6222222222222 13.6892631578948C54.9048888888889 14.4033684210526 56.32 16.2762105263158 56.3128888888889 18.56C56.3128888888889 20.096 55.8151111111111 21.1469473684211 54.5777777777778 22.2248421052632C53.3475555555556 23.2892631578948 52.9066666666667 23.4105263157895 48.5333333333333 23.909052631579C36.3591111111111 25.3035789473684 26.6666666666667 28.288 22.6702222222222 31.8652631578948L21.5466666666667 32.869052631579L21.5466666666667 44.4833684210526C21.5466666666667 55.4576842105263 21.568 56.0842105263158 21.9235555555556 55.9494736842105C24.8533333333333 54.8244210526316 28.6151111111111 53.8206315789474 33.28 52.9111578947368C37.6675555555556 52.0623157894737 49.6711111111111 50.1894736842105 50.752 50.1894736842105C52.7857777777778 50.1894736842105 54.8764444444444 51.6715789473684 55.5662222222222 53.5983157894737C56.1635555555556 55.2555789473684 55.936 56.6164210526316 54.784 58.2197894736842C53.6888888888889 59.749052631579 53.0346666666667 59.9646315789474 46.5066666666667 61.0021052631579C36.8355555555556 62.5313684210526 30.4995555555556 63.7844210526316 27.6266666666667 64.7343157894737C25.8773333333333 65.3136842105263 23.7013333333333 66.5734736842105 22.528 67.685052631579L21.5466666666667 68.6147368421053L21.5466666666667 80.2021052631579L21.5466666666667 91.7827368421053L24.1564444444444 90.7115789473684C29.6035555555556 88.4816842105263 37.0773333333333 86.629052631579 44.9066666666667 85.5646315789474C51.6053333333333 84.6551578947369 54.9546666666667 84.4665263157895 64.4266666666667 84.4530526315789C73.344 84.4463157894737 75.8613333333333 84.5608421052632 81.9697777777778 85.2614736842105C91.1786666666667 86.3124210526316 100.1457777777778 88.4749473684211 106.0622222222222 91.0686315789474L107.7048888888889 91.7827368421053L107.7688888888889 84.581052631579C107.8471111111111 76.416 107.8755555555556 76.288 109.6035555555556 74.8058947368421C110.4426666666667 74.0917894736842 112.1564444444445 73.4315789473684 113.1733333333333 73.4315789473684C114.2471111111111 73.4315789473684 115.9111111111111 74.0917894736842 116.8071111111111 74.8732631578947C118.5848888888889 76.4227368421053 118.5066666666667 75.6682105263158 118.5066666666667 91.9242105263158C118.5066666666667 106.1861052631579 118.5066666666667 106.2804210526316 118.0302222222222 107.6884210526316C115.9466666666667 113.9334736842105 108.7857777777778 118.4 95.36 121.8155789473684C89.8915555555556 123.2101052631579 82.3182222222222 124.3082105263158 75.0933333333333 124.7461052631579C71.3031111111111 124.9818947368421 63.4524444444444 125.1368421052632 60.16 125.0425263157895M74.0266666666667 114.6543157894737C89.4008888888889 113.6505263157895 102.5706666666667 110.1338947368421 106.944 105.8694736842105C107.8968888888889 104.9397894736842 107.9253333333333 104.576 107.1004444444444 103.6867368421053C103.7368888888889 100.0555789473684 91.7262222222222 96.4042105263158 79.0968888888889 95.1646315789474C68.352 94.1069473684211 55.9431111111111 94.3023157894737 45.9733333333333 95.6766315789474C36.5226666666667 96.9835789473684 28.1528888888889 99.5166315789474 23.8435555555556 102.3797894736842C22.6631111111111 103.168 21.5466666666667 104.3132631578947 21.5466666666667 104.7376842105263C21.5466666666667 105.1284210526316 22.8977777777778 106.4016842105263 24.1706666666667 107.2235789473684C29.824 110.8614736842105 42.24 113.8661052631579 54.8266666666667 114.6408421052632C58.7306666666667 114.8833684210526 70.4426666666667 114.8901052631579 74.0266666666667 114.6543157894737M68.9422222222222 60.9347368421053C66.8017777777778 60.2071578947368 65.4791111111111 58.4421052631579 65.4648888888889 56.2863157894737C65.4506666666667 54.0092631578948 65.5288888888889 53.9149473684211 74.8302222222222 45.0896842105263L83.2924444444444 37.0526315789474L74.8302222222222 29.0223157894737C68.1173333333333 22.6492631578948 66.2755555555556 20.7831578947369 65.9128888888889 20.0084210526316C65.3084444444444 18.7082105263158 65.3084444444444 16.9229473684211 65.92 15.7305263157895C67.1715555555556 13.2783157894737 70.5208888888889 12.1397894736842 73.0168888888889 13.3187368421053C73.3937777777778 13.5006315789474 77.568 17.3002105263158 82.2897777777778 21.76L90.8728888888889 29.8711578947368L99.4631111111111 21.7734736842105C105.0666666666667 16.4917894736842 108.352 13.541052631579 108.9066666666667 13.2917894736842C110.0657777777778 12.7797894736842 112.2488888888889 12.7797894736842 113.3653333333333 13.2985263157895C114.3537777777778 13.7566315789474 115.4844444444444 14.7873684210526 115.968 15.6631578947369C116.16 16.0134736842105 116.3662222222222 16.8286315789474 116.4231111111111 17.4821052631579C116.6506666666667 19.7928421052632 116.7431111111111 19.6715789473684 107.1217777777778 28.8134736842105L98.4604444444444 37.0526315789474L107.1217777777778 45.2917894736842C116.7431111111111 54.4336842105263 116.6506666666667 54.3124210526316 116.4231111111111 56.6231578947369C116.3662222222222 57.2766315789474 116.16 58.0917894736842 115.968 58.4421052631579C115.4844444444444 59.3178947368421 114.3537777777778 60.3486315789474 113.3653333333333 60.8067368421053C112.2488888888889 61.3254736842105 110.0657777777778 61.3254736842105 108.9066666666667 60.8134736842105C108.352 60.5642105263158 105.0666666666667 57.6134736842105 99.4631111111111 52.3317894736842L90.8728888888889 44.2341052631579L82.2897777777778 52.3452631578948C77.568 56.805052631579 73.3866666666667 60.6113684210527 72.9884444444444 60.8C71.8791111111111 61.3254736842105 70.2648888888889 61.3793684210527 68.9422222222222 60.9347368421053" />
-    <glyph glyph-name="database-off-1"
-      unicode="&#x64;&#x61;&#x74;&#x61;&#x62;&#x61;&#x73;&#x65;&#x2D;&#x6F;&#x66;&#x66;"
-      horiz-adv-x="128" d="M60.16 125.0425263157895C46.0871111111111 124.645052631579 33.6497777777778 122.469052631579 24.3555555555556 118.784C20.3591111111111 117.1941052631579 17.7066666666667 115.6311578947369 15.2248888888889 113.3945263157895C13.248 111.616 12.0888888888889 109.952 11.4062222222222 107.9309473684211L10.88 106.3545263157895L10.88 69.0256842105263C10.8871111111111 28.0993684210526 10.8017777777778 30.848 12.1671111111111 28.2206315789474C13.5253333333333 25.6 17.5217777777778 22.2989473684211 21.7457777777778 20.2846315789474C28.5155555555556 17.0644210526316 38.1866666666667 14.7132631578947 49.2017777777778 13.6016842105263C51.2782222222222 13.3861052631579 51.712 13.3995789473684 52.6222222222222 13.6892631578948C54.9048888888889 14.4033684210526 56.32 16.2762105263158 56.3128888888889 18.56C56.3128888888889 20.096 55.8151111111111 21.1469473684211 54.5777777777778 22.2248421052632C53.3475555555556 23.2892631578948 52.9066666666667 23.4105263157895 48.5333333333333 23.909052631579C36.3591111111111 25.3035789473684 26.6666666666667 28.288 22.6702222222222 31.8652631578948L21.5466666666667 32.869052631579L21.5466666666667 44.4833684210526C21.5466666666667 55.4576842105263 21.568 56.0842105263158 21.9235555555556 55.9494736842105C24.8533333333333 54.8244210526316 28.6151111111111 53.8206315789474 33.28 52.9111578947368C37.6675555555556 52.0623157894737 49.6711111111111 50.1894736842105 50.752 50.1894736842105C52.7857777777778 50.1894736842105 54.8764444444444 51.6715789473684 55.5662222222222 53.5983157894737C56.1635555555556 55.2555789473684 55.936 56.6164210526316 54.784 58.2197894736842C53.6888888888889 59.749052631579 53.0346666666667 59.9646315789474 46.5066666666667 61.0021052631579C36.8355555555556 62.5313684210526 30.4995555555556 63.7844210526316 27.6266666666667 64.7343157894737C25.8773333333333 65.3136842105263 23.7013333333333 66.5734736842105 22.528 67.685052631579L21.5466666666667 68.6147368421053L21.5466666666667 80.2021052631579L21.5466666666667 91.7827368421053L24.1564444444444 90.7115789473684C29.6035555555556 88.4816842105263 37.0773333333333 86.629052631579 44.9066666666667 85.5646315789474C51.6053333333333 84.6551578947369 54.9546666666667 84.4665263157895 64.4266666666667 84.4530526315789C73.344 84.4463157894737 75.8613333333333 84.5608421052632 81.9697777777778 85.2614736842105C91.1786666666667 86.3124210526316 100.1457777777778 88.4749473684211 106.0622222222222 91.0686315789474L107.7048888888889 91.7827368421053L107.7688888888889 84.581052631579C107.8471111111111 76.416 107.8755555555556 76.288 109.6035555555556 74.8058947368421C110.4426666666667 74.0917894736842 112.1564444444445 73.4315789473684 113.1733333333333 73.4315789473684C114.2471111111111 73.4315789473684 115.9111111111111 74.0917894736842 116.8071111111111 74.8732631578947C118.5848888888889 76.4227368421053 118.5066666666667 75.6682105263158 118.5066666666667 91.9242105263158C118.5066666666667 106.1861052631579 118.5066666666667 106.2804210526316 118.0302222222222 107.6884210526316C115.9466666666667 113.9334736842105 108.7857777777778 118.4 95.36 121.8155789473684C89.8915555555556 123.2101052631579 82.3182222222222 124.3082105263158 75.0933333333333 124.7461052631579C71.3031111111111 124.9818947368421 63.4524444444444 125.1368421052632 60.16 125.0425263157895M74.0266666666667 114.6543157894737C89.4008888888889 113.6505263157895 102.5706666666667 110.1338947368421 106.944 105.8694736842105C107.8968888888889 104.9397894736842 107.9253333333333 104.576 107.1004444444444 103.6867368421053C103.7368888888889 100.0555789473684 91.7262222222222 96.4042105263158 79.0968888888889 95.1646315789474C68.352 94.1069473684211 55.9431111111111 94.3023157894737 45.9733333333333 95.6766315789474C36.5226666666667 96.9835789473684 28.1528888888889 99.5166315789474 23.8435555555556 102.3797894736842C22.6631111111111 103.168 21.5466666666667 104.3132631578947 21.5466666666667 104.7376842105263C21.5466666666667 105.1284210526316 22.8977777777778 106.4016842105263 24.1706666666667 107.2235789473684C29.824 110.8614736842105 42.24 113.8661052631579 54.8266666666667 114.6408421052632C58.7306666666667 114.8833684210526 70.4426666666667 114.8901052631579 74.0266666666667 114.6543157894737M68.9422222222222 60.9347368421053C66.8017777777778 60.2071578947368 65.4791111111111 58.4421052631579 65.4648888888889 56.2863157894737C65.4506666666667 54.0092631578948 65.5288888888889 53.9149473684211 74.8302222222222 45.0896842105263L83.2924444444444 37.0526315789474L74.8302222222222 29.0223157894737C68.1173333333333 22.6492631578948 66.2755555555556 20.7831578947369 65.9128888888889 20.0084210526316C65.3084444444444 18.7082105263158 65.3084444444444 16.9229473684211 65.92 15.7305263157895C67.1715555555556 13.2783157894737 70.5208888888889 12.1397894736842 73.0168888888889 13.3187368421053C73.3937777777778 13.5006315789474 77.568 17.3002105263158 82.2897777777778 21.76L90.8728888888889 29.8711578947368L99.4631111111111 21.7734736842105C105.0666666666667 16.4917894736842 108.352 13.541052631579 108.9066666666667 13.2917894736842C110.0657777777778 12.7797894736842 112.2488888888889 12.7797894736842 113.3653333333333 13.2985263157895C114.3537777777778 13.7566315789474 115.4844444444444 14.7873684210526 115.968 15.6631578947369C116.16 16.0134736842105 116.3662222222222 16.8286315789474 116.4231111111111 17.4821052631579C116.6506666666667 19.7928421052632 116.7431111111111 19.6715789473684 107.1217777777778 28.8134736842105L98.4604444444444 37.0526315789474L107.1217777777778 45.2917894736842C116.7431111111111 54.4336842105263 116.6506666666667 54.3124210526316 116.4231111111111 56.6231578947369C116.3662222222222 57.2766315789474 116.16 58.0917894736842 115.968 58.4421052631579C115.4844444444444 59.3178947368421 114.3537777777778 60.3486315789474 113.3653333333333 60.8067368421053C112.2488888888889 61.3254736842105 110.0657777777778 61.3254736842105 108.9066666666667 60.8134736842105C108.352 60.5642105263158 105.0666666666667 57.6134736842105 99.4631111111111 52.3317894736842L90.8728888888889 44.2341052631579L82.2897777777778 52.3452631578948C77.568 56.805052631579 73.3866666666667 60.6113684210527 72.9884444444444 60.8C71.8791111111111 61.3254736842105 70.2648888888889 61.3793684210527 68.9422222222222 60.9347368421053" />
-    <glyph glyph-name="sun"
-      unicode="&#xF11C;"
-      horiz-adv-x="128" d="M61.9573333333333 122.1493333333333C60.9866666666667 121.728 59.7706666666667 120.5866666666667 59.2426666666667 119.5946666666667C58.7893333333333 118.7466666666667 58.7733333333333 118.5066666666667 58.7733333333333 112C58.7733333333333 105.5146666666667 58.7893333333333 105.248 59.232 104.4266666666667C60.2666666666667 102.512 61.872 101.5466666666667 64 101.5466666666667C66.128 101.5466666666667 67.7333333333333 102.512 68.768 104.4266666666667C69.2106666666667 105.248 69.2266666666667 105.5146666666667 69.2266666666667 112C69.2266666666667 118.48 69.2106666666667 118.752 68.768 119.5733333333334C68.208 120.608 67.3813333333333 121.4026666666667 66.2453333333333 122.0053333333334C65.2426666666667 122.5333333333333 63.008 122.608 61.9573333333333 122.1493333333333M24.48 106.576C23.3013333333333 106.1546666666667 22.2453333333333 105.2693333333333 21.712 104.256C21.0773333333333 103.0453333333333 21.04 100.544 21.6426666666667 99.3066666666667C22.1706666666667 98.2133333333333 30.3466666666667 90.0373333333333 31.4186666666667 89.5306666666667C33.568 88.512 35.7546666666667 88.8853333333333 37.424 90.5546666666667C39.008 92.1386666666667 39.3866666666667 93.696 38.7253333333333 95.9093333333333C38.4693333333333 96.7573333333333 37.968 97.4293333333333 36.112 99.3973333333333C34.848 100.7413333333333 32.6826666666667 102.864 31.3066666666667 104.1226666666667C29.328 105.9253333333333 28.6026666666667 106.4533333333333 27.8506666666667 106.64C26.6186666666667 106.9546666666667 25.472 106.928 24.48 106.576M99.9253333333333 106.6613333333333C99.1093333333333 106.4106666666667 94.976 102.672 91.888 99.3973333333333C90.032 97.4293333333333 89.5306666666667 96.7573333333333 89.2746666666667 95.9093333333333C88.608 93.68 88.992 92.1013333333333 90.576 90.544C92.2613333333333 88.8853333333333 94.4426666666667 88.5173333333333 96.5706666666667 89.5253333333333C97.0026666666667 89.7333333333333 99.2906666666667 91.824 101.6533333333333 94.176C106.6613333333333 99.1626666666667 106.9973333333333 99.6693333333333 106.8266666666667 101.9946666666667C106.624 104.848 104.8746666666667 106.6026666666667 102.0586666666667 106.7786666666667C101.248 106.8266666666667 100.288 106.7733333333333 99.9253333333333 106.6613333333333M59.84 90.2186666666667C54.9706666666667 89.5146666666667 49.2213333333333 86.64 45.5466666666667 83.0666666666667C38.7626666666667 76.4693333333333 36.0053333333333 67.056 38.176 57.92C40.6186666666667 47.632 49.088 39.6266666666667 59.3866666666667 37.872C61.8133333333333 37.456 66.1866666666667 37.456 68.6133333333333 37.872C79.5413333333333 39.7333333333333 88.2133333333333 48.4266666666667 90.1333333333333 59.456C90.544 61.7973333333333 90.544 66.2026666666667 90.1333333333333 68.544C88.2133333333333 79.568 79.3973333333333 88.352 68.4746666666667 90.1226666666667C66.3093333333333 90.4746666666667 61.9573333333333 90.5226666666667 59.84 90.2186666666667M67.9466666666667 79.552C69.5306666666667 79.248 72.672 77.6266666666667 74.1866666666667 76.336C76.624 74.2613333333333 78.6133333333333 71.2906666666667 79.4453333333333 68.496C79.9253333333333 66.864 79.9253333333333 61.136 79.4453333333333 59.504C78.256 55.5146666666667 75.0453333333333 51.68 71.264 49.7333333333333C68.4213333333333 48.272 67.7226666666667 48.1226666666667 63.8933333333333 48.1386666666667C60.5866666666667 48.1493333333333 60.4213333333333 48.1706666666667 58.624 48.8373333333333C55.7226666666667 49.9146666666667 52.5173333333333 52.4 50.784 54.9173333333333C49.856 56.2666666666667 48.9386666666667 58.288 48.5013333333333 59.9466666666667C48.0106666666667 61.8293333333333 48.0053333333333 66.1333333333333 48.5013333333333 68.1333333333333C49.6266666666667 72.7253333333333 54.2186666666667 77.7173333333333 58.6186666666667 79.1306666666667C61.1573333333333 79.9466666666667 65.008 80.1226666666667 67.9466666666667 79.552M10.6666666666667 69.1413333333333C8.5706666666667 68.9706666666667 7.808 68.6293333333333 6.7413333333333 67.3813333333334C5.856 66.3466666666667 5.552 65.4293333333334 5.5466666666667 63.8346666666667C5.5466666666667 61.872 6.5706666666667 60.24 8.4266666666667 59.232C9.248 58.7893333333333 9.5146666666667 58.7733333333333 16 58.7733333333333C22.4853333333333 58.7733333333333 22.752 58.7893333333333 23.5733333333333 59.232C25.488 60.2666666666667 26.4533333333333 61.872 26.4533333333333 64C26.4533333333333 66.1013333333333 25.6373333333333 67.5093333333333 23.7866666666667 68.5866666666667C22.9706666666667 69.0666666666667 22.6986666666667 69.0933333333333 17.7066666666667 69.1893333333333C14.832 69.248 11.664 69.2266666666667 10.6666666666667 69.1413333333333M106.6666666666667 69.1413333333333C104.5706666666667 68.9706666666667 103.808 68.6293333333333 102.7413333333333 67.3813333333334C101.856 66.3466666666667 101.552 65.4293333333334 101.5466666666667 63.8346666666667C101.5466666666667 61.872 102.5706666666667 60.24 104.4266666666667 59.232C105.248 58.7893333333333 105.5146666666667 58.7733333333333 112 58.7733333333333C118.4853333333333 58.7733333333333 118.752 58.7893333333333 119.5733333333334 59.232C121.488 60.2666666666667 122.4533333333333 61.872 122.4533333333333 64C122.4533333333333 66.1013333333333 121.6373333333333 67.5093333333333 119.7866666666667 68.5866666666667C118.9706666666667 69.0666666666667 118.6986666666667 69.0933333333333 113.7066666666667 69.1893333333333C110.832 69.248 107.664 69.2266666666667 106.6666666666667 69.1413333333333M32.2133333333333 38.8C31.0346666666667 38.448 29.488 37.1253333333333 25.6266666666667 33.1626666666667C21.392 28.8213333333333 21.0133333333333 28.2133333333333 21.1733333333333 26.0053333333333C21.376 23.1413333333333 23.2106666666667 21.3173333333333 26.0426666666667 21.1573333333333C28.3466666666667 21.024 28.8746666666667 21.376 33.824 26.3466666666667C36.2133333333333 28.7466666666667 38.2666666666667 30.9973333333333 38.48 31.44C38.9813333333333 32.5013333333334 39.1573333333333 34.3093333333333 38.8426666666667 35.2586666666667C38.4533333333333 36.432 37.4506666666667 37.6746666666667 36.384 38.2986666666667C35.28 38.944 33.4293333333333 39.168 32.2133333333333 38.8M92.672 38.8C91.4826666666667 38.528 90.1706666666667 37.3493333333333 89.4773333333333 35.9306666666667C88.9866666666667 34.9333333333333 88.9173333333333 34.5706666666667 89.0133333333333 33.5146666666667C89.0773333333333 32.8266666666667 89.3013333333333 31.8986666666667 89.5146666666667 31.456C90.1013333333333 30.2186666666667 98.208 22.1706666666667 99.4826666666667 21.5573333333333C101.488 20.5973333333333 104.5866666666667 21.3173333333333 105.8026666666667 23.0293333333333C106.944 24.6293333333333 107.2 26.9333333333333 106.416 28.5706666666667C105.8506666666667 29.7546666666667 97.744 37.92 96.624 38.4373333333333C95.6693333333333 38.88 93.776 39.056 92.672 38.8M61.9573333333333 26.1493333333333C60.9866666666667 25.728 59.7706666666667 24.5866666666667 59.2426666666667 23.5946666666667C58.7893333333333 22.7466666666667 58.7733333333333 22.5066666666667 58.7733333333333 16C58.7733333333333 9.5146666666667 58.7893333333333 9.248 59.232 8.4266666666667C60.2666666666667 6.512 61.872 5.5466666666667 64 5.5466666666667C66.128 5.5466666666667 67.7333333333333 6.512 68.768 8.4266666666667C69.2106666666667 9.248 69.2266666666667 9.5146666666667 69.2266666666667 16C69.2266666666667 22.48 69.2106666666667 22.752 68.768 23.5733333333334C68.208 24.608 67.3813333333333 25.4026666666667 66.2453333333333 26.0053333333333C65.2426666666667 26.5333333333333 63.008 26.608 61.9573333333333 26.1493333333333" />
-    <glyph glyph-name="sun-1"
-      unicode="&#x73;&#x75;&#x6E;"
-      horiz-adv-x="128" d="M61.9573333333333 122.1493333333333C60.9866666666667 121.728 59.7706666666667 120.5866666666667 59.2426666666667 119.5946666666667C58.7893333333333 118.7466666666667 58.7733333333333 118.5066666666667 58.7733333333333 112C58.7733333333333 105.5146666666667 58.7893333333333 105.248 59.232 104.4266666666667C60.2666666666667 102.512 61.872 101.5466666666667 64 101.5466666666667C66.128 101.5466666666667 67.7333333333333 102.512 68.768 104.4266666666667C69.2106666666667 105.248 69.2266666666667 105.5146666666667 69.2266666666667 112C69.2266666666667 118.48 69.2106666666667 118.752 68.768 119.5733333333334C68.208 120.608 67.3813333333333 121.4026666666667 66.2453333333333 122.0053333333334C65.2426666666667 122.5333333333333 63.008 122.608 61.9573333333333 122.1493333333333M24.48 106.576C23.3013333333333 106.1546666666667 22.2453333333333 105.2693333333333 21.712 104.256C21.0773333333333 103.0453333333333 21.04 100.544 21.6426666666667 99.3066666666667C22.1706666666667 98.2133333333333 30.3466666666667 90.0373333333333 31.4186666666667 89.5306666666667C33.568 88.512 35.7546666666667 88.8853333333333 37.424 90.5546666666667C39.008 92.1386666666667 39.3866666666667 93.696 38.7253333333333 95.9093333333333C38.4693333333333 96.7573333333333 37.968 97.4293333333333 36.112 99.3973333333333C34.848 100.7413333333333 32.6826666666667 102.864 31.3066666666667 104.1226666666667C29.328 105.9253333333333 28.6026666666667 106.4533333333333 27.8506666666667 106.64C26.6186666666667 106.9546666666667 25.472 106.928 24.48 106.576M99.9253333333333 106.6613333333333C99.1093333333333 106.4106666666667 94.976 102.672 91.888 99.3973333333333C90.032 97.4293333333333 89.5306666666667 96.7573333333333 89.2746666666667 95.9093333333333C88.608 93.68 88.992 92.1013333333333 90.576 90.544C92.2613333333333 88.8853333333333 94.4426666666667 88.5173333333333 96.5706666666667 89.5253333333333C97.0026666666667 89.7333333333333 99.2906666666667 91.824 101.6533333333333 94.176C106.6613333333333 99.1626666666667 106.9973333333333 99.6693333333333 106.8266666666667 101.9946666666667C106.624 104.848 104.8746666666667 106.6026666666667 102.0586666666667 106.7786666666667C101.248 106.8266666666667 100.288 106.7733333333333 99.9253333333333 106.6613333333333M59.84 90.2186666666667C54.9706666666667 89.5146666666667 49.2213333333333 86.64 45.5466666666667 83.0666666666667C38.7626666666667 76.4693333333333 36.0053333333333 67.056 38.176 57.92C40.6186666666667 47.632 49.088 39.6266666666667 59.3866666666667 37.872C61.8133333333333 37.456 66.1866666666667 37.456 68.6133333333333 37.872C79.5413333333333 39.7333333333333 88.2133333333333 48.4266666666667 90.1333333333333 59.456C90.544 61.7973333333333 90.544 66.2026666666667 90.1333333333333 68.544C88.2133333333333 79.568 79.3973333333333 88.352 68.4746666666667 90.1226666666667C66.3093333333333 90.4746666666667 61.9573333333333 90.5226666666667 59.84 90.2186666666667M67.9466666666667 79.552C69.5306666666667 79.248 72.672 77.6266666666667 74.1866666666667 76.336C76.624 74.2613333333333 78.6133333333333 71.2906666666667 79.4453333333333 68.496C79.9253333333333 66.864 79.9253333333333 61.136 79.4453333333333 59.504C78.256 55.5146666666667 75.0453333333333 51.68 71.264 49.7333333333333C68.4213333333333 48.272 67.7226666666667 48.1226666666667 63.8933333333333 48.1386666666667C60.5866666666667 48.1493333333333 60.4213333333333 48.1706666666667 58.624 48.8373333333333C55.7226666666667 49.9146666666667 52.5173333333333 52.4 50.784 54.9173333333333C49.856 56.2666666666667 48.9386666666667 58.288 48.5013333333333 59.9466666666667C48.0106666666667 61.8293333333333 48.0053333333333 66.1333333333333 48.5013333333333 68.1333333333333C49.6266666666667 72.7253333333333 54.2186666666667 77.7173333333333 58.6186666666667 79.1306666666667C61.1573333333333 79.9466666666667 65.008 80.1226666666667 67.9466666666667 79.552M10.6666666666667 69.1413333333333C8.5706666666667 68.9706666666667 7.808 68.6293333333333 6.7413333333333 67.3813333333334C5.856 66.3466666666667 5.552 65.4293333333334 5.5466666666667 63.8346666666667C5.5466666666667 61.872 6.5706666666667 60.24 8.4266666666667 59.232C9.248 58.7893333333333 9.5146666666667 58.7733333333333 16 58.7733333333333C22.4853333333333 58.7733333333333 22.752 58.7893333333333 23.5733333333333 59.232C25.488 60.2666666666667 26.4533333333333 61.872 26.4533333333333 64C26.4533333333333 66.1013333333333 25.6373333333333 67.5093333333333 23.7866666666667 68.5866666666667C22.9706666666667 69.0666666666667 22.6986666666667 69.0933333333333 17.7066666666667 69.1893333333333C14.832 69.248 11.664 69.2266666666667 10.6666666666667 69.1413333333333M106.6666666666667 69.1413333333333C104.5706666666667 68.9706666666667 103.808 68.6293333333333 102.7413333333333 67.3813333333334C101.856 66.3466666666667 101.552 65.4293333333334 101.5466666666667 63.8346666666667C101.5466666666667 61.872 102.5706666666667 60.24 104.4266666666667 59.232C105.248 58.7893333333333 105.5146666666667 58.7733333333333 112 58.7733333333333C118.4853333333333 58.7733333333333 118.752 58.7893333333333 119.5733333333334 59.232C121.488 60.2666666666667 122.4533333333333 61.872 122.4533333333333 64C122.4533333333333 66.1013333333333 121.6373333333333 67.5093333333333 119.7866666666667 68.5866666666667C118.9706666666667 69.0666666666667 118.6986666666667 69.0933333333333 113.7066666666667 69.1893333333333C110.832 69.248 107.664 69.2266666666667 106.6666666666667 69.1413333333333M32.2133333333333 38.8C31.0346666666667 38.448 29.488 37.1253333333333 25.6266666666667 33.1626666666667C21.392 28.8213333333333 21.0133333333333 28.2133333333333 21.1733333333333 26.0053333333333C21.376 23.1413333333333 23.2106666666667 21.3173333333333 26.0426666666667 21.1573333333333C28.3466666666667 21.024 28.8746666666667 21.376 33.824 26.3466666666667C36.2133333333333 28.7466666666667 38.2666666666667 30.9973333333333 38.48 31.44C38.9813333333333 32.5013333333334 39.1573333333333 34.3093333333333 38.8426666666667 35.2586666666667C38.4533333333333 36.432 37.4506666666667 37.6746666666667 36.384 38.2986666666667C35.28 38.944 33.4293333333333 39.168 32.2133333333333 38.8M92.672 38.8C91.4826666666667 38.528 90.1706666666667 37.3493333333333 89.4773333333333 35.9306666666667C88.9866666666667 34.9333333333333 88.9173333333333 34.5706666666667 89.0133333333333 33.5146666666667C89.0773333333333 32.8266666666667 89.3013333333333 31.8986666666667 89.5146666666667 31.456C90.1013333333333 30.2186666666667 98.208 22.1706666666667 99.4826666666667 21.5573333333333C101.488 20.5973333333333 104.5866666666667 21.3173333333333 105.8026666666667 23.0293333333333C106.944 24.6293333333333 107.2 26.9333333333333 106.416 28.5706666666667C105.8506666666667 29.7546666666667 97.744 37.92 96.624 38.4373333333333C95.6693333333333 38.88 93.776 39.056 92.672 38.8M61.9573333333333 26.1493333333333C60.9866666666667 25.728 59.7706666666667 24.5866666666667 59.2426666666667 23.5946666666667C58.7893333333333 22.7466666666667 58.7733333333333 22.5066666666667 58.7733333333333 16C58.7733333333333 9.5146666666667 58.7893333333333 9.248 59.232 8.4266666666667C60.2666666666667 6.512 61.872 5.5466666666667 64 5.5466666666667C66.128 5.5466666666667 67.7333333333333 6.512 68.768 8.4266666666667C69.2106666666667 9.248 69.2266666666667 9.5146666666667 69.2266666666667 16C69.2266666666667 22.48 69.2106666666667 22.752 68.768 23.5733333333334C68.208 24.608 67.3813333333333 25.4026666666667 66.2453333333333 26.0053333333333C65.2426666666667 26.5333333333333 63.008 26.608 61.9573333333333 26.1493333333333" />
-    <glyph glyph-name="file-text"
+      horiz-adv-x="128" d="M53.5466666666667 122.464C49.5626666666667 122.2453333333333 48.0373333333333 121.6266666666667 45.8506666666667 119.328C44.432 117.84 43.6906666666667 116.608 43.1626666666667 114.88C42.8053333333333 113.7013333333334 42.7733333333333 112.608 42.7733333333333 101.3333333333333C42.7733333333333 90.0373333333333 42.8053333333333 88.9653333333333 43.1626666666667 87.7866666666667C44.2293333333333 84.3146666666667 46.784 81.68 50.1333333333333 80.608C51.2266666666667 80.256 52.272 80.1386666666667 55.0933333333333 80.0533333333333L58.6666666666667 79.9466666666667L58.6666666666667 74.6666666666667L58.6666666666667 69.3813333333334L44.4266666666667 69.28C30.6453333333333 69.184 30.144 69.168 28.8 68.7306666666667C25.5786666666667 67.68 22.9866666666667 65.088 21.9306666666667 61.8666666666667C21.52 60.6133333333334 21.4666666666667 59.8773333333333 21.3813333333333 54.24L21.2906666666667 48L19.0133333333333 48C16.1013333333333 48 13.4933333333333 47.6693333333333 12.1226666666667 47.1306666666667C9.1093333333333 45.9466666666667 6.8106666666667 43.4186666666667 5.8293333333333 40.2133333333333C5.472 39.0346666666667 5.44 37.9626666666667 5.44 26.6666666666667C5.44 14.608 5.4453333333333 14.3733333333333 5.9093333333333 12.9066666666667C6.9813333333333 9.5146666666667 9.5146666666667 6.9813333333333 12.9066666666667 5.9093333333333C14.3733333333333 5.4453333333333 14.608 5.44 26.6666666666667 5.44C38.7253333333333 5.44 38.96 5.4453333333333 40.4266666666667 5.9093333333333C43.8186666666667 6.9813333333333 46.352 9.5146666666667 47.424 12.9066666666667C47.888 14.3733333333333 47.8933333333333 14.608 47.8933333333333 26.6666666666667C47.8933333333333 37.9626666666667 47.8613333333333 39.0346666666667 47.504 40.2133333333333C46.512 43.4506666666667 44.1706666666667 45.9786666666667 41.0293333333333 47.2053333333333C39.8346666666667 47.6746666666667 37.088 48 34.2986666666667 48L32 48L32 53.3333333333333L32 58.6666666666667L64 58.6666666666667L96 58.6666666666667L96 53.3333333333333L96 48L93.7013333333333 48C90.768 48 88.16 47.6746666666667 86.7893333333333 47.1306666666667C83.776 45.9466666666667 81.4773333333333 43.4186666666667 80.496 40.2133333333333C80.1386666666667 39.0346666666667 80.1066666666667 37.9626666666667 80.1066666666667 26.6666666666667C80.1066666666667 14.608 80.112 14.3733333333333 80.576 12.9066666666667C81.648 9.5146666666667 84.1813333333333 6.9813333333333 87.5733333333333 5.9093333333333C89.04 5.4453333333333 89.2746666666667 5.44 101.3333333333333 5.44C113.392 5.44 113.6266666666667 5.4453333333333 115.0933333333333 5.9093333333333C116.848 6.464 118.1493333333333 7.2533333333333 119.4453333333334 8.5546666666667C120.7466666666667 9.8506666666667 121.536 11.152 122.0906666666667 12.9066666666667C122.5546666666667 14.3733333333333 122.56 14.608 122.56 26.6666666666667C122.56 37.9626666666667 122.528 39.0346666666667 122.1706666666667 40.2133333333333C121.1786666666667 43.4506666666667 118.8373333333333 45.9786666666667 115.696 47.2053333333333C114.5013333333333 47.6746666666667 111.7546666666667 48 108.9866666666667 48L106.7093333333333 48L106.6186666666667 54.24C106.5333333333333 59.8773333333333 106.48 60.6133333333334 106.0693333333333 61.8666666666667C105.0133333333333 65.088 102.5333333333333 67.5626666666667 99.2 68.7146666666667C97.8293333333333 69.184 97.6533333333333 69.1946666666667 83.5733333333333 69.2853333333333L69.3333333333333 69.3813333333334L69.3333333333333 74.6666666666667L69.3333333333333 79.9466666666667L72.9066666666667 80.0533333333333C75.4026666666667 80.1333333333333 76.832 80.2773333333333 77.6533333333333 80.528C81.1093333333333 81.6 83.76 84.2826666666667 84.8373333333333 87.7866666666667C85.1946666666667 88.9653333333333 85.2266666666667 90.0373333333333 85.2266666666667 101.3333333333333C85.2266666666667 113.392 85.2213333333333 113.6266666666667 84.7573333333333 115.0933333333333C83.712 118.4 81.232 120.9013333333333 77.8666666666667 122.032C76.528 122.4853333333333 76.128 122.5066666666667 66.4533333333333 122.5653333333333C60.9386666666667 122.5973333333334 55.1306666666667 122.5546666666667 53.5466666666667 122.464M74.6666666666667 101.3333333333333L74.6666666666667 90.6666666666667L64 90.6666666666667L53.3333333333333 90.6666666666667L53.3333333333333 101.3333333333333L53.3333333333333 112L64 112L74.6666666666667 112L74.6666666666667 101.3333333333333M37.3333333333333 26.6666666666667L37.3333333333333 16L26.6666666666667 16L16 16L16 26.6666666666667L16 37.3333333333333L26.6666666666667 37.3333333333333L37.3333333333333 37.3333333333333L37.3333333333333 26.6666666666667M112 26.6666666666667L112 16L101.3333333333333 16L90.6666666666667 16L90.6666666666667 26.6666666666667L90.6666666666667 37.3333333333333L101.3333333333333 37.3333333333333L112 37.3333333333333L112 26.6666666666667" />
+    <glyph glyph-name="network-1"
+      unicode="&#x6E;&#x65;&#x74;&#x77;&#x6F;&#x72;&#x6B;"
+      horiz-adv-x="128" d="M53.5466666666667 122.464C49.5626666666667 122.2453333333333 48.0373333333333 121.6266666666667 45.8506666666667 119.328C44.432 117.84 43.6906666666667 116.608 43.1626666666667 114.88C42.8053333333333 113.7013333333334 42.7733333333333 112.608 42.7733333333333 101.3333333333333C42.7733333333333 90.0373333333333 42.8053333333333 88.9653333333333 43.1626666666667 87.7866666666667C44.2293333333333 84.3146666666667 46.784 81.68 50.1333333333333 80.608C51.2266666666667 80.256 52.272 80.1386666666667 55.0933333333333 80.0533333333333L58.6666666666667 79.9466666666667L58.6666666666667 74.6666666666667L58.6666666666667 69.3813333333334L44.4266666666667 69.28C30.6453333333333 69.184 30.144 69.168 28.8 68.7306666666667C25.5786666666667 67.68 22.9866666666667 65.088 21.9306666666667 61.8666666666667C21.52 60.6133333333334 21.4666666666667 59.8773333333333 21.3813333333333 54.24L21.2906666666667 48L19.0133333333333 48C16.1013333333333 48 13.4933333333333 47.6693333333333 12.1226666666667 47.1306666666667C9.1093333333333 45.9466666666667 6.8106666666667 43.4186666666667 5.8293333333333 40.2133333333333C5.472 39.0346666666667 5.44 37.9626666666667 5.44 26.6666666666667C5.44 14.608 5.4453333333333 14.3733333333333 5.9093333333333 12.9066666666667C6.9813333333333 9.5146666666667 9.5146666666667 6.9813333333333 12.9066666666667 5.9093333333333C14.3733333333333 5.4453333333333 14.608 5.44 26.6666666666667 5.44C38.7253333333333 5.44 38.96 5.4453333333333 40.4266666666667 5.9093333333333C43.8186666666667 6.9813333333333 46.352 9.5146666666667 47.424 12.9066666666667C47.888 14.3733333333333 47.8933333333333 14.608 47.8933333333333 26.6666666666667C47.8933333333333 37.9626666666667 47.8613333333333 39.0346666666667 47.504 40.2133333333333C46.512 43.4506666666667 44.1706666666667 45.9786666666667 41.0293333333333 47.2053333333333C39.8346666666667 47.6746666666667 37.088 48 34.2986666666667 48L32 48L32 53.3333333333333L32 58.6666666666667L64 58.6666666666667L96 58.6666666666667L96 53.3333333333333L96 48L93.7013333333333 48C90.768 48 88.16 47.6746666666667 86.7893333333333 47.1306666666667C83.776 45.9466666666667 81.4773333333333 43.4186666666667 80.496 40.2133333333333C80.1386666666667 39.0346666666667 80.1066666666667 37.9626666666667 80.1066666666667 26.6666666666667C80.1066666666667 14.608 80.112 14.3733333333333 80.576 12.9066666666667C81.648 9.5146666666667 84.1813333333333 6.9813333333333 87.5733333333333 5.9093333333333C89.04 5.4453333333333 89.2746666666667 5.44 101.3333333333333 5.44C113.392 5.44 113.6266666666667 5.4453333333333 115.0933333333333 5.9093333333333C116.848 6.464 118.1493333333333 7.2533333333333 119.4453333333334 8.5546666666667C120.7466666666667 9.8506666666667 121.536 11.152 122.0906666666667 12.9066666666667C122.5546666666667 14.3733333333333 122.56 14.608 122.56 26.6666666666667C122.56 37.9626666666667 122.528 39.0346666666667 122.1706666666667 40.2133333333333C121.1786666666667 43.4506666666667 118.8373333333333 45.9786666666667 115.696 47.2053333333333C114.5013333333333 47.6746666666667 111.7546666666667 48 108.9866666666667 48L106.7093333333333 48L106.6186666666667 54.24C106.5333333333333 59.8773333333333 106.48 60.6133333333334 106.0693333333333 61.8666666666667C105.0133333333333 65.088 102.5333333333333 67.5626666666667 99.2 68.7146666666667C97.8293333333333 69.184 97.6533333333333 69.1946666666667 83.5733333333333 69.2853333333333L69.3333333333333 69.3813333333334L69.3333333333333 74.6666666666667L69.3333333333333 79.9466666666667L72.9066666666667 80.0533333333333C75.4026666666667 80.1333333333333 76.832 80.2773333333333 77.6533333333333 80.528C81.1093333333333 81.6 83.76 84.2826666666667 84.8373333333333 87.7866666666667C85.1946666666667 88.9653333333333 85.2266666666667 90.0373333333333 85.2266666666667 101.3333333333333C85.2266666666667 113.392 85.2213333333333 113.6266666666667 84.7573333333333 115.0933333333333C83.712 118.4 81.232 120.9013333333333 77.8666666666667 122.032C76.528 122.4853333333333 76.128 122.5066666666667 66.4533333333333 122.5653333333333C60.9386666666667 122.5973333333334 55.1306666666667 122.5546666666667 53.5466666666667 122.464M74.6666666666667 101.3333333333333L74.6666666666667 90.6666666666667L64 90.6666666666667L53.3333333333333 90.6666666666667L53.3333333333333 101.3333333333333L53.3333333333333 112L64 112L74.6666666666667 112L74.6666666666667 101.3333333333333M37.3333333333333 26.6666666666667L37.3333333333333 16L26.6666666666667 16L16 16L16 26.6666666666667L16 37.3333333333333L26.6666666666667 37.3333333333333L37.3333333333333 37.3333333333333L37.3333333333333 26.6666666666667M112 26.6666666666667L112 16L101.3333333333333 16L90.6666666666667 16L90.6666666666667 26.6666666666667L90.6666666666667 37.3333333333333L101.3333333333333 37.3333333333333L112 37.3333333333333L112 26.6666666666667" />
+    <glyph glyph-name="plus"
+      unicode="&#xF11C;"
+      horiz-adv-x="128" d="M61.9573333333333 106.1493333333333C60.9813333333333 105.728 59.7706666666667 104.5866666666667 59.2426666666667 103.5946666666667C58.7786666666667 102.72 58.7786666666667 102.7093333333333 58.704 86.0586666666667L58.6293333333333 69.3973333333333L42.0533333333333 69.28C23.8346666666667 69.1466666666667 24.752 69.2213333333333 23.152 67.8133333333333C22.0426666666667 66.8426666666667 21.5573333333333 65.696 21.552 64.048C21.5413333333333 61.872 22.496 60.2773333333333 24.4266666666667 59.2373333333333C25.2746666666667 58.7786666666667 25.3546666666667 58.7786666666667 41.9573333333333 58.704L58.6293333333333 58.6293333333333L58.704 41.9573333333333C58.7786666666667 25.3546666666667 58.7786666666667 25.2746666666667 59.2373333333333 24.4266666666667C60.2666666666667 22.5173333333333 61.8666666666667 21.5466666666667 64 21.5466666666667C66.1333333333333 21.5466666666667 67.7333333333333 22.5173333333333 68.7626666666667 24.4266666666667C69.2213333333333 25.2746666666667 69.2213333333333 25.3546666666667 69.296 41.9573333333333L69.3706666666667 58.6293333333333L86.0426666666667 58.704C102.6453333333333 58.7786666666667 102.7253333333333 58.7786666666667 103.5733333333333 59.2373333333333C105.504 60.2773333333333 106.4586666666667 61.872 106.448 64.048C106.4426666666667 65.696 105.9573333333333 66.8426666666667 104.848 67.8133333333333C103.248 69.2213333333333 104.1653333333333 69.1466666666667 85.9466666666667 69.28L69.3706666666667 69.3973333333333L69.296 86.0586666666667C69.2213333333333 102.6346666666667 69.2213333333333 102.7253333333333 68.7626666666667 103.5733333333333C68.208 104.608 67.3813333333333 105.4026666666667 66.2453333333333 106.0053333333333C65.2426666666667 106.5333333333333 63.008 106.608 61.9573333333333 106.1493333333333" />
+    <glyph glyph-name="plus-1"
+      unicode="&#x70;&#x6C;&#x75;&#x73;"
+      horiz-adv-x="128" d="M61.9573333333333 106.1493333333333C60.9813333333333 105.728 59.7706666666667 104.5866666666667 59.2426666666667 103.5946666666667C58.7786666666667 102.72 58.7786666666667 102.7093333333333 58.704 86.0586666666667L58.6293333333333 69.3973333333333L42.0533333333333 69.28C23.8346666666667 69.1466666666667 24.752 69.2213333333333 23.152 67.8133333333333C22.0426666666667 66.8426666666667 21.5573333333333 65.696 21.552 64.048C21.5413333333333 61.872 22.496 60.2773333333333 24.4266666666667 59.2373333333333C25.2746666666667 58.7786666666667 25.3546666666667 58.7786666666667 41.9573333333333 58.704L58.6293333333333 58.6293333333333L58.704 41.9573333333333C58.7786666666667 25.3546666666667 58.7786666666667 25.2746666666667 59.2373333333333 24.4266666666667C60.2666666666667 22.5173333333333 61.8666666666667 21.5466666666667 64 21.5466666666667C66.1333333333333 21.5466666666667 67.7333333333333 22.5173333333333 68.7626666666667 24.4266666666667C69.2213333333333 25.2746666666667 69.2213333333333 25.3546666666667 69.296 41.9573333333333L69.3706666666667 58.6293333333333L86.0426666666667 58.704C102.6453333333333 58.7786666666667 102.7253333333333 58.7786666666667 103.5733333333333 59.2373333333333C105.504 60.2773333333333 106.4586666666667 61.872 106.448 64.048C106.4426666666667 65.696 105.9573333333333 66.8426666666667 104.848 67.8133333333333C103.248 69.2213333333333 104.1653333333333 69.1466666666667 85.9466666666667 69.28L69.3706666666667 69.3973333333333L69.296 86.0586666666667C69.2213333333333 102.6346666666667 69.2213333333333 102.7253333333333 68.7626666666667 103.5733333333333C68.208 104.608 67.3813333333333 105.4026666666667 66.2453333333333 106.0053333333333C65.2426666666667 106.5333333333333 63.008 106.608 61.9573333333333 106.1493333333333" />
+    <glyph glyph-name="triangle-alert"
       unicode="&#xF11D;"
-      horiz-adv-x="128" d="M38.5066666666667 122.4746666666667C28.7306666666667 122.3466666666667 28.4426666666667 122.3306666666667 27.0933333333333 121.8506666666667C24.2453333333333 120.832 21.696 119.0346666666667 19.6213333333333 116.5813333333333C18.2933333333333 115.008 17.4613333333333 113.424 16.6506666666667 110.9333333333333L16 108.9226666666667L16 64L16 19.0773333333333L16.6506666666667 17.0666666666667C17.7813333333333 13.5733333333334 19.2586666666667 11.36 22 9.0293333333333C23.648 7.632 25.2053333333333 6.8053333333333 27.7333333333333 5.984L29.744 5.3333333333333L64 5.3333333333333L98.256 5.3333333333333L100.2666666666667 5.984C103.7386666666667 7.1093333333333 105.9093333333333 8.5706666666667 108.3146666666667 11.3866666666667C109.7333333333333 13.0453333333333 110.528 14.5386666666667 111.3493333333333 17.0666666666667L112 19.0773333333333L111.9946666666667 55.3493333333333C111.9893333333333 90.4533333333333 111.9786666666667 91.6533333333333 111.5893333333333 92.512C111.3493333333333 93.0346666666667 109.744 94.9226666666667 107.6746666666667 97.0986666666667C102.128 102.9493333333333 83.8346666666667 120.9973333333333 82.6826666666667 121.76L81.632 122.4533333333333L70.9493333333333 122.4533333333333C65.072 122.4533333333333 57.6266666666667 122.4906666666667 54.4 122.5333333333333C51.1733333333333 122.576 44.0213333333333 122.5493333333333 38.5066666666667 122.4746666666667M69.392 102.88C69.4613333333333 97.3333333333333 69.6 93.2586666666667 69.7546666666667 92.48C70.0853333333333 90.7573333333333 71.6213333333333 87.6586666666667 72.9546666666667 86.032C73.5466666666667 85.3013333333333 74.6346666666667 84.2133333333333 75.3653333333333 83.6213333333333C76.992 82.288 80.0906666666667 80.752 81.8133333333333 80.4213333333333C82.5813333333333 80.272 86.7253333333333 80.128 92.2133333333333 80.0586666666667L101.3333333333333 79.9413333333334L101.3333333333333 50.096C101.3333333333333 23.7813333333333 101.296 20.16 101.008 19.472C100.5013333333333 18.2613333333333 99.7066666666667 17.344 98.608 16.6986666666667L97.6 16.1066666666667L64 16.1066666666667L30.4 16.1066666666667L29.376 16.7093333333333C28.24 17.376 27.2053333333333 18.656 26.864 19.8186666666667C26.7093333333333 20.352 26.6613333333333 34.0533333333333 26.704 64.32L26.7733333333333 108.0533333333333L27.2693333333333 109.0613333333333C27.8293333333333 110.1973333333333 28.7146666666667 111.0293333333333 29.9733333333333 111.6C30.7786666666667 111.968 31.9093333333333 111.9893333333333 50.0533333333333 111.9946666666667L69.2746666666667 112L69.392 102.88M98.7733333333333 90.816C98.7733333333333 90.72 95.392 90.672 91.2533333333333 90.7093333333333L83.7333333333333 90.7733333333333L82.7093333333333 91.376C81.4346666666667 92.1226666666667 80.528 93.3546666666667 80.2293333333333 94.7413333333333C80.0906666666667 95.376 80 98.624 80 102.784L80 109.76L89.3866666666667 100.3733333333333C94.5493333333333 95.2106666666667 98.7733333333333 90.912 98.7733333333333 90.816M42.6666666666667 85.1413333333333C40.5706666666667 84.9706666666667 39.808 84.6293333333333 38.7413333333333 83.3813333333334C37.856 82.3466666666667 37.552 81.4293333333334 37.5466666666667 79.8346666666667C37.5466666666667 77.872 38.5706666666667 76.24 40.4266666666667 75.232C41.248 74.7893333333333 41.5146666666667 74.7733333333333 48 74.7733333333333C54.4853333333333 74.7733333333333 54.752 74.7893333333333 55.5733333333333 75.232C57.488 76.2666666666667 58.4533333333333 77.872 58.4533333333333 80C58.4533333333333 82.1013333333333 57.6373333333333 83.5093333333333 55.7866666666667 84.5866666666667C54.9706666666667 85.0666666666667 54.6986666666667 85.0933333333333 49.7066666666667 85.1893333333333C46.832 85.248 43.664 85.2266666666667 42.6666666666667 85.1413333333333M46.9333333333333 63.808C40.112 63.664 40.128 63.6693333333333 38.7413333333333 62.048C37.856 61.0133333333333 37.552 60.096 37.5466666666667 58.5013333333333C37.5466666666667 56.4693333333333 38.5973333333333 54.864 40.5813333333333 53.8453333333333L41.584 53.3333333333333L64 53.3333333333333L86.416 53.3333333333333L87.4186666666667 53.8453333333333C89.4613333333333 54.8906666666667 90.4533333333333 56.464 90.4533333333333 58.6666666666667C90.4533333333333 60.7733333333333 89.632 62.1866666666667 87.7866666666667 63.248L86.9333333333333 63.744L69.9733333333333 63.8346666666667C60.6453333333333 63.888 50.2773333333333 63.872 46.9333333333333 63.808M46.9333333333333 42.4746666666667C40.112 42.3306666666667 40.128 42.336 38.7413333333333 40.7146666666667C37.856 39.68 37.552 38.7626666666667 37.5466666666667 37.168C37.5466666666667 35.136 38.5973333333333 33.5306666666667 40.5813333333333 32.512L41.584 32L64 32L86.416 32L87.4186666666667 32.512C89.4613333333333 33.5573333333333 90.4533333333333 35.1306666666667 90.4533333333333 37.3333333333333C90.4533333333333 39.44 89.632 40.8533333333333 87.7866666666667 41.9146666666667L86.9333333333333 42.4106666666667L69.9733333333333 42.5013333333334C60.6453333333333 42.5546666666667 50.2773333333333 42.5386666666667 46.9333333333333 42.4746666666667" />
-    <glyph glyph-name="file-text-1"
-      unicode="&#x66;&#x69;&#x6C;&#x65;&#x2D;&#x74;&#x65;&#x78;&#x74;"
-      horiz-adv-x="128" d="M38.5066666666667 122.4746666666667C28.7306666666667 122.3466666666667 28.4426666666667 122.3306666666667 27.0933333333333 121.8506666666667C24.2453333333333 120.832 21.696 119.0346666666667 19.6213333333333 116.5813333333333C18.2933333333333 115.008 17.4613333333333 113.424 16.6506666666667 110.9333333333333L16 108.9226666666667L16 64L16 19.0773333333333L16.6506666666667 17.0666666666667C17.7813333333333 13.5733333333334 19.2586666666667 11.36 22 9.0293333333333C23.648 7.632 25.2053333333333 6.8053333333333 27.7333333333333 5.984L29.744 5.3333333333333L64 5.3333333333333L98.256 5.3333333333333L100.2666666666667 5.984C103.7386666666667 7.1093333333333 105.9093333333333 8.5706666666667 108.3146666666667 11.3866666666667C109.7333333333333 13.0453333333333 110.528 14.5386666666667 111.3493333333333 17.0666666666667L112 19.0773333333333L111.9946666666667 55.3493333333333C111.9893333333333 90.4533333333333 111.9786666666667 91.6533333333333 111.5893333333333 92.512C111.3493333333333 93.0346666666667 109.744 94.9226666666667 107.6746666666667 97.0986666666667C102.128 102.9493333333333 83.8346666666667 120.9973333333333 82.6826666666667 121.76L81.632 122.4533333333333L70.9493333333333 122.4533333333333C65.072 122.4533333333333 57.6266666666667 122.4906666666667 54.4 122.5333333333333C51.1733333333333 122.576 44.0213333333333 122.5493333333333 38.5066666666667 122.4746666666667M69.392 102.88C69.4613333333333 97.3333333333333 69.6 93.2586666666667 69.7546666666667 92.48C70.0853333333333 90.7573333333333 71.6213333333333 87.6586666666667 72.9546666666667 86.032C73.5466666666667 85.3013333333333 74.6346666666667 84.2133333333333 75.3653333333333 83.6213333333333C76.992 82.288 80.0906666666667 80.752 81.8133333333333 80.4213333333333C82.5813333333333 80.272 86.7253333333333 80.128 92.2133333333333 80.0586666666667L101.3333333333333 79.9413333333334L101.3333333333333 50.096C101.3333333333333 23.7813333333333 101.296 20.16 101.008 19.472C100.5013333333333 18.2613333333333 99.7066666666667 17.344 98.608 16.6986666666667L97.6 16.1066666666667L64 16.1066666666667L30.4 16.1066666666667L29.376 16.7093333333333C28.24 17.376 27.2053333333333 18.656 26.864 19.8186666666667C26.7093333333333 20.352 26.6613333333333 34.0533333333333 26.704 64.32L26.7733333333333 108.0533333333333L27.2693333333333 109.0613333333333C27.8293333333333 110.1973333333333 28.7146666666667 111.0293333333333 29.9733333333333 111.6C30.7786666666667 111.968 31.9093333333333 111.9893333333333 50.0533333333333 111.9946666666667L69.2746666666667 112L69.392 102.88M98.7733333333333 90.816C98.7733333333333 90.72 95.392 90.672 91.2533333333333 90.7093333333333L83.7333333333333 90.7733333333333L82.7093333333333 91.376C81.4346666666667 92.1226666666667 80.528 93.3546666666667 80.2293333333333 94.7413333333333C80.0906666666667 95.376 80 98.624 80 102.784L80 109.76L89.3866666666667 100.3733333333333C94.5493333333333 95.2106666666667 98.7733333333333 90.912 98.7733333333333 90.816M42.6666666666667 85.1413333333333C40.5706666666667 84.9706666666667 39.808 84.6293333333333 38.7413333333333 83.3813333333334C37.856 82.3466666666667 37.552 81.4293333333334 37.5466666666667 79.8346666666667C37.5466666666667 77.872 38.5706666666667 76.24 40.4266666666667 75.232C41.248 74.7893333333333 41.5146666666667 74.7733333333333 48 74.7733333333333C54.4853333333333 74.7733333333333 54.752 74.7893333333333 55.5733333333333 75.232C57.488 76.2666666666667 58.4533333333333 77.872 58.4533333333333 80C58.4533333333333 82.1013333333333 57.6373333333333 83.5093333333333 55.7866666666667 84.5866666666667C54.9706666666667 85.0666666666667 54.6986666666667 85.0933333333333 49.7066666666667 85.1893333333333C46.832 85.248 43.664 85.2266666666667 42.6666666666667 85.1413333333333M46.9333333333333 63.808C40.112 63.664 40.128 63.6693333333333 38.7413333333333 62.048C37.856 61.0133333333333 37.552 60.096 37.5466666666667 58.5013333333333C37.5466666666667 56.4693333333333 38.5973333333333 54.864 40.5813333333333 53.8453333333333L41.584 53.3333333333333L64 53.3333333333333L86.416 53.3333333333333L87.4186666666667 53.8453333333333C89.4613333333333 54.8906666666667 90.4533333333333 56.464 90.4533333333333 58.6666666666667C90.4533333333333 60.7733333333333 89.632 62.1866666666667 87.7866666666667 63.248L86.9333333333333 63.744L69.9733333333333 63.8346666666667C60.6453333333333 63.888 50.2773333333333 63.872 46.9333333333333 63.808M46.9333333333333 42.4746666666667C40.112 42.3306666666667 40.128 42.336 38.7413333333333 40.7146666666667C37.856 39.68 37.552 38.7626666666667 37.5466666666667 37.168C37.5466666666667 35.136 38.5973333333333 33.5306666666667 40.5813333333333 32.512L41.584 32L64 32L86.416 32L87.4186666666667 32.512C89.4613333333333 33.5573333333333 90.4533333333333 35.1306666666667 90.4533333333333 37.3333333333333C90.4533333333333 39.44 89.632 40.8533333333333 87.7866666666667 41.9146666666667L86.9333333333333 42.4106666666667L69.9733333333333 42.5013333333334C60.6453333333333 42.5546666666667 50.2773333333333 42.5386666666667 46.9333333333333 42.4746666666667" />
-    <glyph glyph-name="panel-bottom"
-      unicode="&#xF11E;"
-      horiz-adv-x="128" d="M22.848 116.7893333333333C19.0346666666667 115.9626666666667 14.5706666666667 112.4853333333333 12.6133333333333 108.8213333333333C12.2613333333333 108.1546666666667 11.6746666666667 106.704 11.3173333333333 105.6L10.6666666666667 103.5893333333333L10.6666666666667 64L10.6666666666667 24.4106666666667L11.3173333333333 22.4C12.448 18.9066666666667 13.9253333333333 16.6933333333333 16.6666666666667 14.3626666666667C18.3146666666667 12.9653333333333 19.872 12.1386666666667 22.4 11.3173333333333L24.4106666666667 10.6666666666667L64 10.6666666666667L103.5893333333333 10.6666666666667L105.6 11.3173333333333C108.128 12.1386666666667 109.6213333333333 12.9333333333333 111.28 14.352C114.096 16.7573333333333 115.5573333333333 18.928 116.6826666666667 22.4L117.3333333333333 24.4106666666667L117.3333333333333 64L117.3333333333333 103.5893333333333L116.6826666666667 105.6C115.5413333333334 109.12 114.1493333333333 111.1946666666667 111.28 113.648C109.7706666666667 114.9386666666667 108.2666666666667 115.776 106.0693333333333 116.5653333333333L104.5066666666667 117.12L64.3626666666667 117.104C30.9653333333333 117.088 23.984 117.0346666666667 22.848 116.7893333333333M103.36 106.2666666666667C104.6186666666667 105.696 105.504 104.864 106.064 103.728L106.56 102.72L106.624 78.0266666666667L106.688 53.3333333333333L64 53.3333333333333L21.312 53.3333333333333L21.376 78.0266666666667L21.44 102.72L21.936 103.728C22.496 104.864 23.3813333333333 105.696 24.64 106.2666666666667C25.456 106.64 27.1893333333333 106.656 64 106.656C100.8106666666667 106.656 102.544 106.64 103.36 106.2666666666667M106.6506666666667 34.72C106.64 30.352 106.5653333333333 26.2666666666667 106.4746666666667 25.648C106.2666666666667 24.176 105.3653333333333 22.9066666666667 103.8933333333333 22.0266666666667L102.7413333333333 21.3333333333333L64 21.3333333333333L25.2586666666667 21.3333333333333L24.1066666666667 22.0266666666667C22.704 22.8693333333333 21.7546666666667 24.16 21.5253333333333 25.536C21.4346666666667 26.096 21.3546666666667 30.1866666666667 21.344 34.6133333333333L21.3333333333333 42.6666666666667L64 42.6666666666667L106.6666666666667 42.6666666666667L106.6506666666667 34.72" />
-    <glyph glyph-name="panel-bottom-1"
-      unicode="&#x70;&#x61;&#x6E;&#x65;&#x6C;&#x2D;&#x62;&#x6F;&#x74;&#x74;&#x6F;&#x6D;"
-      horiz-adv-x="128" d="M22.848 116.7893333333333C19.0346666666667 115.9626666666667 14.5706666666667 112.4853333333333 12.6133333333333 108.8213333333333C12.2613333333333 108.1546666666667 11.6746666666667 106.704 11.3173333333333 105.6L10.6666666666667 103.5893333333333L10.6666666666667 64L10.6666666666667 24.4106666666667L11.3173333333333 22.4C12.448 18.9066666666667 13.9253333333333 16.6933333333333 16.6666666666667 14.3626666666667C18.3146666666667 12.9653333333333 19.872 12.1386666666667 22.4 11.3173333333333L24.4106666666667 10.6666666666667L64 10.6666666666667L103.5893333333333 10.6666666666667L105.6 11.3173333333333C108.128 12.1386666666667 109.6213333333333 12.9333333333333 111.28 14.352C114.096 16.7573333333333 115.5573333333333 18.928 116.6826666666667 22.4L117.3333333333333 24.4106666666667L117.3333333333333 64L117.3333333333333 103.5893333333333L116.6826666666667 105.6C115.5413333333334 109.12 114.1493333333333 111.1946666666667 111.28 113.648C109.7706666666667 114.9386666666667 108.2666666666667 115.776 106.0693333333333 116.5653333333333L104.5066666666667 117.12L64.3626666666667 117.104C30.9653333333333 117.088 23.984 117.0346666666667 22.848 116.7893333333333M103.36 106.2666666666667C104.6186666666667 105.696 105.504 104.864 106.064 103.728L106.56 102.72L106.624 78.0266666666667L106.688 53.3333333333333L64 53.3333333333333L21.312 53.3333333333333L21.376 78.0266666666667L21.44 102.72L21.936 103.728C22.496 104.864 23.3813333333333 105.696 24.64 106.2666666666667C25.456 106.64 27.1893333333333 106.656 64 106.656C100.8106666666667 106.656 102.544 106.64 103.36 106.2666666666667M106.6506666666667 34.72C106.64 30.352 106.5653333333333 26.2666666666667 106.4746666666667 25.648C106.2666666666667 24.176 105.3653333333333 22.9066666666667 103.8933333333333 22.0266666666667L102.7413333333333 21.3333333333333L64 21.3333333333333L25.2586666666667 21.3333333333333L24.1066666666667 22.0266666666667C22.704 22.8693333333333 21.7546666666667 24.16 21.5253333333333 25.536C21.4346666666667 26.096 21.3546666666667 30.1866666666667 21.344 34.6133333333333L21.3333333333333 42.6666666666667L64 42.6666666666667L106.6666666666667 42.6666666666667L106.6506666666667 34.72" />
-    <glyph glyph-name="x"
-      unicode="&#xF11F;"
-      horiz-adv-x="128" d="M29.9573333333333 100.816C28.944 100.3786666666667 27.7066666666667 99.1893333333333 27.28 98.24C26.8053333333333 97.2 26.7573333333333 95.008 27.184 93.9786666666667C27.5786666666667 93.04 30.0053333333333 90.5173333333333 44.4693333333333 76L56.4266666666667 64L44.4693333333333 52C29.8613333333333 37.344 27.5786666666667 34.96 27.1626666666667 33.968C26.7413333333333 32.9653333333334 26.752 31.0453333333333 27.184 30.032C27.6053333333333 29.04 28.672 27.808 29.472 27.3973333333333C30.48 26.8746666666667 32 26.6773333333333 33.136 26.9173333333333C33.8666666666667 27.072 34.5386666666667 27.4506666666667 35.4826666666667 28.2293333333333C36.208 28.832 42.9226666666667 35.4133333333333 50.4 42.8533333333333L64 56.384L77.6 42.8533333333333C85.0826666666667 35.4133333333333 91.792 28.832 92.5173333333333 28.2293333333333C94.0533333333333 26.96 95.28 26.5813333333333 96.9013333333333 26.8906666666667C98.2453333333333 27.1413333333333 98.9973333333333 27.552 99.808 28.4746666666667C100.7413333333333 29.536 101.152 30.6186666666667 101.1573333333333 32.0106666666667C101.168 34.3893333333333 101.856 33.6106666666667 83.424 52.1066666666667L71.5733333333333 64L83.424 75.8933333333334C98.08 90.6026666666667 100.4266666666667 93.0453333333333 100.8373333333333 94.0266666666667C101.3173333333333 95.1786666666667 101.2533333333333 96.9973333333333 100.688 98.2026666666667C99.8026666666667 100.0906666666667 98.08 101.12 95.808 101.12C93.5733333333333 101.12 94.2933333333333 101.76 76 83.5306666666667L64 71.5733333333333L52.32 83.216C36.6453333333333 98.832 34.7786666666667 100.6133333333334 33.7706666666667 100.8906666666667C32.6613333333333 101.2 30.752 101.1626666666667 29.9573333333333 100.816" />
-    <glyph glyph-name="x-1"
-      unicode="&#x78;"
-      horiz-adv-x="128" d="M29.9573333333333 100.816C28.944 100.3786666666667 27.7066666666667 99.1893333333333 27.28 98.24C26.8053333333333 97.2 26.7573333333333 95.008 27.184 93.9786666666667C27.5786666666667 93.04 30.0053333333333 90.5173333333333 44.4693333333333 76L56.4266666666667 64L44.4693333333333 52C29.8613333333333 37.344 27.5786666666667 34.96 27.1626666666667 33.968C26.7413333333333 32.9653333333334 26.752 31.0453333333333 27.184 30.032C27.6053333333333 29.04 28.672 27.808 29.472 27.3973333333333C30.48 26.8746666666667 32 26.6773333333333 33.136 26.9173333333333C33.8666666666667 27.072 34.5386666666667 27.4506666666667 35.4826666666667 28.2293333333333C36.208 28.832 42.9226666666667 35.4133333333333 50.4 42.8533333333333L64 56.384L77.6 42.8533333333333C85.0826666666667 35.4133333333333 91.792 28.832 92.5173333333333 28.2293333333333C94.0533333333333 26.96 95.28 26.5813333333333 96.9013333333333 26.8906666666667C98.2453333333333 27.1413333333333 98.9973333333333 27.552 99.808 28.4746666666667C100.7413333333333 29.536 101.152 30.6186666666667 101.1573333333333 32.0106666666667C101.168 34.3893333333333 101.856 33.6106666666667 83.424 52.1066666666667L71.5733333333333 64L83.424 75.8933333333334C98.08 90.6026666666667 100.4266666666667 93.0453333333333 100.8373333333333 94.0266666666667C101.3173333333333 95.1786666666667 101.2533333333333 96.9973333333333 100.688 98.2026666666667C99.8026666666667 100.0906666666667 98.08 101.12 95.808 101.12C93.5733333333333 101.12 94.2933333333333 101.76 76 83.5306666666667L64 71.5733333333333L52.32 83.216C36.6453333333333 98.832 34.7786666666667 100.6133333333334 33.7706666666667 100.8906666666667C32.6613333333333 101.2 30.752 101.1626666666667 29.9573333333333 100.816" />
-    <glyph glyph-name="layout-panel-top"
-      unicode="&#xF120;"
-      horiz-adv-x="128" d="M19.5253333333333 117.0933333333333C15.232 116.4693333333334 11.52 112.6773333333333 10.8906666666667 108.2666666666667C10.608 106.288 10.608 80.3786666666667 10.8906666666667 78.4C11.536 73.888 15.2213333333333 70.2026666666667 19.7333333333333 69.5573333333333C21.776 69.264 106.224 69.264 108.2666666666667 69.5573333333333C112.7786666666667 70.2026666666667 116.464 73.888 117.1093333333333 78.4C117.2373333333333 79.2693333333333 117.3226666666667 85.504 117.3226666666667 93.3333333333333C117.3226666666667 101.1626666666667 117.2373333333333 107.3973333333333 117.1093333333333 108.2666666666667C116.464 112.7786666666667 112.7786666666667 116.464 108.2666666666667 117.1093333333334C106.4 117.376 21.3653333333333 117.3653333333334 19.5253333333333 117.0933333333333M106.6666666666667 93.3333333333333L106.6666666666667 80L64 80L21.3333333333333 80L21.3333333333333 93.3333333333333L21.3333333333333 106.6666666666667L64 106.6666666666667L106.6666666666667 106.6666666666667L106.6666666666667 93.3333333333333M19.5253333333333 58.4266666666667C15.232 57.8026666666667 11.52 54.0106666666667 10.8906666666667 49.6C10.608 47.6213333333333 10.608 21.712 10.8906666666667 19.7333333333333C11.536 15.2213333333333 15.2213333333333 11.536 19.7333333333333 10.8906666666667C20.6026666666667 10.7626666666667 26.8373333333333 10.6773333333333 34.6666666666667 10.6773333333333C42.496 10.6773333333333 48.7306666666667 10.7626666666667 49.6 10.8906666666667C54.112 11.536 57.7973333333333 15.2213333333333 58.4426666666667 19.7333333333333C58.7253333333333 21.712 58.7253333333333 47.6213333333333 58.4426666666667 49.6C57.7973333333333 54.112 54.112 57.7973333333333 49.6 58.4426666666667C47.7653333333333 58.7093333333333 21.3386666666667 58.6933333333333 19.5253333333333 58.4266666666667M78.192 58.4266666666667C73.8986666666667 57.8026666666667 70.1866666666667 54.0106666666667 69.5573333333333 49.6C69.2746666666667 47.6213333333333 69.2746666666667 21.712 69.5573333333333 19.7333333333333C70.2026666666667 15.2213333333333 73.888 11.536 78.4 10.8906666666667C79.2693333333333 10.7626666666667 85.504 10.6773333333333 93.3333333333333 10.6773333333333C101.1626666666667 10.6773333333333 107.3973333333333 10.7626666666667 108.2666666666667 10.8906666666667C112.7786666666667 11.536 116.464 15.2213333333333 117.1093333333333 19.7333333333333C117.392 21.712 117.392 47.6213333333333 117.1093333333333 49.6C116.464 54.112 112.7786666666667 57.7973333333333 108.2666666666667 58.4426666666667C106.432 58.7093333333333 80.0053333333333 58.6933333333333 78.192 58.4266666666667M48 34.6666666666667L48 21.3333333333333L34.6666666666667 21.3333333333333L21.3333333333333 21.3333333333333L21.3333333333333 34.6666666666667L21.3333333333333 48L34.6666666666667 48L48 48L48 34.6666666666667M106.6666666666667 34.6666666666667L106.6666666666667 21.3333333333333L93.3333333333333 21.3333333333333L80 21.3333333333333L80 34.6666666666667L80 48L93.3333333333333 48L106.6666666666667 48L106.6666666666667 34.6666666666667" />
-    <glyph glyph-name="layout-panel-top-1"
-      unicode="&#x6C;&#x61;&#x79;&#x6F;&#x75;&#x74;&#x2D;&#x70;&#x61;&#x6E;&#x65;&#x6C;&#x2D;&#x74;&#x6F;&#x70;"
-      horiz-adv-x="128" d="M19.5253333333333 117.0933333333333C15.232 116.4693333333334 11.52 112.6773333333333 10.8906666666667 108.2666666666667C10.608 106.288 10.608 80.3786666666667 10.8906666666667 78.4C11.536 73.888 15.2213333333333 70.2026666666667 19.7333333333333 69.5573333333333C21.776 69.264 106.224 69.264 108.2666666666667 69.5573333333333C112.7786666666667 70.2026666666667 116.464 73.888 117.1093333333333 78.4C117.2373333333333 79.2693333333333 117.3226666666667 85.504 117.3226666666667 93.3333333333333C117.3226666666667 101.1626666666667 117.2373333333333 107.3973333333333 117.1093333333333 108.2666666666667C116.464 112.7786666666667 112.7786666666667 116.464 108.2666666666667 117.1093333333334C106.4 117.376 21.3653333333333 117.3653333333334 19.5253333333333 117.0933333333333M106.6666666666667 93.3333333333333L106.6666666666667 80L64 80L21.3333333333333 80L21.3333333333333 93.3333333333333L21.3333333333333 106.6666666666667L64 106.6666666666667L106.6666666666667 106.6666666666667L106.6666666666667 93.3333333333333M19.5253333333333 58.4266666666667C15.232 57.8026666666667 11.52 54.0106666666667 10.8906666666667 49.6C10.608 47.6213333333333 10.608 21.712 10.8906666666667 19.7333333333333C11.536 15.2213333333333 15.2213333333333 11.536 19.7333333333333 10.8906666666667C20.6026666666667 10.7626666666667 26.8373333333333 10.6773333333333 34.6666666666667 10.6773333333333C42.496 10.6773333333333 48.7306666666667 10.7626666666667 49.6 10.8906666666667C54.112 11.536 57.7973333333333 15.2213333333333 58.4426666666667 19.7333333333333C58.7253333333333 21.712 58.7253333333333 47.6213333333333 58.4426666666667 49.6C57.7973333333333 54.112 54.112 57.7973333333333 49.6 58.4426666666667C47.7653333333333 58.7093333333333 21.3386666666667 58.6933333333333 19.5253333333333 58.4266666666667M78.192 58.4266666666667C73.8986666666667 57.8026666666667 70.1866666666667 54.0106666666667 69.5573333333333 49.6C69.2746666666667 47.6213333333333 69.2746666666667 21.712 69.5573333333333 19.7333333333333C70.2026666666667 15.2213333333333 73.888 11.536 78.4 10.8906666666667C79.2693333333333 10.7626666666667 85.504 10.6773333333333 93.3333333333333 10.6773333333333C101.1626666666667 10.6773333333333 107.3973333333333 10.7626666666667 108.2666666666667 10.8906666666667C112.7786666666667 11.536 116.464 15.2213333333333 117.1093333333333 19.7333333333333C117.392 21.712 117.392 47.6213333333333 117.1093333333333 49.6C116.464 54.112 112.7786666666667 57.7973333333333 108.2666666666667 58.4426666666667C106.432 58.7093333333333 80.0053333333333 58.6933333333333 78.192 58.4266666666667M48 34.6666666666667L48 21.3333333333333L34.6666666666667 21.3333333333333L21.3333333333333 21.3333333333333L21.3333333333333 34.6666666666667L21.3333333333333 48L34.6666666666667 48L48 48L48 34.6666666666667M106.6666666666667 34.6666666666667L106.6666666666667 21.3333333333333L93.3333333333333 21.3333333333333L80 21.3333333333333L80 34.6666666666667L80 48L93.3333333333333 48L106.6666666666667 48L106.6666666666667 34.6666666666667" />
+      horiz-adv-x="128" d="M59.9466666666667 116.8213333333333C56.7733333333333 115.888 54.704 114.6293333333333 52.448 112.2613333333333C50.64 110.3626666666667 51.2373333333333 111.3706666666667 33.392 80.1066666666667C9.904 38.96 6.5013333333333 32.9066666666667 6.0586666666667 31.4666666666667C5.4506666666667 29.4773333333334 5.2266666666667 26.8426666666667 5.488 24.8C6.0053333333333 20.816 7.1733333333333 18.4586666666667 10.1333333333333 15.4666666666667C12.176 13.3973333333333 13.4666666666667 12.5813333333333 16.2666666666667 11.584C17.7973333333333 11.04 17.8986666666667 11.0293333333333 27.0933333333333 10.8373333333333C32.1973333333333 10.7253333333333 52.7893333333333 10.6826666666667 72.8533333333333 10.7413333333333L109.3333333333333 10.8426666666667L110.8266666666667 11.312C115.3493333333333 12.736 118.9226666666667 15.664 120.8373333333333 19.52C121.8826666666667 21.6266666666667 122.2666666666667 23.216 122.3946666666667 25.952C122.5493333333333 29.2906666666667 122.1546666666667 30.9546666666667 120.4213333333333 34.2773333333333C118.0693333333333 38.768 105.36 61.184 88.6826666666667 90.24C83.3973333333333 99.4506666666667 78.5813333333333 107.8346666666667 77.9893333333333 108.8746666666667C77.392 109.9093333333333 76.3946666666667 111.3226666666667 75.7706666666667 112.016C74.4 113.5306666666667 71.76 115.312 69.44 116.2773333333333C67.7813333333333 116.9653333333333 67.6373333333333 116.9866666666667 64.32 117.0453333333333C61.9466666666667 117.088 60.6133333333333 117.0186666666667 59.9466666666667 116.8213333333333M65.0613333333333 106.6453333333333C66.976 106.24 67.6586666666667 105.392 71.968 98.08C78.4906666666667 87.0133333333333 111.392 29.2053333333333 111.7493333333333 28.1813333333333C112.5546666666667 25.856 110.9386666666667 22.544 108.592 21.7066666666667C108 21.4986666666667 98.6186666666667 21.44 63.7866666666667 21.44L19.7333333333333 21.44L18.8586666666667 21.9093333333333C17.8453333333333 22.4533333333333 16.7093333333333 23.6693333333333 16.2933333333333 24.672C16.1333333333333 25.056 16 25.9946666666667 16 26.7466666666667C16 27.92 16.1173333333333 28.3413333333333 16.768 29.5733333333334C17.5253333333333 31.0026666666667 33.072 58.272 50.496 88.7466666666667C60.1066666666667 105.552 60.3253333333333 105.8826666666667 62.464 106.544C63.7173333333333 106.928 63.7493333333333 106.928 65.0613333333333 106.6453333333333M61.9573333333333 84.816C60.9866666666667 84.3946666666667 59.7706666666667 83.2533333333333 59.2426666666667 82.2613333333333C58.7733333333333 81.392 58.7733333333333 81.328 58.7733333333333 69.3333333333333C58.7733333333333 57.3813333333334 58.7786666666667 57.2746666666667 59.232 56.4266666666667C60.2666666666667 54.512 61.872 53.5466666666667 64 53.5466666666667C66.128 53.5466666666667 67.7333333333333 54.512 68.768 56.4266666666667C69.2213333333333 57.2746666666667 69.2266666666667 57.3813333333334 69.2266666666667 69.3333333333333C69.2266666666667 81.2746666666667 69.2213333333333 81.392 68.768 82.24C68.208 83.2746666666667 67.3813333333333 84.0693333333333 66.2453333333333 84.672C65.2426666666667 85.2 63.008 85.2746666666667 61.9573333333333 84.816M61.712 42.0053333333333C59.9253333333333 41.1253333333333 58.8373333333333 39.36 58.832 37.3386666666667C58.8213333333333 35.7653333333333 59.3706666666667 34.512 60.5013333333333 33.52C62.672 31.6053333333333 65.8506666666667 31.7066666666667 67.7653333333333 33.7386666666667C68.8533333333333 34.9013333333333 69.2106666666667 35.792 69.2106666666667 37.3333333333333C69.2106666666667 39.456 67.9893333333333 41.328 66.0853333333333 42.1226666666667C64.9226666666667 42.608 62.8106666666667 42.5493333333334 61.712 42.0053333333333" />
+    <glyph glyph-name="triangle-alert-1"
+      unicode="&#x74;&#x72;&#x69;&#x61;&#x6E;&#x67;&#x6C;&#x65;&#x2D;&#x61;&#x6C;&#x65;&#x72;&#x74;"
+      horiz-adv-x="128" d="M59.9466666666667 116.8213333333333C56.7733333333333 115.888 54.704 114.6293333333333 52.448 112.2613333333333C50.64 110.3626666666667 51.2373333333333 111.3706666666667 33.392 80.1066666666667C9.904 38.96 6.5013333333333 32.9066666666667 6.0586666666667 31.4666666666667C5.4506666666667 29.4773333333334 5.2266666666667 26.8426666666667 5.488 24.8C6.0053333333333 20.816 7.1733333333333 18.4586666666667 10.1333333333333 15.4666666666667C12.176 13.3973333333333 13.4666666666667 12.5813333333333 16.2666666666667 11.584C17.7973333333333 11.04 17.8986666666667 11.0293333333333 27.0933333333333 10.8373333333333C32.1973333333333 10.7253333333333 52.7893333333333 10.6826666666667 72.8533333333333 10.7413333333333L109.3333333333333 10.8426666666667L110.8266666666667 11.312C115.3493333333333 12.736 118.9226666666667 15.664 120.8373333333333 19.52C121.8826666666667 21.6266666666667 122.2666666666667 23.216 122.3946666666667 25.952C122.5493333333333 29.2906666666667 122.1546666666667 30.9546666666667 120.4213333333333 34.2773333333333C118.0693333333333 38.768 105.36 61.184 88.6826666666667 90.24C83.3973333333333 99.4506666666667 78.5813333333333 107.8346666666667 77.9893333333333 108.8746666666667C77.392 109.9093333333333 76.3946666666667 111.3226666666667 75.7706666666667 112.016C74.4 113.5306666666667 71.76 115.312 69.44 116.2773333333333C67.7813333333333 116.9653333333333 67.6373333333333 116.9866666666667 64.32 117.0453333333333C61.9466666666667 117.088 60.6133333333333 117.0186666666667 59.9466666666667 116.8213333333333M65.0613333333333 106.6453333333333C66.976 106.24 67.6586666666667 105.392 71.968 98.08C78.4906666666667 87.0133333333333 111.392 29.2053333333333 111.7493333333333 28.1813333333333C112.5546666666667 25.856 110.9386666666667 22.544 108.592 21.7066666666667C108 21.4986666666667 98.6186666666667 21.44 63.7866666666667 21.44L19.7333333333333 21.44L18.8586666666667 21.9093333333333C17.8453333333333 22.4533333333333 16.7093333333333 23.6693333333333 16.2933333333333 24.672C16.1333333333333 25.056 16 25.9946666666667 16 26.7466666666667C16 27.92 16.1173333333333 28.3413333333333 16.768 29.5733333333334C17.5253333333333 31.0026666666667 33.072 58.272 50.496 88.7466666666667C60.1066666666667 105.552 60.3253333333333 105.8826666666667 62.464 106.544C63.7173333333333 106.928 63.7493333333333 106.928 65.0613333333333 106.6453333333333M61.9573333333333 84.816C60.9866666666667 84.3946666666667 59.7706666666667 83.2533333333333 59.2426666666667 82.2613333333333C58.7733333333333 81.392 58.7733333333333 81.328 58.7733333333333 69.3333333333333C58.7733333333333 57.3813333333334 58.7786666666667 57.2746666666667 59.232 56.4266666666667C60.2666666666667 54.512 61.872 53.5466666666667 64 53.5466666666667C66.128 53.5466666666667 67.7333333333333 54.512 68.768 56.4266666666667C69.2213333333333 57.2746666666667 69.2266666666667 57.3813333333334 69.2266666666667 69.3333333333333C69.2266666666667 81.2746666666667 69.2213333333333 81.392 68.768 82.24C68.208 83.2746666666667 67.3813333333333 84.0693333333333 66.2453333333333 84.672C65.2426666666667 85.2 63.008 85.2746666666667 61.9573333333333 84.816M61.712 42.0053333333333C59.9253333333333 41.1253333333333 58.8373333333333 39.36 58.832 37.3386666666667C58.8213333333333 35.7653333333333 59.3706666666667 34.512 60.5013333333333 33.52C62.672 31.6053333333333 65.8506666666667 31.7066666666667 67.7653333333333 33.7386666666667C68.8533333333333 34.9013333333333 69.2106666666667 35.792 69.2106666666667 37.3333333333333C69.2106666666667 39.456 67.9893333333333 41.328 66.0853333333333 42.1226666666667C64.9226666666667 42.608 62.8106666666667 42.5493333333334 61.712 42.0053333333333" />
     <glyph glyph-name="settings"
-      unicode="&#xF121;"
+      unicode="&#xF11E;"
       horiz-adv-x="128" d="M58.736 122.0426666666667C55.7546666666667 121.2373333333334 53.4773333333333 119.8293333333334 51.1413333333333 117.3546666666667C48.5173333333333 114.576 47.248 111.5093333333333 46.944 107.2426666666667C46.8373333333333 105.7066666666667 46.6133333333333 104.2666666666667 46.3946666666667 103.7333333333333C45.9253333333333 102.5546666666667 44.2133333333333 101.0026666666667 42.2133333333333 99.936C40.8426666666667 99.2106666666667 40.464 99.104 39.2533333333333 99.1093333333333C38.0426666666667 99.1146666666667 37.5733333333333 99.2533333333333 35.52 100.2026666666667C31.9413333333333 101.8613333333333 31.072 102.0746666666667 27.84 102.064C24.6826666666667 102.0533333333333 23.184 101.744 20.7413333333333 100.5866666666667C17.2906666666667 98.96 14.7146666666667 96.1813333333333 12.4266666666667 91.6266666666667C10.3946666666667 87.5786666666667 10.1546666666667 83.0133333333333 11.744 78.6506666666667C12.9173333333333 75.4453333333333 14.5226666666667 73.488 18.2613333333333 70.7146666666667C19.5626666666667 69.7493333333333 20.832 68.6666666666667 21.088 68.3146666666667C22.6186666666667 66.1653333333333 22.4266666666667 61.1306666666667 20.736 59.232C20.5386666666667 59.0026666666667 19.3173333333333 58.0373333333333 18.0266666666667 57.0773333333333C15.0666666666667 54.88 13.4933333333333 53.152 12.384 50.88C11.12 48.288 10.8106666666667 46.88 10.8053333333333 43.6266666666667C10.8 40.4213333333333 11.104 39.008 12.288 36.6453333333333C15.008 31.232 17.904 28.3306666666667 22.1226666666667 26.8106666666667C24.2186666666667 26.0533333333333 26.56 25.728 28.864 25.8773333333333C31.2266666666667 26.0266666666667 32.4373333333333 26.3733333333333 35.52 27.792C37.5466666666667 28.7253333333333 38.0533333333333 28.8746666666667 39.2533333333333 28.8853333333333C40.4746666666667 28.896 40.832 28.8 42.2133333333333 28.064C44.208 27.0026666666667 45.9253333333333 25.4453333333333 46.3946666666667 24.272C46.592 23.776 46.8373333333333 22.3093333333333 46.9333333333333 21.008C47.12 18.5333333333333 47.52 16.656 48.1973333333333 15.072C49.5573333333333 11.9093333333333 52.7146666666667 8.5546666666667 55.712 7.088C58.5493333333333 5.7013333333333 59.8186666666667 5.4933333333333 64.656 5.5946666666667C68.4533333333333 5.6746666666667 68.928 5.728 70.3626666666667 6.24C72.5653333333333 7.024 74.064 7.968 75.984 9.7866666666667C79.28 12.9013333333333 80.688 16.016 81.0666666666667 21.008C81.1626666666667 22.3093333333333 81.408 23.776 81.6053333333333 24.272C82.0746666666667 25.4453333333333 83.792 27.0026666666667 85.7866666666667 28.064C87.168 28.8 87.5253333333333 28.896 88.7466666666667 28.8853333333333C89.9466666666667 28.8746666666667 90.4533333333333 28.7253333333333 92.48 27.792C95.5626666666667 26.3733333333333 96.7733333333333 26.0266666666667 99.136 25.8773333333333C104.6186666666667 25.5306666666667 109.6106666666667 27.7226666666667 112.768 31.8666666666667C114.2773333333333 33.8506666666667 115.984 36.9813333333333 116.6453333333333 38.9866666666667C117.12 40.4266666666667 117.1946666666667 41.0133333333334 117.2 43.52C117.2106666666667 46.8586666666667 116.9226666666667 48.1973333333334 115.6 50.9493333333333C114.5386666666667 53.1573333333333 112.2986666666667 55.5893333333333 109.7866666666667 57.2533333333333C106.576 59.3813333333334 105.952 60.4853333333333 105.936 64.1066666666667C105.92 66.0053333333333 105.9946666666667 66.5973333333333 106.32 67.2C107.088 68.64 107.7653333333333 69.3386666666667 109.872 70.8373333333333C113.6586666666667 73.5466666666667 115.8613333333333 76.5226666666667 116.8266666666667 80.24C117.312 82.096 117.3173333333333 86.6613333333333 116.8426666666667 88.4746666666667C116.2506666666667 90.7146666666667 114.112 94.5706666666667 112.1706666666667 96.896C110.4746666666667 98.9333333333333 107.2213333333333 100.928 104.4426666666667 101.6426666666667C102.576 102.1226666666667 99.5626666666667 102.2773333333333 97.7066666666667 101.9893333333333C96.2346666666667 101.76 95.184 101.3866666666667 91.3066666666667 99.7173333333333C89.2533333333333 98.8373333333333 87.9893333333333 98.88 85.92 99.8986666666667C83.9146666666667 100.8906666666667 82.096 102.5066666666667 81.6053333333333 103.728C81.408 104.2293333333333 81.1626666666667 105.7226666666667 81.056 107.088C80.7786666666667 110.6613333333333 79.9573333333333 113.2 78.3093333333333 115.5733333333334C76.624 118.0053333333334 74.832 119.5893333333333 72.3306666666667 120.848C69.776 122.1333333333333 68.9866666666667 122.288 64.4266666666667 122.3733333333333C60.816 122.4426666666667 60.064 122.4 58.736 122.0426666666667M67.68 111.392C68.64 110.8 69.7226666666667 109.584 70.1066666666667 108.6666666666667C70.2666666666667 108.2826666666667 70.4906666666667 106.8373333333333 70.608 105.4506666666667C70.896 102.0693333333333 71.1253333333333 101.136 72.2293333333333 98.8693333333334C73.8826666666667 95.4826666666667 76.128 93.2373333333333 80.0906666666667 91.0186666666667C82.7733333333333 89.5146666666667 85.4186666666667 88.7146666666667 88.1066666666667 88.592C91.0293333333333 88.4586666666667 92.6453333333333 88.8106666666667 96.256 90.368C98.6666666666667 91.408 99.2853333333333 91.5946666666667 100.3733333333333 91.5893333333333C102.9706666666667 91.5893333333333 104.7573333333333 89.9946666666667 106.304 86.3146666666667C107.0293333333333 84.592 106.9973333333333 83.6213333333333 106.16 81.9733333333333C105.5573333333333 80.7946666666667 105.2693333333333 80.5173333333333 102.7946666666667 78.7573333333333C99.1946666666667 76.192 96.8213333333333 72.9973333333333 95.9146666666667 69.488C95.456 67.7333333333333 95.2746666666667 63.4293333333334 95.5466666666667 60.8693333333334C96.0586666666667 56.0693333333333 98.6773333333333 51.8986666666667 102.9173333333333 49.1413333333333C104.9706666666667 47.8026666666667 105.568 47.2213333333333 106.16 45.9733333333333C106.5173333333333 45.216 106.6613333333333 44.528 106.6666666666667 43.6C106.6666666666667 41.856 105.5786666666667 39.632 103.8933333333333 37.9466666666667C102.8853333333333 36.9333333333333 102.5066666666667 36.6986666666667 101.4986666666667 36.4746666666667C100.016 36.144 99.1466666666667 36.336 96.2506666666667 37.6373333333333C93.4026666666667 38.9173333333333 92.1706666666667 39.2533333333333 89.8133333333333 39.3866666666667C86.208 39.5893333333333 83.2266666666667 38.7786666666667 79.424 36.5546666666667C75.7333333333333 34.4 73.7226666666667 32.2986666666667 72.1173333333333 28.9226666666667C71.1093333333333 26.8 70.9173333333333 25.984 70.6133333333333 22.6133333333333C70.3306666666667 19.4933333333333 69.9946666666667 18.5866666666667 68.6506666666667 17.36C67.5146666666667 16.3146666666667 66.3626666666667 16 63.7226666666667 16C61.4133333333333 16.0053333333333 60.528 16.2773333333333 59.36 17.3493333333333C57.9893333333333 18.6026666666667 57.6693333333333 19.4773333333333 57.3813333333333 22.72C56.8106666666667 29.2 54.304 33.152 48.64 36.512C45.456 38.4 43.168 39.1733333333333 40.1066666666667 39.392C37.0133333333333 39.6106666666667 35.3653333333333 39.2213333333333 30.5066666666667 37.104C27.3013333333333 35.712 25.0346666666667 36.2773333333333 23.2053333333333 38.9226666666667C21.7973333333333 40.96 21.024 43.0026666666667 21.2053333333333 44.1973333333334C21.488 46.0266666666667 22.3093333333333 47.104 24.7466666666667 48.848C25.9786666666667 49.728 27.5626666666667 51.0346666666667 28.2666666666667 51.7493333333333C31.456 54.992 32.8746666666667 59.504 32.56 65.3973333333333C32.3946666666667 68.5653333333333 32.048 69.9466666666667 30.8053333333333 72.4746666666667C29.5946666666667 74.9226666666667 28.0373333333333 76.6346666666667 24.8533333333333 79.008C22.3146666666667 80.9066666666667 21.4826666666667 81.9946666666667 21.2106666666667 83.792C21.0293333333333 84.9706666666667 21.68 86.7466666666667 23.0666666666667 88.8746666666667C24.3466666666667 90.832 25.6106666666667 91.5893333333333 27.6266666666667 91.5893333333333C28.7146666666667 91.5946666666667 29.3333333333333 91.408 31.744 90.368C35.3546666666667 88.8106666666667 36.9706666666667 88.4586666666667 39.8933333333333 88.592C42.7253333333333 88.72 45.472 89.5893333333333 48.2666666666667 91.2426666666667C54.288 94.8 56.8213333333333 98.6986666666667 57.3866666666667 105.28C57.6586666666667 108.448 57.984 109.36 59.264 110.592C60.4426666666667 111.7173333333333 61.6 112.0106666666667 64.5493333333333 111.9306666666667C66.5493333333333 111.8773333333333 67.0293333333333 111.7973333333333 67.68 111.392M60.2986666666667 84.9066666666667C58.56 84.5973333333333 56.3146666666667 83.84 54.5173333333333 82.9653333333333C49.584 80.56 45.7013333333333 76.0586666666667 43.8186666666667 70.5706666666667L42.992 68.16L42.992 64L42.992 59.84L43.8186666666667 57.4293333333334C45.024 53.9093333333333 46.3733333333333 51.76 49.0666666666667 49.0666666666667C51.76 46.3733333333333 53.9093333333333 45.024 57.4293333333333 43.8186666666667L59.84 42.992L64 42.992L68.16 42.992L70.5706666666667 43.8186666666667C73.9306666666667 44.9706666666667 76.224 46.384 78.7413333333333 48.8533333333333C82.928 52.96 84.8266666666667 57.1733333333334 85.0613333333333 62.864C85.328 69.3973333333333 83.5893333333333 74.128 79.264 78.6826666666667C76.7253333333333 81.3546666666667 73.008 83.5573333333333 69.44 84.5066666666667C67.536 85.008 62.1813333333333 85.248 60.2986666666667 84.9066666666667M66.256 74.4373333333333C68.048 74.1066666666667 69.856 73.0773333333333 71.4666666666667 71.4666666666667C74.0693333333333 68.864 75.0346666666667 65.936 74.5013333333333 62.2826666666667C74.0213333333333 58.976 71.664 55.8986666666667 68.368 54.272L66.688 53.44L64 53.44L61.312 53.44L59.632 54.272C56.6666666666667 55.7333333333333 54.1653333333333 58.7626666666667 53.568 61.6106666666667C52.784 65.3653333333333 53.7973333333333 68.7306666666667 56.5333333333333 71.4666666666667C59.2693333333333 74.2026666666667 62.3626666666667 75.1466666666667 66.256 74.4373333333333" />
     <glyph glyph-name="settings-1"
       unicode="&#x73;&#x65;&#x74;&#x74;&#x69;&#x6E;&#x67;&#x73;"
       horiz-adv-x="128" d="M58.736 122.0426666666667C55.7546666666667 121.2373333333334 53.4773333333333 119.8293333333334 51.1413333333333 117.3546666666667C48.5173333333333 114.576 47.248 111.5093333333333 46.944 107.2426666666667C46.8373333333333 105.7066666666667 46.6133333333333 104.2666666666667 46.3946666666667 103.7333333333333C45.9253333333333 102.5546666666667 44.2133333333333 101.0026666666667 42.2133333333333 99.936C40.8426666666667 99.2106666666667 40.464 99.104 39.2533333333333 99.1093333333333C38.0426666666667 99.1146666666667 37.5733333333333 99.2533333333333 35.52 100.2026666666667C31.9413333333333 101.8613333333333 31.072 102.0746666666667 27.84 102.064C24.6826666666667 102.0533333333333 23.184 101.744 20.7413333333333 100.5866666666667C17.2906666666667 98.96 14.7146666666667 96.1813333333333 12.4266666666667 91.6266666666667C10.3946666666667 87.5786666666667 10.1546666666667 83.0133333333333 11.744 78.6506666666667C12.9173333333333 75.4453333333333 14.5226666666667 73.488 18.2613333333333 70.7146666666667C19.5626666666667 69.7493333333333 20.832 68.6666666666667 21.088 68.3146666666667C22.6186666666667 66.1653333333333 22.4266666666667 61.1306666666667 20.736 59.232C20.5386666666667 59.0026666666667 19.3173333333333 58.0373333333333 18.0266666666667 57.0773333333333C15.0666666666667 54.88 13.4933333333333 53.152 12.384 50.88C11.12 48.288 10.8106666666667 46.88 10.8053333333333 43.6266666666667C10.8 40.4213333333333 11.104 39.008 12.288 36.6453333333333C15.008 31.232 17.904 28.3306666666667 22.1226666666667 26.8106666666667C24.2186666666667 26.0533333333333 26.56 25.728 28.864 25.8773333333333C31.2266666666667 26.0266666666667 32.4373333333333 26.3733333333333 35.52 27.792C37.5466666666667 28.7253333333333 38.0533333333333 28.8746666666667 39.2533333333333 28.8853333333333C40.4746666666667 28.896 40.832 28.8 42.2133333333333 28.064C44.208 27.0026666666667 45.9253333333333 25.4453333333333 46.3946666666667 24.272C46.592 23.776 46.8373333333333 22.3093333333333 46.9333333333333 21.008C47.12 18.5333333333333 47.52 16.656 48.1973333333333 15.072C49.5573333333333 11.9093333333333 52.7146666666667 8.5546666666667 55.712 7.088C58.5493333333333 5.7013333333333 59.8186666666667 5.4933333333333 64.656 5.5946666666667C68.4533333333333 5.6746666666667 68.928 5.728 70.3626666666667 6.24C72.5653333333333 7.024 74.064 7.968 75.984 9.7866666666667C79.28 12.9013333333333 80.688 16.016 81.0666666666667 21.008C81.1626666666667 22.3093333333333 81.408 23.776 81.6053333333333 24.272C82.0746666666667 25.4453333333333 83.792 27.0026666666667 85.7866666666667 28.064C87.168 28.8 87.5253333333333 28.896 88.7466666666667 28.8853333333333C89.9466666666667 28.8746666666667 90.4533333333333 28.7253333333333 92.48 27.792C95.5626666666667 26.3733333333333 96.7733333333333 26.0266666666667 99.136 25.8773333333333C104.6186666666667 25.5306666666667 109.6106666666667 27.7226666666667 112.768 31.8666666666667C114.2773333333333 33.8506666666667 115.984 36.9813333333333 116.6453333333333 38.9866666666667C117.12 40.4266666666667 117.1946666666667 41.0133333333334 117.2 43.52C117.2106666666667 46.8586666666667 116.9226666666667 48.1973333333334 115.6 50.9493333333333C114.5386666666667 53.1573333333333 112.2986666666667 55.5893333333333 109.7866666666667 57.2533333333333C106.576 59.3813333333334 105.952 60.4853333333333 105.936 64.1066666666667C105.92 66.0053333333333 105.9946666666667 66.5973333333333 106.32 67.2C107.088 68.64 107.7653333333333 69.3386666666667 109.872 70.8373333333333C113.6586666666667 73.5466666666667 115.8613333333333 76.5226666666667 116.8266666666667 80.24C117.312 82.096 117.3173333333333 86.6613333333333 116.8426666666667 88.4746666666667C116.2506666666667 90.7146666666667 114.112 94.5706666666667 112.1706666666667 96.896C110.4746666666667 98.9333333333333 107.2213333333333 100.928 104.4426666666667 101.6426666666667C102.576 102.1226666666667 99.5626666666667 102.2773333333333 97.7066666666667 101.9893333333333C96.2346666666667 101.76 95.184 101.3866666666667 91.3066666666667 99.7173333333333C89.2533333333333 98.8373333333333 87.9893333333333 98.88 85.92 99.8986666666667C83.9146666666667 100.8906666666667 82.096 102.5066666666667 81.6053333333333 103.728C81.408 104.2293333333333 81.1626666666667 105.7226666666667 81.056 107.088C80.7786666666667 110.6613333333333 79.9573333333333 113.2 78.3093333333333 115.5733333333334C76.624 118.0053333333334 74.832 119.5893333333333 72.3306666666667 120.848C69.776 122.1333333333333 68.9866666666667 122.288 64.4266666666667 122.3733333333333C60.816 122.4426666666667 60.064 122.4 58.736 122.0426666666667M67.68 111.392C68.64 110.8 69.7226666666667 109.584 70.1066666666667 108.6666666666667C70.2666666666667 108.2826666666667 70.4906666666667 106.8373333333333 70.608 105.4506666666667C70.896 102.0693333333333 71.1253333333333 101.136 72.2293333333333 98.8693333333334C73.8826666666667 95.4826666666667 76.128 93.2373333333333 80.0906666666667 91.0186666666667C82.7733333333333 89.5146666666667 85.4186666666667 88.7146666666667 88.1066666666667 88.592C91.0293333333333 88.4586666666667 92.6453333333333 88.8106666666667 96.256 90.368C98.6666666666667 91.408 99.2853333333333 91.5946666666667 100.3733333333333 91.5893333333333C102.9706666666667 91.5893333333333 104.7573333333333 89.9946666666667 106.304 86.3146666666667C107.0293333333333 84.592 106.9973333333333 83.6213333333333 106.16 81.9733333333333C105.5573333333333 80.7946666666667 105.2693333333333 80.5173333333333 102.7946666666667 78.7573333333333C99.1946666666667 76.192 96.8213333333333 72.9973333333333 95.9146666666667 69.488C95.456 67.7333333333333 95.2746666666667 63.4293333333334 95.5466666666667 60.8693333333334C96.0586666666667 56.0693333333333 98.6773333333333 51.8986666666667 102.9173333333333 49.1413333333333C104.9706666666667 47.8026666666667 105.568 47.2213333333333 106.16 45.9733333333333C106.5173333333333 45.216 106.6613333333333 44.528 106.6666666666667 43.6C106.6666666666667 41.856 105.5786666666667 39.632 103.8933333333333 37.9466666666667C102.8853333333333 36.9333333333333 102.5066666666667 36.6986666666667 101.4986666666667 36.4746666666667C100.016 36.144 99.1466666666667 36.336 96.2506666666667 37.6373333333333C93.4026666666667 38.9173333333333 92.1706666666667 39.2533333333333 89.8133333333333 39.3866666666667C86.208 39.5893333333333 83.2266666666667 38.7786666666667 79.424 36.5546666666667C75.7333333333333 34.4 73.7226666666667 32.2986666666667 72.1173333333333 28.9226666666667C71.1093333333333 26.8 70.9173333333333 25.984 70.6133333333333 22.6133333333333C70.3306666666667 19.4933333333333 69.9946666666667 18.5866666666667 68.6506666666667 17.36C67.5146666666667 16.3146666666667 66.3626666666667 16 63.7226666666667 16C61.4133333333333 16.0053333333333 60.528 16.2773333333333 59.36 17.3493333333333C57.9893333333333 18.6026666666667 57.6693333333333 19.4773333333333 57.3813333333333 22.72C56.8106666666667 29.2 54.304 33.152 48.64 36.512C45.456 38.4 43.168 39.1733333333333 40.1066666666667 39.392C37.0133333333333 39.6106666666667 35.3653333333333 39.2213333333333 30.5066666666667 37.104C27.3013333333333 35.712 25.0346666666667 36.2773333333333 23.2053333333333 38.9226666666667C21.7973333333333 40.96 21.024 43.0026666666667 21.2053333333333 44.1973333333334C21.488 46.0266666666667 22.3093333333333 47.104 24.7466666666667 48.848C25.9786666666667 49.728 27.5626666666667 51.0346666666667 28.2666666666667 51.7493333333333C31.456 54.992 32.8746666666667 59.504 32.56 65.3973333333333C32.3946666666667 68.5653333333333 32.048 69.9466666666667 30.8053333333333 72.4746666666667C29.5946666666667 74.9226666666667 28.0373333333333 76.6346666666667 24.8533333333333 79.008C22.3146666666667 80.9066666666667 21.4826666666667 81.9946666666667 21.2106666666667 83.792C21.0293333333333 84.9706666666667 21.68 86.7466666666667 23.0666666666667 88.8746666666667C24.3466666666667 90.832 25.6106666666667 91.5893333333333 27.6266666666667 91.5893333333333C28.7146666666667 91.5946666666667 29.3333333333333 91.408 31.744 90.368C35.3546666666667 88.8106666666667 36.9706666666667 88.4586666666667 39.8933333333333 88.592C42.7253333333333 88.72 45.472 89.5893333333333 48.2666666666667 91.2426666666667C54.288 94.8 56.8213333333333 98.6986666666667 57.3866666666667 105.28C57.6586666666667 108.448 57.984 109.36 59.264 110.592C60.4426666666667 111.7173333333333 61.6 112.0106666666667 64.5493333333333 111.9306666666667C66.5493333333333 111.8773333333333 67.0293333333333 111.7973333333333 67.68 111.392M60.2986666666667 84.9066666666667C58.56 84.5973333333333 56.3146666666667 83.84 54.5173333333333 82.9653333333333C49.584 80.56 45.7013333333333 76.0586666666667 43.8186666666667 70.5706666666667L42.992 68.16L42.992 64L42.992 59.84L43.8186666666667 57.4293333333334C45.024 53.9093333333333 46.3733333333333 51.76 49.0666666666667 49.0666666666667C51.76 46.3733333333333 53.9093333333333 45.024 57.4293333333333 43.8186666666667L59.84 42.992L64 42.992L68.16 42.992L70.5706666666667 43.8186666666667C73.9306666666667 44.9706666666667 76.224 46.384 78.7413333333333 48.8533333333333C82.928 52.96 84.8266666666667 57.1733333333334 85.0613333333333 62.864C85.328 69.3973333333333 83.5893333333333 74.128 79.264 78.6826666666667C76.7253333333333 81.3546666666667 73.008 83.5573333333333 69.44 84.5066666666667C67.536 85.008 62.1813333333333 85.248 60.2986666666667 84.9066666666667M66.256 74.4373333333333C68.048 74.1066666666667 69.856 73.0773333333333 71.4666666666667 71.4666666666667C74.0693333333333 68.864 75.0346666666667 65.936 74.5013333333333 62.2826666666667C74.0213333333333 58.976 71.664 55.8986666666667 68.368 54.272L66.688 53.44L64 53.44L61.312 53.44L59.632 54.272C56.6666666666667 55.7333333333333 54.1653333333333 58.7626666666667 53.568 61.6106666666667C52.784 65.3653333333333 53.7973333333333 68.7306666666667 56.5333333333333 71.4666666666667C59.2693333333333 74.2026666666667 62.3626666666667 75.1466666666667 66.256 74.4373333333333" />
-    <glyph glyph-name="play"
+    <glyph glyph-name="chevron-down"
+      unicode="&#xF11F;"
+      horiz-adv-x="128" d="M29.9573333333333 84.816C28.944 84.3786666666667 27.7066666666667 83.1893333333333 27.28 82.24C26.8106666666667 81.2106666666667 26.752 79.008 27.1733333333333 78.0053333333333C27.8933333333333 76.2826666666667 60.2773333333333 43.8933333333333 62 43.1786666666667C62.9066666666667 42.7946666666667 65.0933333333333 42.7946666666667 66 43.1786666666667C67.7653333333333 43.9146666666667 100.112 76.288 100.848 78.0586666666667C101.3173333333333 79.184 101.248 81.008 100.688 82.2026666666667C99.8026666666667 84.0906666666667 98.08 85.12 95.808 85.12C93.5733333333333 85.12 94.2933333333333 85.76 76 67.5306666666667L64 55.5733333333333L52.32 67.216C36.6453333333333 82.832 34.7786666666667 84.6133333333334 33.7706666666667 84.8906666666667C32.6613333333333 85.2 30.752 85.1626666666667 29.9573333333333 84.816" />
+    <glyph glyph-name="chevron-down-1"
+      unicode="&#x63;&#x68;&#x65;&#x76;&#x72;&#x6F;&#x6E;&#x2D;&#x64;&#x6F;&#x77;&#x6E;"
+      horiz-adv-x="128" d="M29.9573333333333 84.816C28.944 84.3786666666667 27.7066666666667 83.1893333333333 27.28 82.24C26.8106666666667 81.2106666666667 26.752 79.008 27.1733333333333 78.0053333333333C27.8933333333333 76.2826666666667 60.2773333333333 43.8933333333333 62 43.1786666666667C62.9066666666667 42.7946666666667 65.0933333333333 42.7946666666667 66 43.1786666666667C67.7653333333333 43.9146666666667 100.112 76.288 100.848 78.0586666666667C101.3173333333333 79.184 101.248 81.008 100.688 82.2026666666667C99.8026666666667 84.0906666666667 98.08 85.12 95.808 85.12C93.5733333333333 85.12 94.2933333333333 85.76 76 67.5306666666667L64 55.5733333333333L52.32 67.216C36.6453333333333 82.832 34.7786666666667 84.6133333333334 33.7706666666667 84.8906666666667C32.6613333333333 85.2 30.752 85.1626666666667 29.9573333333333 84.816" />
+    <glyph glyph-name="circle-dot"
+      unicode="&#xF120;"
+      horiz-adv-x="128" d="M60.16 122.4373333333333C52.3573333333333 121.952 45.3546666666667 120.064 38.08 116.48C31.904 113.44 27.4186666666667 110.2293333333333 22.5973333333333 105.4026666666667C17.7706666666667 100.5813333333333 14.56 96.096 11.52 89.92C7.824 82.4213333333333 6.0533333333333 75.7013333333333 5.5466666666667 67.2693333333333C4.9333333333333 57.1413333333333 6.928 47.392 11.52 38.08C14.56 31.904 17.7706666666667 27.4186666666667 22.5973333333333 22.5973333333333C27.4133333333333 17.7813333333333 31.888 14.576 38.08 11.5093333333333C46.4693333333333 7.36 54.464 5.5093333333333 64 5.5093333333333C73.536 5.5093333333333 81.5306666666667 7.36 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M62.192 74.4373333333333C60.256 74.144 58.0053333333333 72.9706666666667 56.5173333333333 71.4826666666667C51.424 66.3893333333333 52.896 57.5573333333333 59.3493333333333 54.5066666666667C65.8773333333333 51.4186666666667 73.4613333333333 55.408 74.448 62.4533333333334C75.456 69.6373333333334 69.4293333333333 75.5306666666667 62.192 74.4373333333333" />
+    <glyph glyph-name="circle-dot-1"
+      unicode="&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x64;&#x6F;&#x74;"
+      horiz-adv-x="128" d="M60.16 122.4373333333333C52.3573333333333 121.952 45.3546666666667 120.064 38.08 116.48C31.904 113.44 27.4186666666667 110.2293333333333 22.5973333333333 105.4026666666667C17.7706666666667 100.5813333333333 14.56 96.096 11.52 89.92C7.824 82.4213333333333 6.0533333333333 75.7013333333333 5.5466666666667 67.2693333333333C4.9333333333333 57.1413333333333 6.928 47.392 11.52 38.08C14.56 31.904 17.7706666666667 27.4186666666667 22.5973333333333 22.5973333333333C27.4133333333333 17.7813333333333 31.888 14.576 38.08 11.5093333333333C46.4693333333333 7.36 54.464 5.5093333333333 64 5.5093333333333C73.536 5.5093333333333 81.5306666666667 7.36 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M62.192 74.4373333333333C60.256 74.144 58.0053333333333 72.9706666666667 56.5173333333333 71.4826666666667C51.424 66.3893333333333 52.896 57.5573333333333 59.3493333333333 54.5066666666667C65.8773333333333 51.4186666666667 73.4613333333333 55.408 74.448 62.4533333333334C75.456 69.6373333333334 69.4293333333333 75.5306666666667 62.192 74.4373333333333" />
+    <glyph glyph-name="trash-2"
+      unicode="&#xF121;"
+      horiz-adv-x="128" d="M53.2266666666667 122.4693333333334C50.8373333333333 122.3466666666667 49.9306666666667 122.2026666666667 48.6933333333333 121.7653333333333C44.1813333333333 120.1653333333333 40.032 116.08 38.416 111.648C37.6373333333333 109.52 37.3333333333333 107.3706666666667 37.3333333333333 104.016L37.3333333333333 101.3973333333333L26.0693333333333 101.28C13.712 101.152 14.048 101.1893333333333 12.4853333333333 99.8133333333333C11.376 98.8426666666667 10.8906666666667 97.696 10.8853333333333 96.048C10.88 94.4746666666667 11.2746666666667 93.3973333333333 12.224 92.4053333333333C13.552 91.024 14.24 90.8213333333333 17.9733333333333 90.7093333333333L21.3333333333333 90.608L21.3386666666667 56.88C21.3386666666667 38.3253333333333 21.4293333333333 22.0426666666667 21.536 20.6933333333333C21.936 15.488 24.5226666666667 11.1253333333333 28.9386666666667 8.1866666666667C31.4346666666667 6.528 33.6426666666667 5.7706666666667 36.6933333333333 5.536C39.888 5.2853333333333 88.112 5.2853333333333 91.3066666666667 5.536C96.5973333333333 5.9466666666667 101.0453333333333 8.6346666666667 104.0106666666667 13.216C105.5413333333333 15.5893333333333 106.24 17.744 106.464 20.8C106.5706666666667 22.208 106.656 38.4906666666667 106.6613333333333 56.9866666666667L106.6666666666667 90.608L110.0266666666667 90.7093333333333C113.76 90.8213333333333 114.448 91.024 115.776 92.4053333333333C116.7253333333333 93.3973333333333 117.12 94.4746666666667 117.1146666666667 96.048C117.1093333333333 97.696 116.624 98.8426666666667 115.5146666666667 99.8133333333333C113.952 101.1893333333333 114.288 101.152 101.9306666666667 101.28L90.6666666666667 101.3973333333333L90.6666666666667 104.016C90.6666666666667 105.456 90.5653333333333 107.3813333333333 90.4373333333333 108.2933333333333C89.536 114.7733333333334 84.528 120.3626666666667 78.1066666666667 122.0586666666667C76.6026666666667 122.4586666666667 75.7013333333333 122.496 66.3466666666667 122.56C60.7733333333333 122.5973333333334 54.8693333333333 122.5546666666667 53.2266666666667 122.4693333333334M76.528 111.5146666666667C77.6266666666667 110.9173333333333 78.688 109.888 79.3173333333333 108.8266666666667C79.8613333333333 107.8933333333333 79.8986666666667 107.6693333333333 79.968 104.5866666666667L80.048 101.3333333333333L64 101.3333333333333L47.952 101.3333333333333L48.032 104.5866666666667C48.1013333333333 107.6586666666667 48.1386666666667 107.8933333333333 48.6773333333333 108.8106666666667C49.4666666666667 110.1493333333333 50.9973333333333 111.52 51.872 111.664C53.4346666666667 111.9253333333333 54.4693333333333 111.9413333333333 64.96 111.92C74.9333333333333 111.8933333333333 75.8986666666667 111.8613333333333 76.528 111.5146666666667M95.9573333333333 55.3973333333333L95.8933333333333 20.128L95.2533333333333 19.088C94.896 18.5173333333333 94.112 17.6426666666667 93.5093333333333 17.152C92.4373333333333 16.2826666666667 92.3573333333333 16.2506666666667 90.416 16.112C89.3226666666667 16.0373333333334 76.6666666666667 16.0053333333333 62.2933333333333 16.0373333333334L36.16 16.1066666666667L35.1733333333333 16.6826666666667C34.112 17.312 33.0826666666667 18.3733333333333 32.4853333333333 19.472C32.128 20.1226666666667 32.1013333333333 22.1706666666667 32.0426666666667 55.4133333333333L31.9786666666667 90.6666666666667L63.9946666666667 90.6666666666667L96.016 90.6666666666667L95.9573333333333 55.3973333333333M51.2906666666667 74.1493333333334C50.32 73.728 49.104 72.5866666666667 48.576 71.5946666666667L48.1066666666667 70.72L48.1066666666667 53.3333333333333L48.1066666666667 35.9466666666667L48.5653333333333 35.0933333333333C49.6 33.1786666666667 51.2053333333333 32.2133333333333 53.3333333333333 32.2133333333333C55.4613333333333 32.2133333333333 57.0666666666667 33.1786666666667 58.1013333333333 35.0933333333333L58.56 35.9466666666667L58.56 53.3333333333333L58.56 70.72L58.1013333333333 71.5733333333333C57.5413333333333 72.608 56.7146666666667 73.4026666666667 55.5786666666667 74.0053333333333C54.576 74.5333333333333 52.3413333333333 74.608 51.2906666666667 74.1493333333334M72.624 74.1493333333334C71.6533333333333 73.728 70.4373333333333 72.5866666666667 69.9093333333333 71.5946666666667L69.44 70.72L69.44 53.3333333333333L69.44 35.9466666666667L69.8986666666667 35.0933333333333C70.9333333333333 33.1786666666667 72.5386666666667 32.2133333333333 74.6666666666667 32.2133333333333C76.7946666666667 32.2133333333333 78.4 33.1786666666667 79.4346666666667 35.0933333333333L79.8933333333333 35.9466666666667L79.8933333333333 53.3333333333333L79.8933333333333 70.72L79.4346666666667 71.5733333333333C78.8746666666667 72.608 78.048 73.4026666666667 76.912 74.0053333333333C75.9093333333333 74.5333333333333 73.6746666666667 74.608 72.624 74.1493333333334" />
+    <glyph glyph-name="trash-2-1"
+      unicode="&#x74;&#x72;&#x61;&#x73;&#x68;&#x2D;&#x32;"
+      horiz-adv-x="128" d="M53.2266666666667 122.4693333333334C50.8373333333333 122.3466666666667 49.9306666666667 122.2026666666667 48.6933333333333 121.7653333333333C44.1813333333333 120.1653333333333 40.032 116.08 38.416 111.648C37.6373333333333 109.52 37.3333333333333 107.3706666666667 37.3333333333333 104.016L37.3333333333333 101.3973333333333L26.0693333333333 101.28C13.712 101.152 14.048 101.1893333333333 12.4853333333333 99.8133333333333C11.376 98.8426666666667 10.8906666666667 97.696 10.8853333333333 96.048C10.88 94.4746666666667 11.2746666666667 93.3973333333333 12.224 92.4053333333333C13.552 91.024 14.24 90.8213333333333 17.9733333333333 90.7093333333333L21.3333333333333 90.608L21.3386666666667 56.88C21.3386666666667 38.3253333333333 21.4293333333333 22.0426666666667 21.536 20.6933333333333C21.936 15.488 24.5226666666667 11.1253333333333 28.9386666666667 8.1866666666667C31.4346666666667 6.528 33.6426666666667 5.7706666666667 36.6933333333333 5.536C39.888 5.2853333333333 88.112 5.2853333333333 91.3066666666667 5.536C96.5973333333333 5.9466666666667 101.0453333333333 8.6346666666667 104.0106666666667 13.216C105.5413333333333 15.5893333333333 106.24 17.744 106.464 20.8C106.5706666666667 22.208 106.656 38.4906666666667 106.6613333333333 56.9866666666667L106.6666666666667 90.608L110.0266666666667 90.7093333333333C113.76 90.8213333333333 114.448 91.024 115.776 92.4053333333333C116.7253333333333 93.3973333333333 117.12 94.4746666666667 117.1146666666667 96.048C117.1093333333333 97.696 116.624 98.8426666666667 115.5146666666667 99.8133333333333C113.952 101.1893333333333 114.288 101.152 101.9306666666667 101.28L90.6666666666667 101.3973333333333L90.6666666666667 104.016C90.6666666666667 105.456 90.5653333333333 107.3813333333333 90.4373333333333 108.2933333333333C89.536 114.7733333333334 84.528 120.3626666666667 78.1066666666667 122.0586666666667C76.6026666666667 122.4586666666667 75.7013333333333 122.496 66.3466666666667 122.56C60.7733333333333 122.5973333333334 54.8693333333333 122.5546666666667 53.2266666666667 122.4693333333334M76.528 111.5146666666667C77.6266666666667 110.9173333333333 78.688 109.888 79.3173333333333 108.8266666666667C79.8613333333333 107.8933333333333 79.8986666666667 107.6693333333333 79.968 104.5866666666667L80.048 101.3333333333333L64 101.3333333333333L47.952 101.3333333333333L48.032 104.5866666666667C48.1013333333333 107.6586666666667 48.1386666666667 107.8933333333333 48.6773333333333 108.8106666666667C49.4666666666667 110.1493333333333 50.9973333333333 111.52 51.872 111.664C53.4346666666667 111.9253333333333 54.4693333333333 111.9413333333333 64.96 111.92C74.9333333333333 111.8933333333333 75.8986666666667 111.8613333333333 76.528 111.5146666666667M95.9573333333333 55.3973333333333L95.8933333333333 20.128L95.2533333333333 19.088C94.896 18.5173333333333 94.112 17.6426666666667 93.5093333333333 17.152C92.4373333333333 16.2826666666667 92.3573333333333 16.2506666666667 90.416 16.112C89.3226666666667 16.0373333333334 76.6666666666667 16.0053333333333 62.2933333333333 16.0373333333334L36.16 16.1066666666667L35.1733333333333 16.6826666666667C34.112 17.312 33.0826666666667 18.3733333333333 32.4853333333333 19.472C32.128 20.1226666666667 32.1013333333333 22.1706666666667 32.0426666666667 55.4133333333333L31.9786666666667 90.6666666666667L63.9946666666667 90.6666666666667L96.016 90.6666666666667L95.9573333333333 55.3973333333333M51.2906666666667 74.1493333333334C50.32 73.728 49.104 72.5866666666667 48.576 71.5946666666667L48.1066666666667 70.72L48.1066666666667 53.3333333333333L48.1066666666667 35.9466666666667L48.5653333333333 35.0933333333333C49.6 33.1786666666667 51.2053333333333 32.2133333333333 53.3333333333333 32.2133333333333C55.4613333333333 32.2133333333333 57.0666666666667 33.1786666666667 58.1013333333333 35.0933333333333L58.56 35.9466666666667L58.56 53.3333333333333L58.56 70.72L58.1013333333333 71.5733333333333C57.5413333333333 72.608 56.7146666666667 73.4026666666667 55.5786666666667 74.0053333333333C54.576 74.5333333333333 52.3413333333333 74.608 51.2906666666667 74.1493333333334M72.624 74.1493333333334C71.6533333333333 73.728 70.4373333333333 72.5866666666667 69.9093333333333 71.5946666666667L69.44 70.72L69.44 53.3333333333333L69.44 35.9466666666667L69.8986666666667 35.0933333333333C70.9333333333333 33.1786666666667 72.5386666666667 32.2133333333333 74.6666666666667 32.2133333333333C76.7946666666667 32.2133333333333 78.4 33.1786666666667 79.4346666666667 35.0933333333333L79.8933333333333 35.9466666666667L79.8933333333333 53.3333333333333L79.8933333333333 70.72L79.4346666666667 71.5733333333333C78.8746666666667 72.608 78.048 73.4026666666667 76.912 74.0053333333333C75.9093333333333 74.5333333333333 73.6746666666667 74.608 72.624 74.1493333333334" />
+    <glyph glyph-name="mic"
       unicode="&#xF122;"
-      horiz-adv-x="128" d="M29.9573333333333 116.816C28.9226666666667 116.368 27.7493333333333 115.2213333333333 27.184 114.1066666666667L26.6666666666667 113.0826666666667L26.6666666666667 64L26.6666666666667 14.9173333333333L27.1893333333333 13.8826666666667C27.792 12.6933333333333 29.168 11.4293333333333 30.2346666666667 11.0773333333333C30.64 10.944 31.6213333333333 10.8693333333333 32.416 10.9173333333333C34.08 11.008 32.4053333333333 10.0373333333334 47.5733333333333 19.7386666666667C73.5786666666667 36.384 109.7706666666667 59.7973333333333 110.48 60.4426666666667C111.3173333333333 61.2053333333333 111.776 62.464 111.776 64C111.776 65.536 111.3173333333333 66.8 110.48 67.5466666666667C109.936 68.0373333333333 107.088 69.8933333333334 88.5333333333333 81.8826666666667C55.0453333333333 103.5146666666667 34.5653333333333 116.624 33.7866666666667 116.9173333333333C33.0133333333333 117.2106666666667 30.72 117.152 29.9573333333333 116.816M40.1706666666667 100.4533333333333C59.7493333333333 87.9893333333333 96.2773333333333 64.336 96.3733333333333 64.0586666666667C96.4106666666667 63.9466666666667 95.744 63.3973333333333 94.896 62.832C89.1093333333333 58.9866666666667 38.3626666666667 26.2933333333333 37.8986666666667 26.1173333333333C37.4293333333333 25.936 37.3333333333333 32.3626666666667 37.3333333333333 64C37.3333333333333 90.1493333333333 37.4453333333333 101.9733333333333 37.696 101.9733333333333C37.7386666666667 101.9733333333333 38.8533333333333 101.2906666666667 40.1706666666667 100.4533333333333" />
-    <glyph glyph-name="play-1"
-      unicode="&#x70;&#x6C;&#x61;&#x79;"
-      horiz-adv-x="128" d="M29.9573333333333 116.816C28.9226666666667 116.368 27.7493333333333 115.2213333333333 27.184 114.1066666666667L26.6666666666667 113.0826666666667L26.6666666666667 64L26.6666666666667 14.9173333333333L27.1893333333333 13.8826666666667C27.792 12.6933333333333 29.168 11.4293333333333 30.2346666666667 11.0773333333333C30.64 10.944 31.6213333333333 10.8693333333333 32.416 10.9173333333333C34.08 11.008 32.4053333333333 10.0373333333334 47.5733333333333 19.7386666666667C73.5786666666667 36.384 109.7706666666667 59.7973333333333 110.48 60.4426666666667C111.3173333333333 61.2053333333333 111.776 62.464 111.776 64C111.776 65.536 111.3173333333333 66.8 110.48 67.5466666666667C109.936 68.0373333333333 107.088 69.8933333333334 88.5333333333333 81.8826666666667C55.0453333333333 103.5146666666667 34.5653333333333 116.624 33.7866666666667 116.9173333333333C33.0133333333333 117.2106666666667 30.72 117.152 29.9573333333333 116.816M40.1706666666667 100.4533333333333C59.7493333333333 87.9893333333333 96.2773333333333 64.336 96.3733333333333 64.0586666666667C96.4106666666667 63.9466666666667 95.744 63.3973333333333 94.896 62.832C89.1093333333333 58.9866666666667 38.3626666666667 26.2933333333333 37.8986666666667 26.1173333333333C37.4293333333333 25.936 37.3333333333333 32.3626666666667 37.3333333333333 64C37.3333333333333 90.1493333333333 37.4453333333333 101.9733333333333 37.696 101.9733333333333C37.7386666666667 101.9733333333333 38.8533333333333 101.2906666666667 40.1706666666667 100.4533333333333" />
-    <glyph glyph-name="rocket"
+      horiz-adv-x="128" d="M61.7546666666667 122.4426666666667C52.592 121.5466666666667 45.1466666666667 114.7733333333334 43.152 105.5306666666667C42.8053333333333 103.9306666666667 42.7733333333333 102.0426666666667 42.7733333333333 82.6666666666667C42.7733333333333 63.2906666666667 42.8053333333333 61.4026666666667 43.152 59.8026666666667C44.976 51.3333333333333 51.3386666666667 44.944 59.6853333333333 43.1893333333333C61.8666666666667 42.7306666666667 66.1333333333333 42.7306666666667 68.3146666666667 43.1893333333333C75.6906666666667 44.7413333333333 81.68 50.0373333333333 84.1173333333333 57.1733333333334C85.2373333333333 60.4426666666667 85.2266666666667 60.2293333333333 85.2266666666667 82.6666666666667C85.2266666666667 99.0506666666667 85.168 103.8986666666667 84.944 105.0666666666667C83.5093333333333 112.72 78.128 118.96 70.8266666666667 121.4506666666667C68.08 122.384 64.8053333333333 122.7466666666667 61.7546666666667 122.4426666666667M66.5386666666667 111.776C70.08 110.9546666666667 73.6213333333333 107.4133333333333 74.4426666666667 103.872C74.736 102.592 74.736 62.7413333333333 74.4426666666667 61.4613333333333C73.6213333333333 57.92 70.08 54.3786666666667 66.5386666666667 53.5573333333333C65.3333333333333 53.28 62.6666666666667 53.28 61.4613333333333 53.5573333333333C57.92 54.3786666666667 54.3786666666667 57.92 53.5573333333333 61.4613333333333C53.264 62.7413333333333 53.264 102.592 53.5573333333333 103.872C54.3626666666667 107.36 57.92 110.9546666666667 61.376 111.7653333333333C62.496 112.032 65.408 112.032 66.5386666666667 111.776M25.6 79.8026666666667C24.0373333333333 79.4826666666667 22.7253333333333 78.4586666666667 21.8986666666667 76.912C21.472 76.1066666666667 21.44 75.6853333333334 21.3706666666667 70.4053333333334C21.216 58.5226666666667 22.2773333333333 52.3573333333333 25.696 45.3706666666667C31.616 33.264 42.8586666666667 24.6666666666667 56.0373333333333 22.16L58.6346666666667 21.6693333333333L58.704 15.472C58.768 9.616 58.8 9.232 59.232 8.4213333333333C60.2773333333333 6.4693333333333 61.8773333333333 5.4826666666667 64 5.4826666666667C66.1226666666667 5.4826666666667 67.7226666666667 6.4693333333333 68.768 8.4213333333333C69.2 9.232 69.232 9.616 69.296 15.472L69.3653333333333 21.6693333333333L71.9626666666667 22.16C86.9173333333333 24.992 99.424 35.8613333333333 104.304 50.2666666666667C106.192 55.84 106.7626666666667 60.7946666666667 106.6293333333333 70.544C106.56 75.68 106.5226666666667 76.112 106.1013333333333 76.912C105.0613333333333 78.8586666666667 103.456 79.8506666666667 101.3333333333333 79.8506666666667C99.2106666666667 79.8506666666667 97.6053333333333 78.8586666666667 96.5706666666667 76.912C96.1333333333333 76.0906666666667 96.1066666666667 75.6746666666667 95.9733333333333 67.84C95.8933333333333 63.3226666666667 95.7333333333333 59.1466666666667 95.616 58.56C94.2133333333333 51.584 91.3546666666667 46.128 86.6133333333333 41.3866666666667C80.4746666666667 35.248 72.6613333333333 32.0053333333333 64 32.0053333333333C55.3386666666667 32.0053333333333 47.5253333333333 35.248 41.3866666666667 41.3866666666667C36.6453333333333 46.128 33.7866666666667 51.584 32.384 58.56C32.2666666666667 59.1466666666667 32.1066666666667 63.3226666666667 32.0266666666667 67.84C31.8933333333333 75.6746666666667 31.8666666666667 76.0906666666667 31.4293333333333 76.912C30.256 79.1146666666667 27.9146666666667 80.2773333333333 25.6 79.8026666666667" />
+    <glyph glyph-name="mic-1"
+      unicode="&#x6D;&#x69;&#x63;"
+      horiz-adv-x="128" d="M61.7546666666667 122.4426666666667C52.592 121.5466666666667 45.1466666666667 114.7733333333334 43.152 105.5306666666667C42.8053333333333 103.9306666666667 42.7733333333333 102.0426666666667 42.7733333333333 82.6666666666667C42.7733333333333 63.2906666666667 42.8053333333333 61.4026666666667 43.152 59.8026666666667C44.976 51.3333333333333 51.3386666666667 44.944 59.6853333333333 43.1893333333333C61.8666666666667 42.7306666666667 66.1333333333333 42.7306666666667 68.3146666666667 43.1893333333333C75.6906666666667 44.7413333333333 81.68 50.0373333333333 84.1173333333333 57.1733333333334C85.2373333333333 60.4426666666667 85.2266666666667 60.2293333333333 85.2266666666667 82.6666666666667C85.2266666666667 99.0506666666667 85.168 103.8986666666667 84.944 105.0666666666667C83.5093333333333 112.72 78.128 118.96 70.8266666666667 121.4506666666667C68.08 122.384 64.8053333333333 122.7466666666667 61.7546666666667 122.4426666666667M66.5386666666667 111.776C70.08 110.9546666666667 73.6213333333333 107.4133333333333 74.4426666666667 103.872C74.736 102.592 74.736 62.7413333333333 74.4426666666667 61.4613333333333C73.6213333333333 57.92 70.08 54.3786666666667 66.5386666666667 53.5573333333333C65.3333333333333 53.28 62.6666666666667 53.28 61.4613333333333 53.5573333333333C57.92 54.3786666666667 54.3786666666667 57.92 53.5573333333333 61.4613333333333C53.264 62.7413333333333 53.264 102.592 53.5573333333333 103.872C54.3626666666667 107.36 57.92 110.9546666666667 61.376 111.7653333333333C62.496 112.032 65.408 112.032 66.5386666666667 111.776M25.6 79.8026666666667C24.0373333333333 79.4826666666667 22.7253333333333 78.4586666666667 21.8986666666667 76.912C21.472 76.1066666666667 21.44 75.6853333333334 21.3706666666667 70.4053333333334C21.216 58.5226666666667 22.2773333333333 52.3573333333333 25.696 45.3706666666667C31.616 33.264 42.8586666666667 24.6666666666667 56.0373333333333 22.16L58.6346666666667 21.6693333333333L58.704 15.472C58.768 9.616 58.8 9.232 59.232 8.4213333333333C60.2773333333333 6.4693333333333 61.8773333333333 5.4826666666667 64 5.4826666666667C66.1226666666667 5.4826666666667 67.7226666666667 6.4693333333333 68.768 8.4213333333333C69.2 9.232 69.232 9.616 69.296 15.472L69.3653333333333 21.6693333333333L71.9626666666667 22.16C86.9173333333333 24.992 99.424 35.8613333333333 104.304 50.2666666666667C106.192 55.84 106.7626666666667 60.7946666666667 106.6293333333333 70.544C106.56 75.68 106.5226666666667 76.112 106.1013333333333 76.912C105.0613333333333 78.8586666666667 103.456 79.8506666666667 101.3333333333333 79.8506666666667C99.2106666666667 79.8506666666667 97.6053333333333 78.8586666666667 96.5706666666667 76.912C96.1333333333333 76.0906666666667 96.1066666666667 75.6746666666667 95.9733333333333 67.84C95.8933333333333 63.3226666666667 95.7333333333333 59.1466666666667 95.616 58.56C94.2133333333333 51.584 91.3546666666667 46.128 86.6133333333333 41.3866666666667C80.4746666666667 35.248 72.6613333333333 32.0053333333333 64 32.0053333333333C55.3386666666667 32.0053333333333 47.5253333333333 35.248 41.3866666666667 41.3866666666667C36.6453333333333 46.128 33.7866666666667 51.584 32.384 58.56C32.2666666666667 59.1466666666667 32.1066666666667 63.3226666666667 32.0266666666667 67.84C31.8933333333333 75.6746666666667 31.8666666666667 76.0906666666667 31.4293333333333 76.912C30.256 79.1146666666667 27.9146666666667 80.2773333333333 25.6 79.8026666666667" />
+    <glyph glyph-name="circle-stop-locked"
       unicode="&#xF123;"
+      horiz-adv-x="128" d="M62.4 109.4293333333333C50.9226666666667 108.6506666666667 39.7066666666667 103.3653333333333 31.808 95.024C25.024 87.856 20.832 79.216 19.2906666666667 69.2266666666667C18.7946666666667 66.0106666666667 18.7946666666667 59.2 19.2906666666667 56.032C20.8533333333333 46.0266666666667 25.0506666666667 37.4293333333333 31.7866666666667 30.4213333333333C39.6586666666667 22.2346666666667 49.312 17.392 60.3306666666667 16.1013333333333C64.3733333333333 15.632 66.4693333333333 15.68 67.632 16.2666666666667C70.1013333333333 17.5146666666667 70.6933333333333 20.656 68.8533333333333 22.7466666666667C67.8026666666667 23.9466666666667 67.248 24.1173333333333 63.8186666666667 24.3253333333333C62.1013333333333 24.432 59.648 24.7146666666667 58.3733333333333 24.9653333333333C42.6826666666667 28 30.2293333333333 40.912 27.824 56.64C25.9413333333333 68.9386666666667 29.808 80.9386666666667 38.464 89.648C47.8933333333333 99.136 61.1573333333333 103.0293333333333 74.224 100.128C79.9253333333333 98.864 85.296 96.2346666666667 90.1333333333333 92.3466666666667C93.9786666666667 89.2533333333333 98.0213333333333 84.1386666666667 100.1973333333333 79.616C100.7466666666667 78.48 101.3813333333333 77.2693333333333 101.616 76.9333333333333C102.128 76.1866666666667 103.9466666666667 75.312 104.96 75.312C106.6666666666667 75.3173333333333 108.56 76.8213333333333 109.024 78.5386666666667C109.3386666666667 79.7066666666667 109.072 80.736 107.776 83.3813333333334C105.5466666666667 87.9306666666667 103.184 91.3173333333333 99.7333333333333 94.912C92.576 102.3626666666667 83.5733333333333 107.1946666666667 73.664 108.896C71.9573333333333 109.1946666666667 65.9626666666667 109.6906666666667 65.0666666666667 109.616C64.8906666666667 109.6053333333333 63.6906666666667 109.52 62.4 109.4293333333333M51.776 79.488C50.688 79.1893333333333 49.68 78.3786666666667 49.0986666666667 77.3333333333333C48.7786666666667 76.7573333333333 48.7466666666667 75.344 48.7466666666667 62.72L48.7466666666667 48.7466666666667L49.264 47.8453333333333C49.5466666666667 47.344 50.1653333333333 46.672 50.6346666666667 46.352L51.4826666666667 45.76L65.4773333333333 45.7013333333333L79.4666666666667 45.6426666666667L80.4213333333333 46.128C80.9866666666667 46.416 81.648 46.992 82.0213333333333 47.536L82.6666666666667 48.464L82.7306666666667 62.1493333333334C82.7733333333333 71.6266666666667 82.7253333333333 76.0853333333333 82.56 76.6453333333333C82.288 77.5893333333333 81.2746666666667 78.8053333333333 80.3413333333333 79.3173333333333C79.744 79.648 78.432 79.6853333333334 66.24 79.7226666666667C55.7066666666667 79.76 52.576 79.7066666666667 51.776 79.488M74.24 62.72L74.24 54.1866666666667L65.7066666666667 54.1866666666667L57.1733333333333 54.1866666666667L57.1733333333333 62.72L57.1733333333333 71.2533333333333L65.7066666666667 71.2533333333333L74.24 71.2533333333333L74.24 62.72M100.5866666666667 61.4346666666667C96.7466666666667 60.9226666666667 93.104 58.3733333333333 91.136 54.8266666666667C90.0693333333333 52.9066666666667 89.7546666666667 51.4346666666667 89.616 47.7866666666667L89.4933333333333 44.48L88.2453333333333 44.3253333333333C84.912 43.9093333333333 81.9306666666667 41.024 81.2853333333333 37.5733333333334C80.992 36.016 81.0026666666667 23.248 81.3013333333333 21.648C81.7173333333333 19.3813333333333 83.0026666666667 17.4506666666667 84.9546666666667 16.1546666666667C87.1573333333333 14.6933333333333 86.832 14.72 102.4 14.72C117.968 14.72 117.6426666666667 14.6933333333333 119.8453333333333 16.1546666666667C121.7973333333333 17.4506666666667 123.0826666666667 19.3813333333333 123.4986666666667 21.648C123.7973333333333 23.248 123.808 36.016 123.5146666666667 37.5733333333334C122.8693333333333 41.0026666666667 119.872 43.9146666666667 116.5546666666667 44.3253333333333L115.3066666666667 44.48L115.184 47.7866666666667C115.0453333333333 51.4346666666667 114.7306666666667 52.9066666666667 113.664 54.8266666666667C111.0666666666667 59.5146666666667 105.8666666666667 62.144 100.5866666666667 61.4346666666667M104.672 52.3946666666667C105.1253333333333 52.0906666666667 105.7333333333333 51.4933333333333 106.0266666666667 51.0613333333333C106.5173333333333 50.336 106.5653333333333 50.048 106.6293333333333 47.4293333333333L106.6986666666667 44.5866666666667L102.4 44.5866666666667L98.1013333333333 44.5866666666667L98.1706666666667 47.4346666666667C98.2346666666667 50.128 98.272 50.3253333333333 98.8213333333333 51.1146666666667C99.376 51.9146666666667 100.304 52.624 101.2266666666667 52.9493333333333C102.0586666666667 53.248 103.8186666666667 52.96 104.672 52.3946666666667M115.2 29.6533333333333L115.2 23.2533333333333L102.4 23.2533333333333L89.6 23.2533333333333L89.6 29.6533333333333L89.6 36.0533333333333L102.4 36.0533333333333L115.2 36.0533333333333L115.2 29.6533333333333" />
+    <glyph glyph-name="circle-stop-locked-1"
+      unicode="&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x73;&#x74;&#x6F;&#x70;&#x2D;&#x6C;&#x6F;&#x63;&#x6B;&#x65;&#x64;"
+      horiz-adv-x="128" d="M62.4 109.4293333333333C50.9226666666667 108.6506666666667 39.7066666666667 103.3653333333333 31.808 95.024C25.024 87.856 20.832 79.216 19.2906666666667 69.2266666666667C18.7946666666667 66.0106666666667 18.7946666666667 59.2 19.2906666666667 56.032C20.8533333333333 46.0266666666667 25.0506666666667 37.4293333333333 31.7866666666667 30.4213333333333C39.6586666666667 22.2346666666667 49.312 17.392 60.3306666666667 16.1013333333333C64.3733333333333 15.632 66.4693333333333 15.68 67.632 16.2666666666667C70.1013333333333 17.5146666666667 70.6933333333333 20.656 68.8533333333333 22.7466666666667C67.8026666666667 23.9466666666667 67.248 24.1173333333333 63.8186666666667 24.3253333333333C62.1013333333333 24.432 59.648 24.7146666666667 58.3733333333333 24.9653333333333C42.6826666666667 28 30.2293333333333 40.912 27.824 56.64C25.9413333333333 68.9386666666667 29.808 80.9386666666667 38.464 89.648C47.8933333333333 99.136 61.1573333333333 103.0293333333333 74.224 100.128C79.9253333333333 98.864 85.296 96.2346666666667 90.1333333333333 92.3466666666667C93.9786666666667 89.2533333333333 98.0213333333333 84.1386666666667 100.1973333333333 79.616C100.7466666666667 78.48 101.3813333333333 77.2693333333333 101.616 76.9333333333333C102.128 76.1866666666667 103.9466666666667 75.312 104.96 75.312C106.6666666666667 75.3173333333333 108.56 76.8213333333333 109.024 78.5386666666667C109.3386666666667 79.7066666666667 109.072 80.736 107.776 83.3813333333334C105.5466666666667 87.9306666666667 103.184 91.3173333333333 99.7333333333333 94.912C92.576 102.3626666666667 83.5733333333333 107.1946666666667 73.664 108.896C71.9573333333333 109.1946666666667 65.9626666666667 109.6906666666667 65.0666666666667 109.616C64.8906666666667 109.6053333333333 63.6906666666667 109.52 62.4 109.4293333333333M51.776 79.488C50.688 79.1893333333333 49.68 78.3786666666667 49.0986666666667 77.3333333333333C48.7786666666667 76.7573333333333 48.7466666666667 75.344 48.7466666666667 62.72L48.7466666666667 48.7466666666667L49.264 47.8453333333333C49.5466666666667 47.344 50.1653333333333 46.672 50.6346666666667 46.352L51.4826666666667 45.76L65.4773333333333 45.7013333333333L79.4666666666667 45.6426666666667L80.4213333333333 46.128C80.9866666666667 46.416 81.648 46.992 82.0213333333333 47.536L82.6666666666667 48.464L82.7306666666667 62.1493333333334C82.7733333333333 71.6266666666667 82.7253333333333 76.0853333333333 82.56 76.6453333333333C82.288 77.5893333333333 81.2746666666667 78.8053333333333 80.3413333333333 79.3173333333333C79.744 79.648 78.432 79.6853333333334 66.24 79.7226666666667C55.7066666666667 79.76 52.576 79.7066666666667 51.776 79.488M74.24 62.72L74.24 54.1866666666667L65.7066666666667 54.1866666666667L57.1733333333333 54.1866666666667L57.1733333333333 62.72L57.1733333333333 71.2533333333333L65.7066666666667 71.2533333333333L74.24 71.2533333333333L74.24 62.72M100.5866666666667 61.4346666666667C96.7466666666667 60.9226666666667 93.104 58.3733333333333 91.136 54.8266666666667C90.0693333333333 52.9066666666667 89.7546666666667 51.4346666666667 89.616 47.7866666666667L89.4933333333333 44.48L88.2453333333333 44.3253333333333C84.912 43.9093333333333 81.9306666666667 41.024 81.2853333333333 37.5733333333334C80.992 36.016 81.0026666666667 23.248 81.3013333333333 21.648C81.7173333333333 19.3813333333333 83.0026666666667 17.4506666666667 84.9546666666667 16.1546666666667C87.1573333333333 14.6933333333333 86.832 14.72 102.4 14.72C117.968 14.72 117.6426666666667 14.6933333333333 119.8453333333333 16.1546666666667C121.7973333333333 17.4506666666667 123.0826666666667 19.3813333333333 123.4986666666667 21.648C123.7973333333333 23.248 123.808 36.016 123.5146666666667 37.5733333333334C122.8693333333333 41.0026666666667 119.872 43.9146666666667 116.5546666666667 44.3253333333333L115.3066666666667 44.48L115.184 47.7866666666667C115.0453333333333 51.4346666666667 114.7306666666667 52.9066666666667 113.664 54.8266666666667C111.0666666666667 59.5146666666667 105.8666666666667 62.144 100.5866666666667 61.4346666666667M104.672 52.3946666666667C105.1253333333333 52.0906666666667 105.7333333333333 51.4933333333333 106.0266666666667 51.0613333333333C106.5173333333333 50.336 106.5653333333333 50.048 106.6293333333333 47.4293333333333L106.6986666666667 44.5866666666667L102.4 44.5866666666667L98.1013333333333 44.5866666666667L98.1706666666667 47.4346666666667C98.2346666666667 50.128 98.272 50.3253333333333 98.8213333333333 51.1146666666667C99.376 51.9146666666667 100.304 52.624 101.2266666666667 52.9493333333333C102.0586666666667 53.248 103.8186666666667 52.96 104.672 52.3946666666667M115.2 29.6533333333333L115.2 23.2533333333333L102.4 23.2533333333333L89.6 23.2533333333333L89.6 29.6533333333333L89.6 36.0533333333333L102.4 36.0533333333333L115.2 36.0533333333333L115.2 29.6533333333333" />
+    <glyph glyph-name="shield"
+      unicode="&#xF124;"
+      horiz-adv-x="128" d="M63.04 122.528C59.856 122.16 58.544 121.52 54.8266666666667 118.4853333333333C47.344 112.3733333333333 37.1893333333333 107.6586666666667 29.8773333333333 106.8906666666667C28.7573333333333 106.7733333333333 26.8906666666667 106.5813333333333 25.7386666666667 106.4693333333333C24.0373333333333 106.304 23.328 106.1226666666667 22.0426666666667 105.5093333333333C18.9493333333333 104.0426666666667 16.7093333333333 100.992 16.224 97.6C15.936 95.616 15.936 59.616 16.2186666666667 55.1786666666667C16.4853333333333 51.0026666666667 16.8746666666667 48.4853333333333 17.808 44.9066666666667C21.5786666666667 30.4693333333333 31.44 19.456 47.8933333333333 11.312C51.9946666666667 9.28 57.5573333333333 6.96 60.6933333333333 5.968C63.008 5.2373333333333 65.4826666666667 5.296 67.9946666666667 6.1493333333333C72.944 7.824 79.216 10.6133333333333 83.8133333333333 13.1786666666667C97.9946666666667 21.104 106.7146666666667 31.5893333333333 110.192 44.9066666666667C111.136 48.528 111.5306666666667 51.0773333333333 111.7866666666667 55.3066666666667C112.064 59.904 112.0586666666667 95.6373333333334 111.776 97.6C111.472 99.7546666666667 110.3786666666667 101.9253333333333 108.816 103.4826666666667C106.6773333333333 105.6266666666667 103.888 106.6506666666667 100.16 106.6613333333333C98.6933333333333 106.6666666666667 96.0266666666667 107.104 93.5573333333333 107.744C87.1946666666667 109.3973333333333 79.0613333333333 113.68 73.1733333333333 118.4853333333333C70.848 120.3786666666667 70.2026666666667 120.8373333333333 69.0133333333333 121.4346666666667C67.4453333333333 122.2186666666667 64.7093333333333 122.72 63.04 122.528M66.736 110.08C75.4986666666667 103.056 86.48 97.9253333333333 95.7493333333333 96.528C96.8853333333333 96.3573333333333 98.304 96.2133333333333 98.9066666666667 96.2133333333333C99.5093333333333 96.2133333333333 100.2986666666667 96.1546666666667 100.6666666666667 96.08L101.3333333333333 95.9466666666667L101.3333333333333 75.6373333333334C101.3333333333333 54.0853333333333 101.296 53.12 100.288 48.8533333333333C96.88 34.4266666666667 86.0906666666667 24.1866666666667 66.5653333333333 16.8533333333333L64.1226666666667 15.9306666666667L63.0453333333333 16.3093333333333C56.5333333333333 18.592 50.144 21.6746666666667 45.3333333333333 24.848C34.4693333333333 32.0213333333333 28.5493333333333 41.0986666666667 26.976 52.9973333333333C26.7253333333333 54.896 26.6666666666667 59.1413333333333 26.6666666666667 75.6373333333334L26.6666666666667 95.9466666666667L27.3333333333333 96.08C27.7013333333333 96.1546666666667 28.4906666666667 96.2133333333333 29.0933333333333 96.2133333333333C29.696 96.2133333333333 31.1146666666667 96.3573333333333 32.2506666666667 96.528C41.504 97.92 52.5333333333333 103.0826666666667 61.312 110.1173333333333C62.6026666666667 111.152 63.8133333333333 112 64 112C64.1866666666667 112 65.4186666666667 111.136 66.736 110.08" />
+    <glyph glyph-name="shield-1"
+      unicode="&#x73;&#x68;&#x69;&#x65;&#x6C;&#x64;"
+      horiz-adv-x="128" d="M63.04 122.528C59.856 122.16 58.544 121.52 54.8266666666667 118.4853333333333C47.344 112.3733333333333 37.1893333333333 107.6586666666667 29.8773333333333 106.8906666666667C28.7573333333333 106.7733333333333 26.8906666666667 106.5813333333333 25.7386666666667 106.4693333333333C24.0373333333333 106.304 23.328 106.1226666666667 22.0426666666667 105.5093333333333C18.9493333333333 104.0426666666667 16.7093333333333 100.992 16.224 97.6C15.936 95.616 15.936 59.616 16.2186666666667 55.1786666666667C16.4853333333333 51.0026666666667 16.8746666666667 48.4853333333333 17.808 44.9066666666667C21.5786666666667 30.4693333333333 31.44 19.456 47.8933333333333 11.312C51.9946666666667 9.28 57.5573333333333 6.96 60.6933333333333 5.968C63.008 5.2373333333333 65.4826666666667 5.296 67.9946666666667 6.1493333333333C72.944 7.824 79.216 10.6133333333333 83.8133333333333 13.1786666666667C97.9946666666667 21.104 106.7146666666667 31.5893333333333 110.192 44.9066666666667C111.136 48.528 111.5306666666667 51.0773333333333 111.7866666666667 55.3066666666667C112.064 59.904 112.0586666666667 95.6373333333334 111.776 97.6C111.472 99.7546666666667 110.3786666666667 101.9253333333333 108.816 103.4826666666667C106.6773333333333 105.6266666666667 103.888 106.6506666666667 100.16 106.6613333333333C98.6933333333333 106.6666666666667 96.0266666666667 107.104 93.5573333333333 107.744C87.1946666666667 109.3973333333333 79.0613333333333 113.68 73.1733333333333 118.4853333333333C70.848 120.3786666666667 70.2026666666667 120.8373333333333 69.0133333333333 121.4346666666667C67.4453333333333 122.2186666666667 64.7093333333333 122.72 63.04 122.528M66.736 110.08C75.4986666666667 103.056 86.48 97.9253333333333 95.7493333333333 96.528C96.8853333333333 96.3573333333333 98.304 96.2133333333333 98.9066666666667 96.2133333333333C99.5093333333333 96.2133333333333 100.2986666666667 96.1546666666667 100.6666666666667 96.08L101.3333333333333 95.9466666666667L101.3333333333333 75.6373333333334C101.3333333333333 54.0853333333333 101.296 53.12 100.288 48.8533333333333C96.88 34.4266666666667 86.0906666666667 24.1866666666667 66.5653333333333 16.8533333333333L64.1226666666667 15.9306666666667L63.0453333333333 16.3093333333333C56.5333333333333 18.592 50.144 21.6746666666667 45.3333333333333 24.848C34.4693333333333 32.0213333333333 28.5493333333333 41.0986666666667 26.976 52.9973333333333C26.7253333333333 54.896 26.6666666666667 59.1413333333333 26.6666666666667 75.6373333333334L26.6666666666667 95.9466666666667L27.3333333333333 96.08C27.7013333333333 96.1546666666667 28.4906666666667 96.2133333333333 29.0933333333333 96.2133333333333C29.696 96.2133333333333 31.1146666666667 96.3573333333333 32.2506666666667 96.528C41.504 97.92 52.5333333333333 103.0826666666667 61.312 110.1173333333333C62.6026666666667 111.152 63.8133333333333 112 64 112C64.1866666666667 112 65.4186666666667 111.136 66.736 110.08" />
+    <glyph glyph-name="user"
+      unicode="&#xF125;"
+      horiz-adv-x="128" d="M59.84 116.8853333333333C54.9706666666667 116.1813333333333 49.2213333333333 113.3066666666667 45.5466666666667 109.7333333333333C38.7626666666667 103.136 36.0053333333333 93.7226666666667 38.176 84.5866666666667C40.6186666666667 74.2986666666667 49.088 66.2933333333333 59.3866666666667 64.5386666666667C61.8133333333333 64.1226666666667 66.1866666666667 64.1226666666667 68.6133333333333 64.5386666666667C79.5413333333333 66.4 88.2133333333333 75.0933333333333 90.1333333333333 86.1226666666667C90.544 88.464 90.544 92.8693333333334 90.1333333333333 95.2106666666667C88.2133333333333 106.2346666666667 79.3973333333333 115.0186666666667 68.4746666666667 116.7893333333333C66.3093333333333 117.1413333333333 61.9573333333333 117.1893333333333 59.84 116.8853333333333M67.9466666666667 106.2186666666667C69.5306666666667 105.9146666666667 72.672 104.2933333333333 74.1866666666667 103.0026666666667C76.624 100.928 78.6133333333333 97.9573333333333 79.4453333333333 95.1626666666667C79.9253333333333 93.5306666666667 79.9253333333333 87.8026666666667 79.4453333333333 86.1706666666667C78.256 82.1813333333333 75.0453333333333 78.3466666666667 71.264 76.4C68.4213333333333 74.9386666666667 67.7226666666667 74.7893333333333 63.8933333333333 74.8053333333333C60.5866666666667 74.816 60.4213333333333 74.8373333333333 58.624 75.504C55.7226666666667 76.5813333333333 52.5173333333333 79.0666666666667 50.784 81.584C49.856 82.9333333333333 48.9386666666667 84.9546666666667 48.5013333333333 86.6133333333334C48.0106666666667 88.496 48.0053333333333 92.8 48.5013333333333 94.8C49.6266666666667 99.392 54.2186666666667 104.384 58.6186666666667 105.7973333333333C61.1573333333333 106.6133333333334 65.008 106.7893333333333 67.9466666666667 106.2186666666667M48.2133333333333 53.1306666666667C42.6026666666667 52.9333333333333 40.1226666666667 52.3733333333333 36.16 50.3946666666667C33.856 49.248 32.832 48.5706666666667 30.72 46.8C27.0613333333333 43.7333333333333 24.176 39.3493333333333 22.6613333333333 34.56C21.5893333333333 31.1786666666667 21.4773333333333 29.9786666666667 21.456 21.9733333333333C21.44 14.816 21.4506666666667 14.592 21.8986666666667 13.76C22.9333333333333 11.8453333333333 24.5386666666667 10.88 26.6666666666667 10.88C28.8053333333333 10.88 30.432 11.8666666666667 31.4133333333333 13.76C31.824 14.56 31.8666666666667 15.1253333333333 32.0213333333333 22.4C32.1653333333333 29.2693333333333 32.2346666666667 30.3253333333333 32.5973333333333 31.3653333333333C34.336 36.336 37.808 39.9253333333333 42.704 41.8133333333333L44.3573333333333 42.4533333333334L63.9893333333333 42.4533333333334L83.616 42.4533333333334L84.9706666666667 41.9466666666667C90.0693333333333 40.0266666666667 93.6533333333333 36.384 95.4026666666667 31.36C95.76 30.3306666666667 95.8293333333333 29.2373333333333 95.9786666666667 22.4C96.1333333333333 15.1306666666667 96.176 14.5546666666667 96.5866666666667 13.76C97.568 11.8666666666667 99.1946666666667 10.88 101.3333333333333 10.88C103.4613333333333 10.88 105.0666666666667 11.8453333333333 106.1013333333333 13.76C106.5493333333333 14.592 106.56 14.8053333333333 106.5333333333333 22.08C106.5066666666667 30.1013333333333 106.432 30.9386666666667 105.3546666666667 34.4533333333334C102.4426666666667 44 94.304 51.1306666666667 84.4106666666667 52.816C82.7946666666667 53.0933333333333 79.8346666666667 53.1626666666667 67.52 53.216C59.3066666666667 53.2533333333333 50.6186666666667 53.216 48.2133333333333 53.1306666666667" />
+    <glyph glyph-name="user-1"
+      unicode="&#x75;&#x73;&#x65;&#x72;"
+      horiz-adv-x="128" d="M59.84 116.8853333333333C54.9706666666667 116.1813333333333 49.2213333333333 113.3066666666667 45.5466666666667 109.7333333333333C38.7626666666667 103.136 36.0053333333333 93.7226666666667 38.176 84.5866666666667C40.6186666666667 74.2986666666667 49.088 66.2933333333333 59.3866666666667 64.5386666666667C61.8133333333333 64.1226666666667 66.1866666666667 64.1226666666667 68.6133333333333 64.5386666666667C79.5413333333333 66.4 88.2133333333333 75.0933333333333 90.1333333333333 86.1226666666667C90.544 88.464 90.544 92.8693333333334 90.1333333333333 95.2106666666667C88.2133333333333 106.2346666666667 79.3973333333333 115.0186666666667 68.4746666666667 116.7893333333333C66.3093333333333 117.1413333333333 61.9573333333333 117.1893333333333 59.84 116.8853333333333M67.9466666666667 106.2186666666667C69.5306666666667 105.9146666666667 72.672 104.2933333333333 74.1866666666667 103.0026666666667C76.624 100.928 78.6133333333333 97.9573333333333 79.4453333333333 95.1626666666667C79.9253333333333 93.5306666666667 79.9253333333333 87.8026666666667 79.4453333333333 86.1706666666667C78.256 82.1813333333333 75.0453333333333 78.3466666666667 71.264 76.4C68.4213333333333 74.9386666666667 67.7226666666667 74.7893333333333 63.8933333333333 74.8053333333333C60.5866666666667 74.816 60.4213333333333 74.8373333333333 58.624 75.504C55.7226666666667 76.5813333333333 52.5173333333333 79.0666666666667 50.784 81.584C49.856 82.9333333333333 48.9386666666667 84.9546666666667 48.5013333333333 86.6133333333334C48.0106666666667 88.496 48.0053333333333 92.8 48.5013333333333 94.8C49.6266666666667 99.392 54.2186666666667 104.384 58.6186666666667 105.7973333333333C61.1573333333333 106.6133333333334 65.008 106.7893333333333 67.9466666666667 106.2186666666667M48.2133333333333 53.1306666666667C42.6026666666667 52.9333333333333 40.1226666666667 52.3733333333333 36.16 50.3946666666667C33.856 49.248 32.832 48.5706666666667 30.72 46.8C27.0613333333333 43.7333333333333 24.176 39.3493333333333 22.6613333333333 34.56C21.5893333333333 31.1786666666667 21.4773333333333 29.9786666666667 21.456 21.9733333333333C21.44 14.816 21.4506666666667 14.592 21.8986666666667 13.76C22.9333333333333 11.8453333333333 24.5386666666667 10.88 26.6666666666667 10.88C28.8053333333333 10.88 30.432 11.8666666666667 31.4133333333333 13.76C31.824 14.56 31.8666666666667 15.1253333333333 32.0213333333333 22.4C32.1653333333333 29.2693333333333 32.2346666666667 30.3253333333333 32.5973333333333 31.3653333333333C34.336 36.336 37.808 39.9253333333333 42.704 41.8133333333333L44.3573333333333 42.4533333333334L63.9893333333333 42.4533333333334L83.616 42.4533333333334L84.9706666666667 41.9466666666667C90.0693333333333 40.0266666666667 93.6533333333333 36.384 95.4026666666667 31.36C95.76 30.3306666666667 95.8293333333333 29.2373333333333 95.9786666666667 22.4C96.1333333333333 15.1306666666667 96.176 14.5546666666667 96.5866666666667 13.76C97.568 11.8666666666667 99.1946666666667 10.88 101.3333333333333 10.88C103.4613333333333 10.88 105.0666666666667 11.8453333333333 106.1013333333333 13.76C106.5493333333333 14.592 106.56 14.8053333333333 106.5333333333333 22.08C106.5066666666667 30.1013333333333 106.432 30.9386666666667 105.3546666666667 34.4533333333334C102.4426666666667 44 94.304 51.1306666666667 84.4106666666667 52.816C82.7946666666667 53.0933333333333 79.8346666666667 53.1626666666667 67.52 53.216C59.3066666666667 53.2533333333333 50.6186666666667 53.216 48.2133333333333 53.1306666666667" />
+    <glyph glyph-name="mic-off"
+      unicode="&#xF126;"
+      horiz-adv-x="128" d="M9.6 122.4693333333334C8.0266666666667 122.1493333333333 6.6986666666667 121.104 5.92 119.5786666666667C5.3013333333333 118.3626666666667 5.3226666666667 116.272 5.9626666666667 114.9866666666667C6.304 114.2986666666667 11.5893333333333 108.8693333333333 24.5386666666667 95.8933333333334L42.6346666666667 77.76L42.7253333333333 69.3333333333333C42.816 61.1306666666667 42.832 60.8533333333333 43.3653333333333 58.8533333333333C45.2053333333333 51.92 49.9253333333333 46.6133333333333 56.4266666666667 44.1813333333333C58.768 43.3066666666667 59.5893333333333 43.1146666666667 61.9733333333333 42.8906666666667C65.696 42.5386666666667 69.776 43.2373333333333 73.0933333333333 44.7893333333333L74.8266666666667 45.6L78.8426666666667 41.584C81.0506666666667 39.3706666666667 82.816 37.5306666666667 82.7626666666667 37.4933333333333C82.7093333333333 37.456 82.3146666666667 37.1626666666667 81.888 36.848C80.576 35.888 76.8 33.9946666666667 74.784 33.2906666666667C72.0053333333333 32.32 69.2533333333333 31.744 67.3066666666667 31.7333333333333C65.2 31.7173333333333 62.96 31.7173333333333 60.5866666666667 31.728C58.5066666666667 31.7386666666667 55.4346666666667 32.448 52.3733333333333 33.6266666666667C43.5573333333333 37.0293333333333 36.5973333333333 44.3253333333333 33.648 53.2586666666667C32.2133333333333 57.6106666666667 32.176 57.9253333333333 32.0213333333333 67.4133333333333C31.8933333333333 75.68 31.8666666666667 76.0906666666667 31.4293333333333 76.912C30.3946666666667 78.8586666666667 28.7893333333333 79.8506666666667 26.6666666666667 79.8506666666667C24.544 79.8506666666667 22.944 78.864 21.8986666666667 76.912C21.4506666666667 76.0746666666667 21.44 75.8346666666667 21.4506666666667 68.16C21.4613333333333 59.4986666666667 21.6213333333333 57.424 22.624 53.328C25.4026666666667 41.936 32.8213333333333 32.128 42.9866666666667 26.4106666666667C47.664 23.776 51.4933333333333 22.464 58.1706666666667 21.2053333333333C58.6293333333333 21.12 58.6346666666667 21.0773333333333 58.704 15.2C58.7733333333333 9.632 58.8053333333333 9.2266666666667 59.232 8.4213333333333C60.2773333333333 6.4693333333333 61.8773333333333 5.4826666666667 64 5.4826666666667C66.1226666666667 5.4826666666667 67.728 6.4746666666667 68.768 8.4213333333333C69.1893333333333 9.2213333333333 69.2266666666667 9.68 69.328 15.2373333333333L69.44 21.2L71.1466666666667 21.4826666666667C75.3173333333333 22.1813333333333 80.2346666666667 23.8293333333333 83.84 25.7386666666667C85.296 26.5066666666667 88.256 28.3946666666667 90.1546666666667 29.76C90.3786666666667 29.92 93.1946666666667 27.232 102.24 18.208C110.5013333333333 9.9626666666667 114.3146666666667 6.304 114.9866666666667 5.9626666666667C116.9173333333333 4.9973333333333 119.4986666666667 5.424 121.04 6.96C122.576 8.5013333333333 123.0026666666667 11.0773333333333 122.0373333333333 13.0133333333334C121.3973333333333 14.304 14.3893333333333 121.3546666666667 13.12 121.9786666666667C12.1066666666667 122.4746666666667 10.6346666666667 122.6826666666667 9.6 122.4693333333334M59.9466666666667 122.1333333333333C53.7066666666667 120.8693333333333 48 116.6666666666667 45.3333333333333 111.36C44.4053333333333 109.504 44.2506666666667 108.4746666666667 44.6826666666667 106.9866666666667C45.344 104.7146666666667 47.3013333333333 103.2533333333333 49.68 103.2533333333333C51.9413333333333 103.2533333333333 53.0346666666667 103.9733333333333 54.7573333333333 106.5866666666667C56.1866666666667 108.7573333333333 57.4453333333333 109.9146666666667 59.4133333333333 110.8533333333333C61.8666666666667 112.0266666666667 63.888 112.2613333333333 66.3306666666667 111.6533333333333C70.048 110.7306666666667 72.7573333333333 108.3413333333333 74.0906666666667 104.8213333333333C74.5493333333333 103.5946666666667 74.56 103.344 74.6666666666667 90.24C74.784 75.6586666666667 74.7253333333333 76.2773333333333 76.064 74.688C77.968 72.4373333333333 82.032 72.4373333333333 83.936 74.688C85.2853333333333 76.288 85.2266666666667 75.5946666666667 85.2213333333333 90.4533333333333C85.216 103.6266666666667 85.2053333333333 104.0533333333333 84.752 105.9733333333333C83.1146666666667 112.896 78.2773333333333 118.48 71.648 121.0773333333333C68.416 122.352 63.296 122.8106666666667 59.9466666666667 122.1333333333333M100.2666666666667 79.8026666666667C98.704 79.4826666666667 97.392 78.4586666666667 96.5706666666667 76.912C96.1333333333333 76.096 96.1066666666667 75.6533333333333 95.9573333333333 67.9466666666667C95.872 63.488 95.7386666666667 59.0026666666667 95.664 57.9733333333333C95.5466666666667 56.3146666666667 95.5786666666667 56.0106666666667 96 55.2C96.6613333333333 53.9146666666667 97.232 53.3493333333333 98.4533333333333 52.7733333333333C100.4266666666667 51.8453333333333 102.8746666666667 52.2026666666667 104.3733333333333 53.6426666666667C106.1333333333333 55.3333333333333 106.5226666666667 57.9733333333333 106.544 68.3733333333333C106.56 75.84 106.5493333333333 76.0746666666667 106.1013333333333 76.912C104.9173333333333 79.12 102.5813333333333 80.2773333333333 100.2666666666667 79.8026666666667M66.4906666666667 53.6213333333333C66.4053333333333 53.536 65.488 53.424 64.4533333333333 53.376C61.2693333333333 53.2213333333333 58.8426666666667 54.1813333333333 56.512 56.512C54.1546666666667 58.8693333333334 53.3333333333333 60.992 53.3333333333333 64.7306666666667L53.3333333333333 67.0933333333333L59.9893333333333 60.4373333333333C63.6533333333333 56.7733333333333 66.576 53.7066666666667 66.4906666666667 53.6213333333333" />
+    <glyph glyph-name="mic-off-1"
+      unicode="&#x6D;&#x69;&#x63;&#x2D;&#x6F;&#x66;&#x66;"
+      horiz-adv-x="128" d="M9.6 122.4693333333334C8.0266666666667 122.1493333333333 6.6986666666667 121.104 5.92 119.5786666666667C5.3013333333333 118.3626666666667 5.3226666666667 116.272 5.9626666666667 114.9866666666667C6.304 114.2986666666667 11.5893333333333 108.8693333333333 24.5386666666667 95.8933333333334L42.6346666666667 77.76L42.7253333333333 69.3333333333333C42.816 61.1306666666667 42.832 60.8533333333333 43.3653333333333 58.8533333333333C45.2053333333333 51.92 49.9253333333333 46.6133333333333 56.4266666666667 44.1813333333333C58.768 43.3066666666667 59.5893333333333 43.1146666666667 61.9733333333333 42.8906666666667C65.696 42.5386666666667 69.776 43.2373333333333 73.0933333333333 44.7893333333333L74.8266666666667 45.6L78.8426666666667 41.584C81.0506666666667 39.3706666666667 82.816 37.5306666666667 82.7626666666667 37.4933333333333C82.7093333333333 37.456 82.3146666666667 37.1626666666667 81.888 36.848C80.576 35.888 76.8 33.9946666666667 74.784 33.2906666666667C72.0053333333333 32.32 69.2533333333333 31.744 67.3066666666667 31.7333333333333C65.2 31.7173333333333 62.96 31.7173333333333 60.5866666666667 31.728C58.5066666666667 31.7386666666667 55.4346666666667 32.448 52.3733333333333 33.6266666666667C43.5573333333333 37.0293333333333 36.5973333333333 44.3253333333333 33.648 53.2586666666667C32.2133333333333 57.6106666666667 32.176 57.9253333333333 32.0213333333333 67.4133333333333C31.8933333333333 75.68 31.8666666666667 76.0906666666667 31.4293333333333 76.912C30.3946666666667 78.8586666666667 28.7893333333333 79.8506666666667 26.6666666666667 79.8506666666667C24.544 79.8506666666667 22.944 78.864 21.8986666666667 76.912C21.4506666666667 76.0746666666667 21.44 75.8346666666667 21.4506666666667 68.16C21.4613333333333 59.4986666666667 21.6213333333333 57.424 22.624 53.328C25.4026666666667 41.936 32.8213333333333 32.128 42.9866666666667 26.4106666666667C47.664 23.776 51.4933333333333 22.464 58.1706666666667 21.2053333333333C58.6293333333333 21.12 58.6346666666667 21.0773333333333 58.704 15.2C58.7733333333333 9.632 58.8053333333333 9.2266666666667 59.232 8.4213333333333C60.2773333333333 6.4693333333333 61.8773333333333 5.4826666666667 64 5.4826666666667C66.1226666666667 5.4826666666667 67.728 6.4746666666667 68.768 8.4213333333333C69.1893333333333 9.2213333333333 69.2266666666667 9.68 69.328 15.2373333333333L69.44 21.2L71.1466666666667 21.4826666666667C75.3173333333333 22.1813333333333 80.2346666666667 23.8293333333333 83.84 25.7386666666667C85.296 26.5066666666667 88.256 28.3946666666667 90.1546666666667 29.76C90.3786666666667 29.92 93.1946666666667 27.232 102.24 18.208C110.5013333333333 9.9626666666667 114.3146666666667 6.304 114.9866666666667 5.9626666666667C116.9173333333333 4.9973333333333 119.4986666666667 5.424 121.04 6.96C122.576 8.5013333333333 123.0026666666667 11.0773333333333 122.0373333333333 13.0133333333334C121.3973333333333 14.304 14.3893333333333 121.3546666666667 13.12 121.9786666666667C12.1066666666667 122.4746666666667 10.6346666666667 122.6826666666667 9.6 122.4693333333334M59.9466666666667 122.1333333333333C53.7066666666667 120.8693333333333 48 116.6666666666667 45.3333333333333 111.36C44.4053333333333 109.504 44.2506666666667 108.4746666666667 44.6826666666667 106.9866666666667C45.344 104.7146666666667 47.3013333333333 103.2533333333333 49.68 103.2533333333333C51.9413333333333 103.2533333333333 53.0346666666667 103.9733333333333 54.7573333333333 106.5866666666667C56.1866666666667 108.7573333333333 57.4453333333333 109.9146666666667 59.4133333333333 110.8533333333333C61.8666666666667 112.0266666666667 63.888 112.2613333333333 66.3306666666667 111.6533333333333C70.048 110.7306666666667 72.7573333333333 108.3413333333333 74.0906666666667 104.8213333333333C74.5493333333333 103.5946666666667 74.56 103.344 74.6666666666667 90.24C74.784 75.6586666666667 74.7253333333333 76.2773333333333 76.064 74.688C77.968 72.4373333333333 82.032 72.4373333333333 83.936 74.688C85.2853333333333 76.288 85.2266666666667 75.5946666666667 85.2213333333333 90.4533333333333C85.216 103.6266666666667 85.2053333333333 104.0533333333333 84.752 105.9733333333333C83.1146666666667 112.896 78.2773333333333 118.48 71.648 121.0773333333333C68.416 122.352 63.296 122.8106666666667 59.9466666666667 122.1333333333333M100.2666666666667 79.8026666666667C98.704 79.4826666666667 97.392 78.4586666666667 96.5706666666667 76.912C96.1333333333333 76.096 96.1066666666667 75.6533333333333 95.9573333333333 67.9466666666667C95.872 63.488 95.7386666666667 59.0026666666667 95.664 57.9733333333333C95.5466666666667 56.3146666666667 95.5786666666667 56.0106666666667 96 55.2C96.6613333333333 53.9146666666667 97.232 53.3493333333333 98.4533333333333 52.7733333333333C100.4266666666667 51.8453333333333 102.8746666666667 52.2026666666667 104.3733333333333 53.6426666666667C106.1333333333333 55.3333333333333 106.5226666666667 57.9733333333333 106.544 68.3733333333333C106.56 75.84 106.5493333333333 76.0746666666667 106.1013333333333 76.912C104.9173333333333 79.12 102.5813333333333 80.2773333333333 100.2666666666667 79.8026666666667M66.4906666666667 53.6213333333333C66.4053333333333 53.536 65.488 53.424 64.4533333333333 53.376C61.2693333333333 53.2213333333333 58.8426666666667 54.1813333333333 56.512 56.512C54.1546666666667 58.8693333333334 53.3333333333333 60.992 53.3333333333333 64.7306666666667L53.3333333333333 67.0933333333333L59.9893333333333 60.4373333333333C63.6533333333333 56.7733333333333 66.576 53.7066666666667 66.4906666666667 53.6213333333333" />
+    <glyph glyph-name="rocket"
+      unicode="&#xF127;"
       horiz-adv-x="128" d="M110.9333333333333 122.3146666666667C97.1093333333333 120.9866666666667 86.3413333333333 117.168 75.2 109.632C68.72 105.2533333333333 63.184 100.0426666666667 58.2986666666667 93.7493333333333L56.4693333333333 91.3866666666667L54.192 91.856C50.7733333333333 92.5653333333333 46.3146666666667 93.0133333333333 42.752 93.0133333333333C31.8773333333333 93.008 25.9146666666667 89.344 21.072 79.6906666666667C18.8586666666667 75.2746666666667 16.8053333333333 69.0506666666667 16.2293333333333 64.9813333333333C15.8826666666667 62.528 16.944 60.3733333333333 19.0613333333333 59.248C19.9413333333333 58.7786666666667 20.0266666666667 58.7786666666667 32.8746666666667 58.704L45.7973333333333 58.6293333333333L52.2186666666667 52.1973333333334L58.64 45.76L58.7093333333333 32.8533333333333C58.7786666666667 20.0213333333333 58.7786666666667 19.9413333333333 59.248 19.0613333333334C59.888 17.8666666666667 61.3066666666667 16.6986666666667 62.5866666666667 16.3146666666667C63.4293333333333 16.064 63.9253333333333 16.048 65.0453333333333 16.224C68.8586666666667 16.832 74.832 18.7573333333333 78.8746666666667 20.6933333333333C89.1786666666667 25.616 93.056 31.632 93.0453333333333 42.6666666666667C93.04 46.384 92.832 48.5546666666667 92.0266666666667 53.312C91.5253333333333 56.3146666666667 91.504 56.6133333333334 91.824 56.7946666666667C92.4693333333333 57.152 95.8826666666667 59.968 98.4053333333333 62.224C110.0426666666667 72.6293333333333 118.1493333333333 86.928 121.168 102.4C121.9466666666667 106.416 122.2506666666667 109.2586666666667 122.384 113.8613333333333C122.5013333333333 117.8133333333333 122.4693333333334 118.5066666666667 122.1546666666667 119.3386666666667C121.7066666666667 120.5066666666667 120.224 121.9146666666667 119.1146666666667 122.224C118.3733333333333 122.4266666666667 112.784 122.4906666666667 110.9333333333333 122.3146666666667M111.7173333333333 111.44C111.9253333333333 110.9066666666667 111.216 106.288 110.368 102.6186666666667C106.8266666666667 87.3066666666667 98.448 74.8373333333333 85.072 64.992C81.408 62.2933333333333 73.7173333333333 57.936 68.4 55.5413333333333L65.3866666666667 54.192L59.8133333333333 59.76L54.2346666666667 65.3333333333333L54.6666666666667 66.32C57.6906666666667 73.2533333333333 62.4853333333333 81.648 66.3253333333333 86.736C76.2613333333333 99.904 91.0133333333333 108.7573333333333 107.3066666666667 111.3226666666667C110.7466666666667 111.8666666666667 111.5466666666667 111.888 111.7173333333333 111.44M48.624 82.1173333333333C49.4986666666667 82.0053333333333 50.256 81.872 50.3093333333333 81.8186666666667C50.3626666666667 81.7653333333333 49.3013333333333 79.4826666666667 47.952 76.752C46.6026666666667 74.0213333333333 45.2746666666667 71.2373333333333 45.0026666666667 70.56L44.5066666666667 69.3333333333333L36.3466666666667 69.3333333333333L28.1813333333333 69.3333333333333L28.5866666666667 70.512C29.152 72.1546666666667 30.384 74.832 31.4026666666667 76.6506666666667C33.1893333333333 79.824 35.0026666666667 81.3333333333333 37.9786666666667 82.128C39.3866666666667 82.5066666666667 40.0106666666667 82.5386666666667 43.3066666666667 82.4373333333333C45.36 82.3733333333333 47.7546666666667 82.2293333333333 48.624 82.1173333333333M82.1226666666667 48.64C82.5013333333333 46.2986666666667 82.624 41.8506666666667 82.368 39.5733333333334C81.9946666666667 36.2666666666667 80.6933333333333 33.9946666666667 78.24 32.3626666666667C76.7093333333333 31.3493333333333 72.7733333333333 29.4026666666667 70.88 28.7253333333333L69.3333333333333 28.1706666666667L69.3333333333333 36.336L69.3333333333333 44.5013333333333L71.0933333333333 45.2213333333333C72.064 45.616 74.8213333333333 46.928 77.2266666666667 48.128C79.632 49.3333333333333 81.664 50.2506666666667 81.7493333333333 50.1706666666667C81.8293333333333 50.0906666666667 81.9946666666667 49.4026666666667 82.1226666666667 48.64M29.44 47.8613333333333C20.5546666666667 46.6773333333333 14.6826666666667 39.6586666666667 10.56 25.2853333333333C9.5466666666667 21.7653333333333 8.416 16.4853333333333 8.192 14.2666666666667C7.9573333333333 11.888 9.0826666666667 9.584 10.9706666666667 8.5866666666667C13.5253333333333 7.2266666666667 26.832 10.288 34.928 14.0853333333333C42.656 17.7173333333333 47.1413333333333 23.0826666666667 47.8026666666667 29.4933333333333C48.3253333333333 34.5386666666667 47.1626666666667 38.6133333333333 44.1653333333333 42.2133333333333C42.1973333333333 44.5813333333333 38.7786666666667 46.6666666666667 35.5946666666667 47.4453333333333C34.128 47.808 30.7466666666667 48.0373333333333 29.44 47.8613333333333M34.2026666666667 36.816C35.3493333333333 36.256 36.2506666666667 35.2853333333333 36.864 33.952C37.312 32.9653333333334 37.3706666666667 32.5813333333334 37.2906666666667 31.1786666666667C37.1786666666667 29.28 36.8426666666667 28.528 35.4453333333333 27.0346666666667C33.6853333333333 25.152 31.1573333333333 23.6853333333333 27.072 22.1813333333333C25.0666666666667 21.44 20.24 20.0106666666667 20.128 20.1226666666667C20.0853333333333 20.1653333333333 20.4373333333333 21.5146666666667 20.9066666666667 23.12C23.2746666666667 31.2106666666667 26.0373333333333 35.7493333333333 29.3813333333333 37.0186666666667C30.496 37.44 33.1466666666667 37.328 34.2026666666667 36.816" />
     <glyph glyph-name="rocket-1"
       unicode="&#x72;&#x6F;&#x63;&#x6B;&#x65;&#x74;"
       horiz-adv-x="128" d="M110.9333333333333 122.3146666666667C97.1093333333333 120.9866666666667 86.3413333333333 117.168 75.2 109.632C68.72 105.2533333333333 63.184 100.0426666666667 58.2986666666667 93.7493333333333L56.4693333333333 91.3866666666667L54.192 91.856C50.7733333333333 92.5653333333333 46.3146666666667 93.0133333333333 42.752 93.0133333333333C31.8773333333333 93.008 25.9146666666667 89.344 21.072 79.6906666666667C18.8586666666667 75.2746666666667 16.8053333333333 69.0506666666667 16.2293333333333 64.9813333333333C15.8826666666667 62.528 16.944 60.3733333333333 19.0613333333333 59.248C19.9413333333333 58.7786666666667 20.0266666666667 58.7786666666667 32.8746666666667 58.704L45.7973333333333 58.6293333333333L52.2186666666667 52.1973333333334L58.64 45.76L58.7093333333333 32.8533333333333C58.7786666666667 20.0213333333333 58.7786666666667 19.9413333333333 59.248 19.0613333333334C59.888 17.8666666666667 61.3066666666667 16.6986666666667 62.5866666666667 16.3146666666667C63.4293333333333 16.064 63.9253333333333 16.048 65.0453333333333 16.224C68.8586666666667 16.832 74.832 18.7573333333333 78.8746666666667 20.6933333333333C89.1786666666667 25.616 93.056 31.632 93.0453333333333 42.6666666666667C93.04 46.384 92.832 48.5546666666667 92.0266666666667 53.312C91.5253333333333 56.3146666666667 91.504 56.6133333333334 91.824 56.7946666666667C92.4693333333333 57.152 95.8826666666667 59.968 98.4053333333333 62.224C110.0426666666667 72.6293333333333 118.1493333333333 86.928 121.168 102.4C121.9466666666667 106.416 122.2506666666667 109.2586666666667 122.384 113.8613333333333C122.5013333333333 117.8133333333333 122.4693333333334 118.5066666666667 122.1546666666667 119.3386666666667C121.7066666666667 120.5066666666667 120.224 121.9146666666667 119.1146666666667 122.224C118.3733333333333 122.4266666666667 112.784 122.4906666666667 110.9333333333333 122.3146666666667M111.7173333333333 111.44C111.9253333333333 110.9066666666667 111.216 106.288 110.368 102.6186666666667C106.8266666666667 87.3066666666667 98.448 74.8373333333333 85.072 64.992C81.408 62.2933333333333 73.7173333333333 57.936 68.4 55.5413333333333L65.3866666666667 54.192L59.8133333333333 59.76L54.2346666666667 65.3333333333333L54.6666666666667 66.32C57.6906666666667 73.2533333333333 62.4853333333333 81.648 66.3253333333333 86.736C76.2613333333333 99.904 91.0133333333333 108.7573333333333 107.3066666666667 111.3226666666667C110.7466666666667 111.8666666666667 111.5466666666667 111.888 111.7173333333333 111.44M48.624 82.1173333333333C49.4986666666667 82.0053333333333 50.256 81.872 50.3093333333333 81.8186666666667C50.3626666666667 81.7653333333333 49.3013333333333 79.4826666666667 47.952 76.752C46.6026666666667 74.0213333333333 45.2746666666667 71.2373333333333 45.0026666666667 70.56L44.5066666666667 69.3333333333333L36.3466666666667 69.3333333333333L28.1813333333333 69.3333333333333L28.5866666666667 70.512C29.152 72.1546666666667 30.384 74.832 31.4026666666667 76.6506666666667C33.1893333333333 79.824 35.0026666666667 81.3333333333333 37.9786666666667 82.128C39.3866666666667 82.5066666666667 40.0106666666667 82.5386666666667 43.3066666666667 82.4373333333333C45.36 82.3733333333333 47.7546666666667 82.2293333333333 48.624 82.1173333333333M82.1226666666667 48.64C82.5013333333333 46.2986666666667 82.624 41.8506666666667 82.368 39.5733333333334C81.9946666666667 36.2666666666667 80.6933333333333 33.9946666666667 78.24 32.3626666666667C76.7093333333333 31.3493333333333 72.7733333333333 29.4026666666667 70.88 28.7253333333333L69.3333333333333 28.1706666666667L69.3333333333333 36.336L69.3333333333333 44.5013333333333L71.0933333333333 45.2213333333333C72.064 45.616 74.8213333333333 46.928 77.2266666666667 48.128C79.632 49.3333333333333 81.664 50.2506666666667 81.7493333333333 50.1706666666667C81.8293333333333 50.0906666666667 81.9946666666667 49.4026666666667 82.1226666666667 48.64M29.44 47.8613333333333C20.5546666666667 46.6773333333333 14.6826666666667 39.6586666666667 10.56 25.2853333333333C9.5466666666667 21.7653333333333 8.416 16.4853333333333 8.192 14.2666666666667C7.9573333333333 11.888 9.0826666666667 9.584 10.9706666666667 8.5866666666667C13.5253333333333 7.2266666666667 26.832 10.288 34.928 14.0853333333333C42.656 17.7173333333333 47.1413333333333 23.0826666666667 47.8026666666667 29.4933333333333C48.3253333333333 34.5386666666667 47.1626666666667 38.6133333333333 44.1653333333333 42.2133333333333C42.1973333333333 44.5813333333333 38.7786666666667 46.6666666666667 35.5946666666667 47.4453333333333C34.128 47.808 30.7466666666667 48.0373333333333 29.44 47.8613333333333M34.2026666666667 36.816C35.3493333333333 36.256 36.2506666666667 35.2853333333333 36.864 33.952C37.312 32.9653333333334 37.3706666666667 32.5813333333334 37.2906666666667 31.1786666666667C37.1786666666667 29.28 36.8426666666667 28.528 35.4453333333333 27.0346666666667C33.6853333333333 25.152 31.1573333333333 23.6853333333333 27.072 22.1813333333333C25.0666666666667 21.44 20.24 20.0106666666667 20.128 20.1226666666667C20.0853333333333 20.1653333333333 20.4373333333333 21.5146666666667 20.9066666666667 23.12C23.2746666666667 31.2106666666667 26.0373333333333 35.7493333333333 29.3813333333333 37.0186666666667C30.496 37.44 33.1466666666667 37.328 34.2026666666667 36.816" />
-    <glyph glyph-name="server"
-      unicode="&#xF124;"
-      horiz-adv-x="128" d="M19.4133333333333 122.464C15.8186666666667 122.0746666666667 12.864 120.6133333333333 10.1226666666667 117.8773333333334C7.9466666666667 115.696 6.7733333333333 113.7226666666667 5.9306666666667 110.816C5.44 109.1306666666667 5.44 109.056 5.44 96C5.44 82.944 5.44 82.8693333333334 5.9306666666667 81.184C6.7733333333333 78.2773333333333 7.9466666666667 76.304 10.1226666666667 74.1226666666667C12.304 71.9466666666667 14.2773333333333 70.7733333333333 17.184 69.9306666666667L18.88 69.44L64 69.44L109.12 69.44L110.816 69.9306666666667C113.7226666666667 70.7733333333333 115.696 71.9466666666667 117.8773333333333 74.1226666666667C120.0533333333334 76.304 121.2266666666667 78.2773333333333 122.0693333333333 81.184C122.56 82.8693333333334 122.56 82.944 122.56 96C122.56 109.056 122.56 109.1306666666667 122.0693333333333 110.816C121.2266666666667 113.7226666666667 120.0533333333334 115.696 117.8773333333333 117.8773333333334C115.7386666666667 120.0106666666667 113.8026666666667 121.1786666666667 110.928 122.064L109.3333333333333 122.5546666666667L65.0666666666667 122.5813333333333C40.72 122.5973333333334 20.176 122.544 19.4133333333333 122.464M108.9066666666667 111.4933333333333C110.1866666666667 110.8853333333333 110.9706666666667 110.0906666666667 111.5573333333333 108.8C111.9786666666667 107.872 111.9893333333333 107.456 111.9893333333333 96C111.9893333333333 84.544 111.9786666666667 84.128 111.5573333333333 83.2C110.9706666666667 81.9093333333333 110.1866666666667 81.1146666666667 108.9066666666667 80.5066666666667L107.84 80.0053333333333L64 80.0053333333333L20.16 80.0053333333333L19.0933333333333 80.5066666666667C17.8133333333333 81.1146666666667 17.0293333333333 81.9093333333333 16.4426666666667 83.2C16.0213333333333 84.128 16.0106666666667 84.544 16.0106666666667 96C16.0106666666667 107.456 16.0213333333333 107.872 16.4426666666667 108.8C17.0293333333333 110.0906666666667 17.8133333333333 110.8853333333333 19.0933333333333 111.4933333333333L20.16 111.9946666666667L64 111.9946666666667L107.84 111.9946666666667L108.9066666666667 111.4933333333333M30.9333333333333 101.136C26.9013333333333 100.3093333333333 25.3813333333333 95.2106666666667 28.2933333333333 92.2933333333333C29.7706666666667 90.8213333333333 32.4 90.3413333333333 34.24 91.216C35.9946666666667 92.048 37.3333333333333 94.1173333333333 37.3333333333333 96C37.3333333333333 97.8453333333333 35.9893333333333 99.968 34.336 100.7306666666667C33.4133333333333 101.1573333333333 31.9093333333333 101.3333333333333 30.9333333333333 101.136M19.4133333333333 58.464C15.8186666666667 58.0746666666667 12.864 56.6133333333334 10.1226666666667 53.8773333333333C7.9466666666667 51.696 6.7733333333333 49.7226666666667 5.9306666666667 46.816C5.44 45.1306666666667 5.44 45.056 5.44 32C5.44 18.944 5.44 18.8693333333333 5.9306666666667 17.184C6.7733333333333 14.2773333333333 7.9466666666667 12.304 10.1226666666667 10.1226666666667C12.304 7.9466666666667 14.2773333333333 6.7733333333333 17.184 5.9306666666667L18.88 5.44L64 5.44L109.12 5.44L110.816 5.9306666666667C113.7226666666667 6.7733333333333 115.696 7.9466666666667 117.8773333333333 10.1226666666667C120.0533333333334 12.304 121.2266666666667 14.2773333333333 122.0693333333333 17.184C122.56 18.8693333333333 122.56 18.944 122.56 32C122.56 45.056 122.56 45.1306666666667 122.0693333333333 46.816C121.2266666666667 49.7226666666667 120.0533333333334 51.696 117.8773333333333 53.8773333333333C115.7386666666667 56.0106666666667 113.8026666666667 57.1786666666667 110.928 58.064L109.3333333333333 58.5546666666667L65.0666666666667 58.5813333333333C40.72 58.5973333333333 20.176 58.544 19.4133333333333 58.464M108.9066666666667 47.4933333333333C110.1866666666667 46.8853333333333 110.9706666666667 46.0906666666667 111.5573333333333 44.8C111.9786666666667 43.872 111.9893333333333 43.456 111.9893333333333 32C111.9893333333333 20.544 111.9786666666667 20.128 111.5573333333333 19.2C110.9706666666667 17.9093333333333 110.1866666666667 17.1146666666667 108.9066666666667 16.5066666666667L107.84 16.0053333333333L64 16.0053333333333L20.16 16.0053333333333L19.0933333333333 16.5066666666667C17.8133333333333 17.1146666666667 17.0293333333333 17.9093333333333 16.4426666666667 19.2C16.0213333333333 20.128 16.0106666666667 20.544 16.0106666666667 32C16.0106666666667 43.456 16.0213333333333 43.872 16.4426666666667 44.8C17.0293333333333 46.0906666666667 17.8133333333333 46.8853333333333 19.0933333333333 47.4933333333333L20.16 47.9946666666667L64 47.9946666666667L107.84 47.9946666666667L108.9066666666667 47.4933333333333M30.9333333333333 37.136C26.9013333333333 36.3093333333333 25.3813333333333 31.2106666666667 28.2933333333333 28.2933333333333C29.7706666666667 26.8213333333333 32.4 26.3413333333333 34.24 27.216C35.9946666666667 28.048 37.3333333333333 30.1173333333333 37.3333333333333 32C37.3333333333333 33.8453333333333 35.9893333333333 35.968 34.336 36.7306666666667C33.4133333333333 37.1573333333333 31.9093333333333 37.3333333333333 30.9333333333333 37.136" />
-    <glyph glyph-name="server-1"
-      unicode="&#x73;&#x65;&#x72;&#x76;&#x65;&#x72;"
-      horiz-adv-x="128" d="M19.4133333333333 122.464C15.8186666666667 122.0746666666667 12.864 120.6133333333333 10.1226666666667 117.8773333333334C7.9466666666667 115.696 6.7733333333333 113.7226666666667 5.9306666666667 110.816C5.44 109.1306666666667 5.44 109.056 5.44 96C5.44 82.944 5.44 82.8693333333334 5.9306666666667 81.184C6.7733333333333 78.2773333333333 7.9466666666667 76.304 10.1226666666667 74.1226666666667C12.304 71.9466666666667 14.2773333333333 70.7733333333333 17.184 69.9306666666667L18.88 69.44L64 69.44L109.12 69.44L110.816 69.9306666666667C113.7226666666667 70.7733333333333 115.696 71.9466666666667 117.8773333333333 74.1226666666667C120.0533333333334 76.304 121.2266666666667 78.2773333333333 122.0693333333333 81.184C122.56 82.8693333333334 122.56 82.944 122.56 96C122.56 109.056 122.56 109.1306666666667 122.0693333333333 110.816C121.2266666666667 113.7226666666667 120.0533333333334 115.696 117.8773333333333 117.8773333333334C115.7386666666667 120.0106666666667 113.8026666666667 121.1786666666667 110.928 122.064L109.3333333333333 122.5546666666667L65.0666666666667 122.5813333333333C40.72 122.5973333333334 20.176 122.544 19.4133333333333 122.464M108.9066666666667 111.4933333333333C110.1866666666667 110.8853333333333 110.9706666666667 110.0906666666667 111.5573333333333 108.8C111.9786666666667 107.872 111.9893333333333 107.456 111.9893333333333 96C111.9893333333333 84.544 111.9786666666667 84.128 111.5573333333333 83.2C110.9706666666667 81.9093333333333 110.1866666666667 81.1146666666667 108.9066666666667 80.5066666666667L107.84 80.0053333333333L64 80.0053333333333L20.16 80.0053333333333L19.0933333333333 80.5066666666667C17.8133333333333 81.1146666666667 17.0293333333333 81.9093333333333 16.4426666666667 83.2C16.0213333333333 84.128 16.0106666666667 84.544 16.0106666666667 96C16.0106666666667 107.456 16.0213333333333 107.872 16.4426666666667 108.8C17.0293333333333 110.0906666666667 17.8133333333333 110.8853333333333 19.0933333333333 111.4933333333333L20.16 111.9946666666667L64 111.9946666666667L107.84 111.9946666666667L108.9066666666667 111.4933333333333M30.9333333333333 101.136C26.9013333333333 100.3093333333333 25.3813333333333 95.2106666666667 28.2933333333333 92.2933333333333C29.7706666666667 90.8213333333333 32.4 90.3413333333333 34.24 91.216C35.9946666666667 92.048 37.3333333333333 94.1173333333333 37.3333333333333 96C37.3333333333333 97.8453333333333 35.9893333333333 99.968 34.336 100.7306666666667C33.4133333333333 101.1573333333333 31.9093333333333 101.3333333333333 30.9333333333333 101.136M19.4133333333333 58.464C15.8186666666667 58.0746666666667 12.864 56.6133333333334 10.1226666666667 53.8773333333333C7.9466666666667 51.696 6.7733333333333 49.7226666666667 5.9306666666667 46.816C5.44 45.1306666666667 5.44 45.056 5.44 32C5.44 18.944 5.44 18.8693333333333 5.9306666666667 17.184C6.7733333333333 14.2773333333333 7.9466666666667 12.304 10.1226666666667 10.1226666666667C12.304 7.9466666666667 14.2773333333333 6.7733333333333 17.184 5.9306666666667L18.88 5.44L64 5.44L109.12 5.44L110.816 5.9306666666667C113.7226666666667 6.7733333333333 115.696 7.9466666666667 117.8773333333333 10.1226666666667C120.0533333333334 12.304 121.2266666666667 14.2773333333333 122.0693333333333 17.184C122.56 18.8693333333333 122.56 18.944 122.56 32C122.56 45.056 122.56 45.1306666666667 122.0693333333333 46.816C121.2266666666667 49.7226666666667 120.0533333333334 51.696 117.8773333333333 53.8773333333333C115.7386666666667 56.0106666666667 113.8026666666667 57.1786666666667 110.928 58.064L109.3333333333333 58.5546666666667L65.0666666666667 58.5813333333333C40.72 58.5973333333333 20.176 58.544 19.4133333333333 58.464M108.9066666666667 47.4933333333333C110.1866666666667 46.8853333333333 110.9706666666667 46.0906666666667 111.5573333333333 44.8C111.9786666666667 43.872 111.9893333333333 43.456 111.9893333333333 32C111.9893333333333 20.544 111.9786666666667 20.128 111.5573333333333 19.2C110.9706666666667 17.9093333333333 110.1866666666667 17.1146666666667 108.9066666666667 16.5066666666667L107.84 16.0053333333333L64 16.0053333333333L20.16 16.0053333333333L19.0933333333333 16.5066666666667C17.8133333333333 17.1146666666667 17.0293333333333 17.9093333333333 16.4426666666667 19.2C16.0213333333333 20.128 16.0106666666667 20.544 16.0106666666667 32C16.0106666666667 43.456 16.0213333333333 43.872 16.4426666666667 44.8C17.0293333333333 46.0906666666667 17.8133333333333 46.8853333333333 19.0933333333333 47.4933333333333L20.16 47.9946666666667L64 47.9946666666667L107.84 47.9946666666667L108.9066666666667 47.4933333333333M30.9333333333333 37.136C26.9013333333333 36.3093333333333 25.3813333333333 31.2106666666667 28.2933333333333 28.2933333333333C29.7706666666667 26.8213333333333 32.4 26.3413333333333 34.24 27.216C35.9946666666667 28.048 37.3333333333333 30.1173333333333 37.3333333333333 32C37.3333333333333 33.8453333333333 35.9893333333333 35.968 34.336 36.7306666666667C33.4133333333333 37.1573333333333 31.9093333333333 37.3333333333333 30.9333333333333 37.136" />
+    <glyph glyph-name="paintbrush"
+      unicode="&#xF128;"
+      horiz-adv-x="128" d="M101.7813333333333 122.016C99.8933333333333 121.52 98.352 120.8373333333333 96.6933333333333 119.76C95.9626666666667 119.28 91.248 114.7573333333333 85.072 108.6133333333334L74.672 98.2666666666667L72.0586666666667 100.8213333333333C68.8906666666667 103.9093333333333 67.936 104.688 66.1333333333333 105.6693333333333C63.6053333333333 107.04 61.9573333333333 107.4133333333333 58.56 107.3973333333333C55.9573333333333 107.3813333333333 55.36 107.312 53.936 106.8373333333333C50.432 105.68 48.5813333333333 104.2453333333333 42.2133333333333 97.7866666666667C37.9466666666667 93.456 37.4826666666667 92.7573333333333 37.4826666666667 90.6666666666667C37.4826666666667 88.9226666666667 37.9466666666667 87.968 39.7066666666667 86.0853333333333L41.008 84.6933333333333L40.1973333333333 83.68C38.6826666666667 81.7973333333333 34.8746666666667 78.192 32.9493333333333 76.832C28.2826666666667 73.52 23.1146666666667 71.6693333333333 13.5466666666667 69.8773333333333C11.3173333333333 69.4613333333333 9.104 68.976 8.624 68.7946666666667C7.5733333333333 68.4053333333334 6.5226666666667 67.4186666666667 5.92 66.2506666666667C5.264 64.992 5.3066666666667 62.8693333333334 6.0053333333333 61.6213333333333C6.4693333333333 60.7946666666667 48.544 8.064 49.6853333333333 6.88C50.544 5.9946666666667 51.8506666666667 5.472 53.2373333333333 5.472C54.8693333333333 5.4666666666667 56.528 6.208 59.9306666666667 8.4746666666667C69.7013333333333 14.976 81.5093333333333 27.264 86.8373333333333 36.48C87.344 37.36 87.7813333333333 38.112 87.808 38.1493333333333C87.8346666666667 38.1866666666667 88.1706666666667 38.0533333333333 88.5653333333333 37.8506666666667C89.632 37.3013333333333 91.8026666666667 37.36 93.0133333333333 37.968C94.064 38.5013333333334 100.4906666666667 44.7093333333333 103.2693333333333 47.872C106.2773333333333 51.3013333333333 107.3973333333333 54.2186666666667 107.3973333333333 58.6666666666667C107.3973333333333 61.7333333333333 107.0666666666667 63.2746666666667 105.9093333333333 65.6426666666667C104.9493333333333 67.6053333333333 103.984 68.8266666666667 100.8266666666667 72.0586666666667L98.2666666666667 74.6773333333333L108.4 84.8586666666667C113.9733333333333 90.4586666666667 118.8266666666667 95.424 119.1893333333333 95.8933333333334C120.192 97.2 121.3013333333333 99.36 121.8186666666667 101.0133333333333C122.4586666666667 103.0453333333333 122.6346666666667 107.3973333333333 122.1653333333333 109.6C120.8853333333333 115.632 115.6746666666667 120.8746666666667 109.712 122.1386666666667C107.6106666666667 122.5866666666667 103.7226666666667 122.5226666666667 101.7813333333333 122.016M107.6053333333333 111.7706666666667C110.7093333333333 110.9866666666667 112.704 107.232 111.68 104.0853333333333C111.3333333333333 102.9973333333333 110.608 102.2293333333333 98.88 90.4533333333333C90.1653333333333 81.7066666666667 86.304 77.6853333333334 85.9626666666667 77.0133333333333C85.296 75.68 85.3013333333333 73.6426666666667 85.968 72.32C86.2773333333333 71.712 88.272 69.5253333333333 91.4133333333333 66.3466666666667C96.7573333333333 60.9386666666667 96.9173333333333 60.7146666666667 96.9013333333333 58.544C96.88 56.7413333333333 96.3146666666667 55.84 93.3546666666667 52.9066666666667L90.6613333333333 50.2453333333333L70.4533333333333 70.4533333333334L50.2453333333333 90.6613333333333L52.9066666666667 93.3546666666667C55.84 96.3146666666667 56.7413333333333 96.88 58.544 96.9013333333333C60.7146666666667 96.9173333333333 60.9386666666667 96.7573333333333 66.3466666666667 91.4133333333333C69.5253333333333 88.272 71.712 86.2773333333333 72.32 85.968C73.6426666666667 85.3013333333333 75.68 85.296 77.0133333333333 85.9626666666667C77.6906666666667 86.304 81.648 90.112 90.352 98.8C101.072 109.4933333333333 102.8746666666667 111.2106666666667 103.792 111.568C104.9973333333333 112.0373333333333 106.2773333333333 112.1066666666667 107.6053333333333 111.7706666666667M79.5733333333333 45.824C79.5733333333333 45.36 77.2906666666667 40.8533333333333 76.8853333333333 40.5173333333333C76.6506666666667 40.32 71.2106666666667 41.6106666666667 51.4986666666667 46.5333333333333L26.416 52.8L23.5466666666667 56.3786666666667C21.968 58.352 20.6293333333333 60.08 20.576 60.2186666666667C20.5066666666667 60.3946666666667 21.4613333333333 60.7306666666667 23.552 61.2693333333333C30.848 63.1413333333333 36.7146666666667 66.0746666666667 41.936 70.4533333333334C43.7813333333333 72.0053333333333 46.7253333333333 74.96 47.9626666666667 76.5066666666667L48.5333333333333 77.2266666666667L64.0533333333333 61.7066666666667C72.5866666666667 53.1733333333333 79.5733333333333 46.0213333333333 79.5733333333333 45.824M53.6533333333333 35.1786666666667C62.2186666666667 33.0453333333333 69.312 31.2266666666667 69.4133333333333 31.136C69.8773333333333 30.72 59.3013333333333 20.8853333333333 55.728 18.4053333333333C54.7573333333333 17.7333333333333 54.56 17.6693333333333 54.3146666666667 17.936C54.1066666666667 18.16 39.0186666666667 37.0346666666667 37.4613333333333 39.0186666666667C37.2746666666667 39.2533333333333 37.312 39.2906666666667 37.6533333333333 39.184C37.888 39.1146666666667 45.088 37.312 53.6533333333333 35.1786666666667" />
+    <glyph glyph-name="paintbrush-1"
+      unicode="&#x70;&#x61;&#x69;&#x6E;&#x74;&#x62;&#x72;&#x75;&#x73;&#x68;"
+      horiz-adv-x="128" d="M101.7813333333333 122.016C99.8933333333333 121.52 98.352 120.8373333333333 96.6933333333333 119.76C95.9626666666667 119.28 91.248 114.7573333333333 85.072 108.6133333333334L74.672 98.2666666666667L72.0586666666667 100.8213333333333C68.8906666666667 103.9093333333333 67.936 104.688 66.1333333333333 105.6693333333333C63.6053333333333 107.04 61.9573333333333 107.4133333333333 58.56 107.3973333333333C55.9573333333333 107.3813333333333 55.36 107.312 53.936 106.8373333333333C50.432 105.68 48.5813333333333 104.2453333333333 42.2133333333333 97.7866666666667C37.9466666666667 93.456 37.4826666666667 92.7573333333333 37.4826666666667 90.6666666666667C37.4826666666667 88.9226666666667 37.9466666666667 87.968 39.7066666666667 86.0853333333333L41.008 84.6933333333333L40.1973333333333 83.68C38.6826666666667 81.7973333333333 34.8746666666667 78.192 32.9493333333333 76.832C28.2826666666667 73.52 23.1146666666667 71.6693333333333 13.5466666666667 69.8773333333333C11.3173333333333 69.4613333333333 9.104 68.976 8.624 68.7946666666667C7.5733333333333 68.4053333333334 6.5226666666667 67.4186666666667 5.92 66.2506666666667C5.264 64.992 5.3066666666667 62.8693333333334 6.0053333333333 61.6213333333333C6.4693333333333 60.7946666666667 48.544 8.064 49.6853333333333 6.88C50.544 5.9946666666667 51.8506666666667 5.472 53.2373333333333 5.472C54.8693333333333 5.4666666666667 56.528 6.208 59.9306666666667 8.4746666666667C69.7013333333333 14.976 81.5093333333333 27.264 86.8373333333333 36.48C87.344 37.36 87.7813333333333 38.112 87.808 38.1493333333333C87.8346666666667 38.1866666666667 88.1706666666667 38.0533333333333 88.5653333333333 37.8506666666667C89.632 37.3013333333333 91.8026666666667 37.36 93.0133333333333 37.968C94.064 38.5013333333334 100.4906666666667 44.7093333333333 103.2693333333333 47.872C106.2773333333333 51.3013333333333 107.3973333333333 54.2186666666667 107.3973333333333 58.6666666666667C107.3973333333333 61.7333333333333 107.0666666666667 63.2746666666667 105.9093333333333 65.6426666666667C104.9493333333333 67.6053333333333 103.984 68.8266666666667 100.8266666666667 72.0586666666667L98.2666666666667 74.6773333333333L108.4 84.8586666666667C113.9733333333333 90.4586666666667 118.8266666666667 95.424 119.1893333333333 95.8933333333334C120.192 97.2 121.3013333333333 99.36 121.8186666666667 101.0133333333333C122.4586666666667 103.0453333333333 122.6346666666667 107.3973333333333 122.1653333333333 109.6C120.8853333333333 115.632 115.6746666666667 120.8746666666667 109.712 122.1386666666667C107.6106666666667 122.5866666666667 103.7226666666667 122.5226666666667 101.7813333333333 122.016M107.6053333333333 111.7706666666667C110.7093333333333 110.9866666666667 112.704 107.232 111.68 104.0853333333333C111.3333333333333 102.9973333333333 110.608 102.2293333333333 98.88 90.4533333333333C90.1653333333333 81.7066666666667 86.304 77.6853333333334 85.9626666666667 77.0133333333333C85.296 75.68 85.3013333333333 73.6426666666667 85.968 72.32C86.2773333333333 71.712 88.272 69.5253333333333 91.4133333333333 66.3466666666667C96.7573333333333 60.9386666666667 96.9173333333333 60.7146666666667 96.9013333333333 58.544C96.88 56.7413333333333 96.3146666666667 55.84 93.3546666666667 52.9066666666667L90.6613333333333 50.2453333333333L70.4533333333333 70.4533333333334L50.2453333333333 90.6613333333333L52.9066666666667 93.3546666666667C55.84 96.3146666666667 56.7413333333333 96.88 58.544 96.9013333333333C60.7146666666667 96.9173333333333 60.9386666666667 96.7573333333333 66.3466666666667 91.4133333333333C69.5253333333333 88.272 71.712 86.2773333333333 72.32 85.968C73.6426666666667 85.3013333333333 75.68 85.296 77.0133333333333 85.9626666666667C77.6906666666667 86.304 81.648 90.112 90.352 98.8C101.072 109.4933333333333 102.8746666666667 111.2106666666667 103.792 111.568C104.9973333333333 112.0373333333333 106.2773333333333 112.1066666666667 107.6053333333333 111.7706666666667M79.5733333333333 45.824C79.5733333333333 45.36 77.2906666666667 40.8533333333333 76.8853333333333 40.5173333333333C76.6506666666667 40.32 71.2106666666667 41.6106666666667 51.4986666666667 46.5333333333333L26.416 52.8L23.5466666666667 56.3786666666667C21.968 58.352 20.6293333333333 60.08 20.576 60.2186666666667C20.5066666666667 60.3946666666667 21.4613333333333 60.7306666666667 23.552 61.2693333333333C30.848 63.1413333333333 36.7146666666667 66.0746666666667 41.936 70.4533333333334C43.7813333333333 72.0053333333333 46.7253333333333 74.96 47.9626666666667 76.5066666666667L48.5333333333333 77.2266666666667L64.0533333333333 61.7066666666667C72.5866666666667 53.1733333333333 79.5733333333333 46.0213333333333 79.5733333333333 45.824M53.6533333333333 35.1786666666667C62.2186666666667 33.0453333333333 69.312 31.2266666666667 69.4133333333333 31.136C69.8773333333333 30.72 59.3013333333333 20.8853333333333 55.728 18.4053333333333C54.7573333333333 17.7333333333333 54.56 17.6693333333333 54.3146666666667 17.936C54.1066666666667 18.16 39.0186666666667 37.0346666666667 37.4613333333333 39.0186666666667C37.2746666666667 39.2533333333333 37.312 39.2906666666667 37.6533333333333 39.184C37.888 39.1146666666667 45.088 37.312 53.6533333333333 35.1786666666667" />
     <glyph glyph-name="circle-plus"
-      unicode="&#xF125;"
+      unicode="&#xF129;"
       horiz-adv-x="128" d="M60.16 122.4373333333333C48.3626666666667 121.7066666666667 36.6826666666667 117.1786666666667 27.312 109.712C24.704 107.632 20.368 103.296 18.288 100.688C13.088 94.16 9.0293333333333 85.904 7.0666666666667 77.8346666666667C4.9173333333333 69.0346666666667 4.9173333333333 58.9653333333333 7.0666666666667 50.1653333333333C9.0293333333333 42.096 13.088 33.84 18.288 27.312C20.368 24.704 24.704 20.368 27.312 18.288C32.192 14.4 39.0506666666667 10.608 44.7253333333333 8.6666666666667C59.7493333333333 3.52 75.8186666666667 4.5333333333333 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M62.9333333333333 90.4693333333333C61.3706666666667 90.1493333333333 60.064 89.1253333333334 59.232 87.5786666666667C58.7893333333333 86.7466666666667 58.7733333333333 86.448 58.7093333333333 78.0373333333333L58.64 69.36L49.9626666666667 69.2906666666667C41.552 69.2266666666667 41.2533333333333 69.2106666666667 40.4213333333333 68.768C38.4693333333333 67.7226666666667 37.4826666666667 66.1226666666667 37.4826666666667 64C37.4826666666667 61.8773333333333 38.4693333333333 60.2773333333333 40.4213333333333 59.232C41.2533333333333 58.7893333333333 41.552 58.7733333333333 49.9626666666667 58.7093333333333L58.64 58.64L58.7093333333333 49.9626666666667C58.7733333333333 41.552 58.7893333333333 41.2533333333333 59.232 40.4213333333333C60.2773333333333 38.4693333333333 61.8773333333333 37.4826666666667 64 37.4826666666667C66.1226666666667 37.4826666666667 67.7226666666667 38.4693333333333 68.768 40.4213333333333C69.2106666666667 41.2533333333333 69.2266666666667 41.552 69.2906666666667 49.9626666666667L69.36 58.64L78.0373333333333 58.7093333333333C86.448 58.7733333333333 86.7466666666667 58.7893333333333 87.5786666666667 59.232C89.5306666666667 60.2773333333333 90.5173333333333 61.8773333333333 90.5173333333333 64C90.5173333333333 66.1226666666667 89.5306666666667 67.7226666666667 87.5786666666667 68.768C86.7466666666667 69.2106666666667 86.448 69.2266666666667 78.0373333333333 69.2906666666667L69.36 69.36L69.2906666666667 78.0373333333333C69.2266666666667 86.448 69.2106666666667 86.7466666666667 68.768 87.5786666666667C67.584 89.7866666666667 65.248 90.944 62.9333333333333 90.4693333333333" />
     <glyph glyph-name="circle-plus-1"
       unicode="&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x70;&#x6C;&#x75;&#x73;"
       horiz-adv-x="128" d="M60.16 122.4373333333333C48.3626666666667 121.7066666666667 36.6826666666667 117.1786666666667 27.312 109.712C24.704 107.632 20.368 103.296 18.288 100.688C13.088 94.16 9.0293333333333 85.904 7.0666666666667 77.8346666666667C4.9173333333333 69.0346666666667 4.9173333333333 58.9653333333333 7.0666666666667 50.1653333333333C9.0293333333333 42.096 13.088 33.84 18.288 27.312C20.368 24.704 24.704 20.368 27.312 18.288C32.192 14.4 39.0506666666667 10.608 44.7253333333333 8.6666666666667C59.7493333333333 3.52 75.8186666666667 4.5333333333333 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M62.9333333333333 90.4693333333333C61.3706666666667 90.1493333333333 60.064 89.1253333333334 59.232 87.5786666666667C58.7893333333333 86.7466666666667 58.7733333333333 86.448 58.7093333333333 78.0373333333333L58.64 69.36L49.9626666666667 69.2906666666667C41.552 69.2266666666667 41.2533333333333 69.2106666666667 40.4213333333333 68.768C38.4693333333333 67.7226666666667 37.4826666666667 66.1226666666667 37.4826666666667 64C37.4826666666667 61.8773333333333 38.4693333333333 60.2773333333333 40.4213333333333 59.232C41.2533333333333 58.7893333333333 41.552 58.7733333333333 49.9626666666667 58.7093333333333L58.64 58.64L58.7093333333333 49.9626666666667C58.7733333333333 41.552 58.7893333333333 41.2533333333333 59.232 40.4213333333333C60.2773333333333 38.4693333333333 61.8773333333333 37.4826666666667 64 37.4826666666667C66.1226666666667 37.4826666666667 67.7226666666667 38.4693333333333 68.768 40.4213333333333C69.2106666666667 41.2533333333333 69.2266666666667 41.552 69.2906666666667 49.9626666666667L69.36 58.64L78.0373333333333 58.7093333333333C86.448 58.7733333333333 86.7466666666667 58.7893333333333 87.5786666666667 59.232C89.5306666666667 60.2773333333333 90.5173333333333 61.8773333333333 90.5173333333333 64C90.5173333333333 66.1226666666667 89.5306666666667 67.7226666666667 87.5786666666667 68.768C86.7466666666667 69.2106666666667 86.448 69.2266666666667 78.0373333333333 69.2906666666667L69.36 69.36L69.2906666666667 78.0373333333333C69.2266666666667 86.448 69.2106666666667 86.7466666666667 68.768 87.5786666666667C67.584 89.7866666666667 65.248 90.944 62.9333333333333 90.4693333333333" />
-    <glyph glyph-name="more_horiz"
-      unicode="&#xF126;"
-      horiz-adv-x="128" d="M29.568 74.3413333333333C23.728 72.736 20.2453333333333 67.1093333333333 21.6693333333333 61.5786666666667C23.1466666666667 55.8666666666667 28.992 52.24 34.4426666666667 53.6586666666667C38.24 54.6453333333333 41.3546666666667 57.76 42.3413333333333 61.5573333333333C43.8933333333333 67.52 39.5786666666667 73.664 33.2853333333333 74.4426666666667C31.104 74.7146666666667 30.9013333333333 74.7093333333333 29.568 74.3413333333333M61.568 74.3413333333333C55.728 72.736 52.2453333333333 67.1093333333333 53.6693333333333 61.5786666666667C55.1466666666667 55.8666666666667 60.992 52.24 66.4426666666667 53.6586666666667C70.24 54.6453333333333 73.3546666666667 57.76 74.3413333333333 61.5573333333333C75.8933333333333 67.52 71.5786666666667 73.664 65.2853333333333 74.4426666666667C63.104 74.7146666666667 62.9013333333333 74.7093333333333 61.568 74.3413333333333M93.568 74.3413333333333C87.728 72.736 84.2453333333333 67.1093333333333 85.6693333333333 61.5786666666667C87.1466666666667 55.8666666666667 92.992 52.24 98.4426666666667 53.6586666666667C102.24 54.6453333333333 105.3546666666667 57.76 106.3413333333333 61.5573333333333C107.8933333333333 67.52 103.5786666666667 73.664 97.2853333333333 74.4426666666667C95.104 74.7146666666667 94.9013333333333 74.7093333333333 93.568 74.3413333333333" />
-    <glyph glyph-name="more_horiz-1"
-      unicode="&#x6D;&#x6F;&#x72;&#x65;&#x5F;&#x68;&#x6F;&#x72;&#x69;&#x7A;"
-      horiz-adv-x="128" d="M29.568 74.3413333333333C23.728 72.736 20.2453333333333 67.1093333333333 21.6693333333333 61.5786666666667C23.1466666666667 55.8666666666667 28.992 52.24 34.4426666666667 53.6586666666667C38.24 54.6453333333333 41.3546666666667 57.76 42.3413333333333 61.5573333333333C43.8933333333333 67.52 39.5786666666667 73.664 33.2853333333333 74.4426666666667C31.104 74.7146666666667 30.9013333333333 74.7093333333333 29.568 74.3413333333333M61.568 74.3413333333333C55.728 72.736 52.2453333333333 67.1093333333333 53.6693333333333 61.5786666666667C55.1466666666667 55.8666666666667 60.992 52.24 66.4426666666667 53.6586666666667C70.24 54.6453333333333 73.3546666666667 57.76 74.3413333333333 61.5573333333333C75.8933333333333 67.52 71.5786666666667 73.664 65.2853333333333 74.4426666666667C63.104 74.7146666666667 62.9013333333333 74.7093333333333 61.568 74.3413333333333M93.568 74.3413333333333C87.728 72.736 84.2453333333333 67.1093333333333 85.6693333333333 61.5786666666667C87.1466666666667 55.8666666666667 92.992 52.24 98.4426666666667 53.6586666666667C102.24 54.6453333333333 105.3546666666667 57.76 106.3413333333333 61.5573333333333C107.8933333333333 67.52 103.5786666666667 73.664 97.2853333333333 74.4426666666667C95.104 74.7146666666667 94.9013333333333 74.7093333333333 93.568 74.3413333333333" />
-    <glyph glyph-name="key"
-      unicode="&#xF127;"
-      horiz-adv-x="128" d="M110.9333333333333 122.4693333333334C110.5226666666667 122.384 109.8506666666667 122.144 109.44 121.936C109.0293333333333 121.728 97.8293333333333 110.704 84.5493333333333 97.44L60.4106666666667 73.3226666666667L59.1626666666667 74.1493333333334C55.0133333333333 76.9066666666667 49.8026666666667 78.8693333333334 44.8 79.5733333333333C42.4693333333333 79.8986666666667 37.5306666666667 79.8986666666667 35.2 79.5733333333333C19.9146666666667 77.4293333333334 7.904 65.4186666666667 5.76 50.1333333333333C5.2213333333333 46.2666666666667 5.4986666666667 40.832 6.432 37.0133333333334C9.1413333333333 25.9413333333333 17.424 16.7306666666667 28.16 12.8426666666667C32.0693333333333 11.424 35.5253333333333 10.8426666666667 40 10.8426666666667C45.968 10.8426666666667 50.736 11.984 55.8933333333333 14.6453333333333C65.7973333333333 19.7653333333333 72.6933333333333 29.488 74.24 40.5333333333333C74.7786666666667 44.4 74.5013333333333 49.8346666666667 73.568 53.6533333333333C72.6933333333333 57.2106666666667 70.8373333333333 61.4453333333333 68.816 64.5013333333333L67.9893333333333 65.744L75.3226666666667 73.0826666666667L82.656 80.416L89.0613333333333 74.048C92.5866666666667 70.5493333333333 95.8026666666667 67.504 96.2133333333333 67.2853333333333C97.2533333333333 66.7306666666667 100.0693333333333 66.7253333333333 101.12 67.28C102.3093333333333 67.9093333333333 121.4666666666667 87.1786666666667 122.0373333333333 88.32C122.6986666666667 89.648 122.6986666666667 91.6906666666667 122.032 93.0133333333333C121.712 93.648 119.424 96.112 115.2373333333333 100.32L108.928 106.6613333333333L112.5706666666667 110.3466666666667C116.7146666666667 114.5386666666667 117.184 115.248 117.184 117.3333333333333C117.184 120.6933333333333 114.2026666666667 123.1413333333333 110.9333333333333 122.4693333333334M105.6 94.8266666666667L109.7546666666667 90.6666666666667L104.2133333333333 85.12L98.672 79.5733333333333L94.4533333333333 83.7866666666667L90.24 87.9946666666667L95.7333333333333 93.4933333333333C98.752 96.512 101.2746666666667 98.9866666666667 101.3333333333333 98.9866666666667C101.392 98.9866666666667 103.312 97.1146666666667 105.6 94.8266666666667M45.6426666666667 68.7093333333333C52.9813333333333 66.8533333333333 59.136 61.6373333333334 62.0586666666667 54.7946666666667C63.536 51.3333333333333 63.888 49.52 63.888 45.3333333333333C63.888 42.272 63.8133333333333 41.408 63.4026666666667 39.7973333333333C61.52 32.3466666666667 56.3466666666667 26.2133333333333 49.4613333333333 23.2746666666667C46 21.7973333333333 44.1866666666667 21.4453333333333 40 21.4453333333333C36.9386666666667 21.4453333333333 36.0746666666667 21.52 34.464 21.9306666666667C27.0133333333333 23.8133333333333 20.88 28.9866666666667 17.9413333333333 35.872C16.464 39.3333333333333 16.112 41.1466666666667 16.112 45.3333333333333C16.112 48.3946666666667 16.1866666666667 49.2586666666667 16.5973333333333 50.8693333333333C17.7066666666667 55.248 19.9093333333333 59.1466666666667 23.0453333333333 62.288C26.7306666666667 65.9733333333333 30.8746666666667 68.0693333333333 36.6933333333333 69.1946666666667C36.9866666666667 69.2533333333333 38.7146666666667 69.2693333333333 40.5333333333333 69.232C43.0346666666667 69.184 44.2826666666667 69.056 45.6426666666667 68.7093333333333" />
-    <glyph glyph-name="key-1"
-      unicode="&#x6B;&#x65;&#x79;"
-      horiz-adv-x="128" d="M110.9333333333333 122.4693333333334C110.5226666666667 122.384 109.8506666666667 122.144 109.44 121.936C109.0293333333333 121.728 97.8293333333333 110.704 84.5493333333333 97.44L60.4106666666667 73.3226666666667L59.1626666666667 74.1493333333334C55.0133333333333 76.9066666666667 49.8026666666667 78.8693333333334 44.8 79.5733333333333C42.4693333333333 79.8986666666667 37.5306666666667 79.8986666666667 35.2 79.5733333333333C19.9146666666667 77.4293333333334 7.904 65.4186666666667 5.76 50.1333333333333C5.2213333333333 46.2666666666667 5.4986666666667 40.832 6.432 37.0133333333334C9.1413333333333 25.9413333333333 17.424 16.7306666666667 28.16 12.8426666666667C32.0693333333333 11.424 35.5253333333333 10.8426666666667 40 10.8426666666667C45.968 10.8426666666667 50.736 11.984 55.8933333333333 14.6453333333333C65.7973333333333 19.7653333333333 72.6933333333333 29.488 74.24 40.5333333333333C74.7786666666667 44.4 74.5013333333333 49.8346666666667 73.568 53.6533333333333C72.6933333333333 57.2106666666667 70.8373333333333 61.4453333333333 68.816 64.5013333333333L67.9893333333333 65.744L75.3226666666667 73.0826666666667L82.656 80.416L89.0613333333333 74.048C92.5866666666667 70.5493333333333 95.8026666666667 67.504 96.2133333333333 67.2853333333333C97.2533333333333 66.7306666666667 100.0693333333333 66.7253333333333 101.12 67.28C102.3093333333333 67.9093333333333 121.4666666666667 87.1786666666667 122.0373333333333 88.32C122.6986666666667 89.648 122.6986666666667 91.6906666666667 122.032 93.0133333333333C121.712 93.648 119.424 96.112 115.2373333333333 100.32L108.928 106.6613333333333L112.5706666666667 110.3466666666667C116.7146666666667 114.5386666666667 117.184 115.248 117.184 117.3333333333333C117.184 120.6933333333333 114.2026666666667 123.1413333333333 110.9333333333333 122.4693333333334M105.6 94.8266666666667L109.7546666666667 90.6666666666667L104.2133333333333 85.12L98.672 79.5733333333333L94.4533333333333 83.7866666666667L90.24 87.9946666666667L95.7333333333333 93.4933333333333C98.752 96.512 101.2746666666667 98.9866666666667 101.3333333333333 98.9866666666667C101.392 98.9866666666667 103.312 97.1146666666667 105.6 94.8266666666667M45.6426666666667 68.7093333333333C52.9813333333333 66.8533333333333 59.136 61.6373333333334 62.0586666666667 54.7946666666667C63.536 51.3333333333333 63.888 49.52 63.888 45.3333333333333C63.888 42.272 63.8133333333333 41.408 63.4026666666667 39.7973333333333C61.52 32.3466666666667 56.3466666666667 26.2133333333333 49.4613333333333 23.2746666666667C46 21.7973333333333 44.1866666666667 21.4453333333333 40 21.4453333333333C36.9386666666667 21.4453333333333 36.0746666666667 21.52 34.464 21.9306666666667C27.0133333333333 23.8133333333333 20.88 28.9866666666667 17.9413333333333 35.872C16.464 39.3333333333333 16.112 41.1466666666667 16.112 45.3333333333333C16.112 48.3946666666667 16.1866666666667 49.2586666666667 16.5973333333333 50.8693333333333C17.7066666666667 55.248 19.9093333333333 59.1466666666667 23.0453333333333 62.288C26.7306666666667 65.9733333333333 30.8746666666667 68.0693333333333 36.6933333333333 69.1946666666667C36.9866666666667 69.2533333333333 38.7146666666667 69.2693333333333 40.5333333333333 69.232C43.0346666666667 69.184 44.2826666666667 69.056 45.6426666666667 68.7093333333333" />
+    <glyph glyph-name="circle-divide"
+      unicode="&#xF12A;"
+      horiz-adv-x="128" d="M60.16 122.4373333333333C48.3626666666667 121.7066666666667 36.6826666666667 117.1786666666667 27.312 109.712C24.704 107.632 20.368 103.296 18.288 100.688C13.088 94.16 9.0293333333333 85.904 7.0666666666667 77.8346666666667C4.9173333333333 69.0346666666667 4.9173333333333 58.9653333333333 7.0666666666667 50.1653333333333C9.0293333333333 42.096 13.088 33.84 18.288 27.312C20.368 24.704 24.704 20.368 27.312 18.288C32.192 14.4 39.0506666666667 10.608 44.7253333333333 8.6666666666667C59.7493333333333 3.52 75.8186666666667 4.5333333333333 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M62.192 95.7706666666667C60.256 95.4773333333333 58.0053333333333 94.304 56.5173333333333 92.816C51.424 87.7226666666667 52.896 78.8906666666667 59.3493333333333 75.84C65.8773333333333 72.752 73.4613333333333 76.7413333333333 74.448 83.7866666666667C75.456 90.9706666666667 69.4293333333333 96.864 62.192 95.7706666666667M41.6 69.136C39.1306666666667 68.6293333333333 37.4826666666667 66.576 37.4826666666667 64C37.4826666666667 61.8773333333333 38.4693333333333 60.2773333333333 40.4213333333333 59.232L41.28 58.7733333333333L64 58.7733333333333L86.72 58.7733333333333L87.5786666666667 59.232C89.5306666666667 60.2773333333333 90.5173333333333 61.8773333333333 90.5173333333333 64C90.5173333333333 66.1226666666667 89.5306666666667 67.7226666666667 87.5786666666667 68.768L86.72 69.2266666666667L64.5333333333333 69.2586666666667C52.3306666666667 69.2746666666667 42.0106666666667 69.2213333333333 41.6 69.136M62.192 53.104C60.256 52.8106666666667 58.0053333333333 51.6373333333333 56.5173333333333 50.1493333333333C51.424 45.056 52.896 36.224 59.3493333333333 33.1733333333333C65.8773333333333 30.0853333333333 73.4613333333333 34.0746666666667 74.448 41.12C75.456 48.304 69.4293333333333 54.1973333333334 62.192 53.104" />
+    <glyph glyph-name="circle-divide-1"
+      unicode="&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x64;&#x69;&#x76;&#x69;&#x64;&#x65;"
+      horiz-adv-x="128" d="M60.16 122.4373333333333C48.3626666666667 121.7066666666667 36.6826666666667 117.1786666666667 27.312 109.712C24.704 107.632 20.368 103.296 18.288 100.688C13.088 94.16 9.0293333333333 85.904 7.0666666666667 77.8346666666667C4.9173333333333 69.0346666666667 4.9173333333333 58.9653333333333 7.0666666666667 50.1653333333333C9.0293333333333 42.096 13.088 33.84 18.288 27.312C20.368 24.704 24.704 20.368 27.312 18.288C32.192 14.4 39.0506666666667 10.608 44.7253333333333 8.6666666666667C59.7493333333333 3.52 75.8186666666667 4.5333333333333 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M62.192 95.7706666666667C60.256 95.4773333333333 58.0053333333333 94.304 56.5173333333333 92.816C51.424 87.7226666666667 52.896 78.8906666666667 59.3493333333333 75.84C65.8773333333333 72.752 73.4613333333333 76.7413333333333 74.448 83.7866666666667C75.456 90.9706666666667 69.4293333333333 96.864 62.192 95.7706666666667M41.6 69.136C39.1306666666667 68.6293333333333 37.4826666666667 66.576 37.4826666666667 64C37.4826666666667 61.8773333333333 38.4693333333333 60.2773333333333 40.4213333333333 59.232L41.28 58.7733333333333L64 58.7733333333333L86.72 58.7733333333333L87.5786666666667 59.232C89.5306666666667 60.2773333333333 90.5173333333333 61.8773333333333 90.5173333333333 64C90.5173333333333 66.1226666666667 89.5306666666667 67.7226666666667 87.5786666666667 68.768L86.72 69.2266666666667L64.5333333333333 69.2586666666667C52.3306666666667 69.2746666666667 42.0106666666667 69.2213333333333 41.6 69.136M62.192 53.104C60.256 52.8106666666667 58.0053333333333 51.6373333333333 56.5173333333333 50.1493333333333C51.424 45.056 52.896 36.224 59.3493333333333 33.1733333333333C65.8773333333333 30.0853333333333 73.4613333333333 34.0746666666667 74.448 41.12C75.456 48.304 69.4293333333333 54.1973333333334 62.192 53.104" />
     <glyph glyph-name="copy"
-      unicode="&#xF128;"
+      unicode="&#xF12B;"
       horiz-adv-x="128" d="M17.312 122.0373333333333C12.032 120.7413333333333 7.824 116.6133333333333 5.984 110.944L5.3333333333333 108.9226666666667L5.3333333333333 80L5.3333333333333 51.0773333333333L5.984 49.0666666666667C7.0186666666667 45.8826666666667 7.7226666666667 44.7413333333333 10.2346666666667 42.2293333333333C12.128 40.3306666666667 12.768 39.8346666666667 14.3093333333333 39.0773333333333C16.496 38 18.4426666666667 37.5573333333333 20.9706666666667 37.552C23.088 37.5466666666667 23.9466666666667 37.8613333333333 25.1093333333333 39.072C26.0586666666667 40.064 26.4533333333333 41.1413333333333 26.448 42.7146666666667C26.4426666666667 44.3573333333333 25.9573333333333 45.5093333333333 24.864 46.4693333333333C23.8933333333333 47.3173333333333 23.4133333333333 47.5146666666667 21.3333333333333 47.92C18.5973333333333 48.448 17.584 49.1146666666667 16.5493333333333 51.072L16 52.1173333333333L16.0106666666667 78.3786666666667C16.016 92.8213333333333 16.096 105.5786666666667 16.1866666666667 106.7306666666667C16.336 108.544 16.4373333333333 108.9333333333333 16.9866666666667 109.712C17.328 110.2026666666667 18.0853333333333 110.896 18.656 111.248L19.7013333333333 111.8933333333333L47.984 111.8933333333333L76.2666666666667 111.8933333333333L77.3333333333333 111.2373333333333C78.6613333333333 110.416 79.4826666666667 109.2533333333333 79.7973333333333 107.7333333333333C80.384 104.9173333333333 80.816 103.8026666666667 81.6426666666667 102.9973333333333C82.7093333333333 101.9573333333333 83.7546666666667 101.5466666666667 85.3333333333333 101.5466666666667C87.4666666666667 101.5466666666667 89.104 102.5386666666667 90.0746666666667 104.416C90.4586666666667 105.1733333333333 90.496 105.5306666666667 90.3946666666667 107.7226666666667C90.1973333333333 111.9893333333333 89.0293333333333 114.528 85.7813333333333 117.7813333333333C83.5786666666667 119.9786666666667 82.0853333333333 120.944 79.4026666666667 121.8986666666667L77.84 122.4533333333333L48.3626666666667 122.4373333333333C20.7093333333333 122.4213333333333 18.784 122.4 17.312 122.0373333333333M49.5146666666667 90.1226666666667C45.7013333333333 89.296 41.2373333333333 85.8186666666667 39.28 82.1546666666667C38.928 81.488 38.3413333333333 80.0373333333333 37.984 78.9333333333333L37.3333333333333 76.9226666666667L37.3333333333333 48L37.3333333333333 19.0773333333333L37.984 17.0666666666667C39.1146666666667 13.5733333333334 40.592 11.36 43.3333333333333 9.0293333333333C44.9813333333333 7.632 46.5386666666667 6.8053333333333 49.0666666666667 5.984L51.0773333333333 5.3333333333333L80 5.3333333333333L108.9226666666667 5.3333333333333L110.9333333333333 5.984C113.4613333333333 6.8053333333333 114.9546666666667 7.6 116.6133333333333 9.0186666666667C119.4293333333333 11.424 120.8906666666667 13.5946666666667 122.016 17.0666666666667L122.6666666666667 19.0773333333333L122.6666666666667 48L122.6666666666667 76.9226666666667L122.016 78.9333333333333C120.8746666666667 82.4533333333334 119.4826666666667 84.528 116.6133333333333 86.9813333333333C115.104 88.272 113.6 89.1093333333333 111.4026666666667 89.8986666666667L109.84 90.4533333333333L80.3626666666667 90.4373333333333C56.064 90.4213333333333 50.64 90.368 49.5146666666667 90.1226666666667M108.6933333333333 79.6C109.952 79.0293333333333 110.8373333333333 78.1973333333334 111.3973333333333 77.0613333333333L111.8933333333333 76.0533333333333L111.8933333333333 47.8773333333333L111.8933333333333 19.7013333333333L111.248 18.656C110.4 17.2853333333333 109.1146666666667 16.3946666666667 107.6853333333333 16.192C106.2186666666667 15.984 53.7813333333333 15.984 52.3146666666667 16.192C50.8853333333333 16.3946666666667 49.6 17.2853333333333 48.752 18.656L48.1066666666667 19.7013333333333L48.1066666666667 47.8773333333333L48.1066666666667 76.0533333333333L48.6026666666667 77.0613333333333C49.1626666666667 78.1973333333334 50.048 79.0293333333333 51.3066666666667 79.6C52.1173333333333 79.9733333333333 53.5146666666667 79.9893333333333 80 79.9893333333333C106.4853333333333 79.9893333333333 107.8826666666667 79.9733333333333 108.6933333333333 79.6" />
     <glyph glyph-name="copy-1"
       unicode="&#x63;&#x6F;&#x70;&#x79;"
       horiz-adv-x="128" d="M17.312 122.0373333333333C12.032 120.7413333333333 7.824 116.6133333333333 5.984 110.944L5.3333333333333 108.9226666666667L5.3333333333333 80L5.3333333333333 51.0773333333333L5.984 49.0666666666667C7.0186666666667 45.8826666666667 7.7226666666667 44.7413333333333 10.2346666666667 42.2293333333333C12.128 40.3306666666667 12.768 39.8346666666667 14.3093333333333 39.0773333333333C16.496 38 18.4426666666667 37.5573333333333 20.9706666666667 37.552C23.088 37.5466666666667 23.9466666666667 37.8613333333333 25.1093333333333 39.072C26.0586666666667 40.064 26.4533333333333 41.1413333333333 26.448 42.7146666666667C26.4426666666667 44.3573333333333 25.9573333333333 45.5093333333333 24.864 46.4693333333333C23.8933333333333 47.3173333333333 23.4133333333333 47.5146666666667 21.3333333333333 47.92C18.5973333333333 48.448 17.584 49.1146666666667 16.5493333333333 51.072L16 52.1173333333333L16.0106666666667 78.3786666666667C16.016 92.8213333333333 16.096 105.5786666666667 16.1866666666667 106.7306666666667C16.336 108.544 16.4373333333333 108.9333333333333 16.9866666666667 109.712C17.328 110.2026666666667 18.0853333333333 110.896 18.656 111.248L19.7013333333333 111.8933333333333L47.984 111.8933333333333L76.2666666666667 111.8933333333333L77.3333333333333 111.2373333333333C78.6613333333333 110.416 79.4826666666667 109.2533333333333 79.7973333333333 107.7333333333333C80.384 104.9173333333333 80.816 103.8026666666667 81.6426666666667 102.9973333333333C82.7093333333333 101.9573333333333 83.7546666666667 101.5466666666667 85.3333333333333 101.5466666666667C87.4666666666667 101.5466666666667 89.104 102.5386666666667 90.0746666666667 104.416C90.4586666666667 105.1733333333333 90.496 105.5306666666667 90.3946666666667 107.7226666666667C90.1973333333333 111.9893333333333 89.0293333333333 114.528 85.7813333333333 117.7813333333333C83.5786666666667 119.9786666666667 82.0853333333333 120.944 79.4026666666667 121.8986666666667L77.84 122.4533333333333L48.3626666666667 122.4373333333333C20.7093333333333 122.4213333333333 18.784 122.4 17.312 122.0373333333333M49.5146666666667 90.1226666666667C45.7013333333333 89.296 41.2373333333333 85.8186666666667 39.28 82.1546666666667C38.928 81.488 38.3413333333333 80.0373333333333 37.984 78.9333333333333L37.3333333333333 76.9226666666667L37.3333333333333 48L37.3333333333333 19.0773333333333L37.984 17.0666666666667C39.1146666666667 13.5733333333334 40.592 11.36 43.3333333333333 9.0293333333333C44.9813333333333 7.632 46.5386666666667 6.8053333333333 49.0666666666667 5.984L51.0773333333333 5.3333333333333L80 5.3333333333333L108.9226666666667 5.3333333333333L110.9333333333333 5.984C113.4613333333333 6.8053333333333 114.9546666666667 7.6 116.6133333333333 9.0186666666667C119.4293333333333 11.424 120.8906666666667 13.5946666666667 122.016 17.0666666666667L122.6666666666667 19.0773333333333L122.6666666666667 48L122.6666666666667 76.9226666666667L122.016 78.9333333333333C120.8746666666667 82.4533333333334 119.4826666666667 84.528 116.6133333333333 86.9813333333333C115.104 88.272 113.6 89.1093333333333 111.4026666666667 89.8986666666667L109.84 90.4533333333333L80.3626666666667 90.4373333333333C56.064 90.4213333333333 50.64 90.368 49.5146666666667 90.1226666666667M108.6933333333333 79.6C109.952 79.0293333333333 110.8373333333333 78.1973333333334 111.3973333333333 77.0613333333333L111.8933333333333 76.0533333333333L111.8933333333333 47.8773333333333L111.8933333333333 19.7013333333333L111.248 18.656C110.4 17.2853333333333 109.1146666666667 16.3946666666667 107.6853333333333 16.192C106.2186666666667 15.984 53.7813333333333 15.984 52.3146666666667 16.192C50.8853333333333 16.3946666666667 49.6 17.2853333333333 48.752 18.656L48.1066666666667 19.7013333333333L48.1066666666667 47.8773333333333L48.1066666666667 76.0533333333333L48.6026666666667 77.0613333333333C49.1626666666667 78.1973333333334 50.048 79.0293333333333 51.3066666666667 79.6C52.1173333333333 79.9733333333333 53.5146666666667 79.9893333333333 80 79.9893333333333C106.4853333333333 79.9893333333333 107.8826666666667 79.9733333333333 108.6933333333333 79.6" />
-    <glyph glyph-name="arrow-down"
-      unicode="&#xF129;"
-      horiz-adv-x="128" d="M61.9573333333333 106.1493333333333C60.9226666666667 105.7013333333333 59.7493333333333 104.5546666666667 59.184 103.44L58.6666666666667 102.416L58.6666666666667 70.992L58.6666666666667 39.5733333333334L46.7733333333333 51.424C32.208 65.936 29.6213333333333 68.4266666666667 28.688 68.816C27.808 69.184 26.0586666666667 69.2106666666667 24.928 68.8746666666667C23.7866666666667 68.528 22.544 67.4026666666667 21.9786666666667 66.2026666666667C21.4186666666667 65.008 21.3493333333333 63.184 21.8186666666667 62.0533333333333C22.56 60.2773333333333 60.2346666666667 22.5813333333333 62.0106666666667 21.84C62.9066666666667 21.4613333333333 65.0933333333333 21.4613333333333 65.9893333333333 21.84C67.7653333333333 22.5813333333333 105.44 60.2773333333333 106.1813333333333 62.0533333333333C106.6506666666667 63.184 106.5813333333333 65.008 106.0213333333333 66.2026666666667C105.136 68.0906666666667 103.4133333333333 69.12 101.1413333333333 69.12C98.9066666666667 69.12 99.632 69.7653333333333 81.2266666666667 51.424L69.3333333333333 39.5733333333334L69.3333333333333 70.992L69.3333333333333 102.416L68.8213333333333 103.4186666666667C67.8026666666667 105.4186666666667 66.144 106.4586666666667 64.0053333333333 106.4426666666667C63.2373333333333 106.4426666666667 62.32 106.3093333333333 61.9573333333333 106.1493333333333" />
-    <glyph glyph-name="arrow-down-1"
-      unicode="&#x61;&#x72;&#x72;&#x6F;&#x77;&#x2D;&#x64;&#x6F;&#x77;&#x6E;"
-      horiz-adv-x="128" d="M61.9573333333333 106.1493333333333C60.9226666666667 105.7013333333333 59.7493333333333 104.5546666666667 59.184 103.44L58.6666666666667 102.416L58.6666666666667 70.992L58.6666666666667 39.5733333333334L46.7733333333333 51.424C32.208 65.936 29.6213333333333 68.4266666666667 28.688 68.816C27.808 69.184 26.0586666666667 69.2106666666667 24.928 68.8746666666667C23.7866666666667 68.528 22.544 67.4026666666667 21.9786666666667 66.2026666666667C21.4186666666667 65.008 21.3493333333333 63.184 21.8186666666667 62.0533333333333C22.56 60.2773333333333 60.2346666666667 22.5813333333333 62.0106666666667 21.84C62.9066666666667 21.4613333333333 65.0933333333333 21.4613333333333 65.9893333333333 21.84C67.7653333333333 22.5813333333333 105.44 60.2773333333333 106.1813333333333 62.0533333333333C106.6506666666667 63.184 106.5813333333333 65.008 106.0213333333333 66.2026666666667C105.136 68.0906666666667 103.4133333333333 69.12 101.1413333333333 69.12C98.9066666666667 69.12 99.632 69.7653333333333 81.2266666666667 51.424L69.3333333333333 39.5733333333334L69.3333333333333 70.992L69.3333333333333 102.416L68.8213333333333 103.4186666666667C67.8026666666667 105.4186666666667 66.144 106.4586666666667 64.0053333333333 106.4426666666667C63.2373333333333 106.4426666666667 62.32 106.3093333333333 61.9573333333333 106.1493333333333" />
-    <glyph glyph-name="circle-pause"
-      unicode="&#xF12A;"
-      horiz-adv-x="128" d="M60.16 122.4373333333333C48.3626666666667 121.7066666666667 36.6826666666667 117.1786666666667 27.312 109.712C24.704 107.632 20.368 103.296 18.288 100.688C13.088 94.16 9.0293333333333 85.904 7.0666666666667 77.8346666666667C4.9173333333333 69.0346666666667 4.9173333333333 58.9653333333333 7.0666666666667 50.1653333333333C9.0293333333333 42.096 13.088 33.84 18.288 27.312C20.368 24.704 24.704 20.368 27.312 18.288C32.192 14.4 39.0506666666667 10.608 44.7253333333333 8.6666666666667C59.7493333333333 3.52 75.8186666666667 4.5333333333333 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M52.2666666666667 85.136C50.704 84.816 49.3973333333333 83.792 48.5653333333333 82.2453333333333C48.1066666666667 81.3866666666667 48.1066666666667 81.3813333333334 48.1066666666667 64C48.1066666666667 46.6186666666667 48.1066666666667 46.6133333333333 48.5653333333333 45.7546666666667C49.6106666666667 43.8026666666667 51.2106666666667 42.816 53.3333333333333 42.816C55.456 42.816 57.056 43.8026666666667 58.1013333333333 45.7546666666667C58.56 46.6133333333333 58.56 46.6186666666667 58.56 64C58.56 81.3813333333334 58.56 81.3866666666667 58.1013333333333 82.2453333333333C56.9173333333333 84.4533333333334 54.5813333333333 85.6106666666667 52.2666666666667 85.136M73.6 85.136C72.0373333333333 84.816 70.7306666666667 83.792 69.8986666666667 82.2453333333333C69.44 81.3866666666667 69.44 81.3813333333334 69.44 64C69.44 46.6186666666667 69.44 46.6133333333333 69.8986666666667 45.7546666666667C70.944 43.8026666666667 72.544 42.816 74.6666666666667 42.816C76.7893333333333 42.816 78.3893333333333 43.8026666666667 79.4346666666667 45.7546666666667C79.8933333333333 46.6133333333333 79.8933333333333 46.6186666666667 79.8933333333333 64C79.8933333333333 81.3813333333334 79.8933333333333 81.3866666666667 79.4346666666667 82.2453333333333C78.2506666666667 84.4533333333334 75.9146666666667 85.6106666666667 73.6 85.136" />
-    <glyph glyph-name="circle-pause-1"
-      unicode="&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x70;&#x61;&#x75;&#x73;&#x65;"
-      horiz-adv-x="128" d="M60.16 122.4373333333333C48.3626666666667 121.7066666666667 36.6826666666667 117.1786666666667 27.312 109.712C24.704 107.632 20.368 103.296 18.288 100.688C13.088 94.16 9.0293333333333 85.904 7.0666666666667 77.8346666666667C4.9173333333333 69.0346666666667 4.9173333333333 58.9653333333333 7.0666666666667 50.1653333333333C9.0293333333333 42.096 13.088 33.84 18.288 27.312C20.368 24.704 24.704 20.368 27.312 18.288C32.192 14.4 39.0506666666667 10.608 44.7253333333333 8.6666666666667C59.7493333333333 3.52 75.8186666666667 4.5333333333333 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M52.2666666666667 85.136C50.704 84.816 49.3973333333333 83.792 48.5653333333333 82.2453333333333C48.1066666666667 81.3866666666667 48.1066666666667 81.3813333333334 48.1066666666667 64C48.1066666666667 46.6186666666667 48.1066666666667 46.6133333333333 48.5653333333333 45.7546666666667C49.6106666666667 43.8026666666667 51.2106666666667 42.816 53.3333333333333 42.816C55.456 42.816 57.056 43.8026666666667 58.1013333333333 45.7546666666667C58.56 46.6133333333333 58.56 46.6186666666667 58.56 64C58.56 81.3813333333334 58.56 81.3866666666667 58.1013333333333 82.2453333333333C56.9173333333333 84.4533333333334 54.5813333333333 85.6106666666667 52.2666666666667 85.136M73.6 85.136C72.0373333333333 84.816 70.7306666666667 83.792 69.8986666666667 82.2453333333333C69.44 81.3866666666667 69.44 81.3813333333334 69.44 64C69.44 46.6186666666667 69.44 46.6133333333333 69.8986666666667 45.7546666666667C70.944 43.8026666666667 72.544 42.816 74.6666666666667 42.816C76.7893333333333 42.816 78.3893333333333 43.8026666666667 79.4346666666667 45.7546666666667C79.8933333333333 46.6133333333333 79.8933333333333 46.6186666666667 79.8933333333333 64C79.8933333333333 81.3813333333334 79.8933333333333 81.3866666666667 79.4346666666667 82.2453333333333C78.2506666666667 84.4533333333334 75.9146666666667 85.6106666666667 73.6 85.136" />
-    <glyph glyph-name="menu"
-      unicode="&#xF12B;"
-      horiz-adv-x="128" d="M30.8266666666667 101.136C18.1493333333333 100.9973333333333 18.8746666666667 101.0933333333333 17.408 99.3813333333334C16.5226666666667 98.3466666666667 16.2186666666667 97.4293333333333 16.2133333333333 95.8346666666667C16.2133333333333 93.8026666666667 17.264 92.1973333333333 19.248 91.1786666666667L20.2506666666667 90.6666666666667L64 90.6666666666667L107.7493333333333 90.6666666666667L108.752 91.1786666666667C110.7946666666667 92.224 111.7866666666667 93.7973333333333 111.7866666666667 96C111.7866666666667 98.1066666666667 110.9653333333333 99.52 109.12 100.5813333333333L108.2666666666667 101.0773333333333L75.2 101.168C57.0133333333333 101.216 37.0453333333333 101.2 30.8266666666667 101.136M30.8266666666667 69.136C18.1493333333333 68.9973333333333 18.8746666666667 69.0933333333333 17.408 67.3813333333334C16.5226666666667 66.3466666666667 16.2186666666667 65.4293333333334 16.2133333333333 63.8346666666667C16.2133333333333 61.8026666666667 17.264 60.1973333333334 19.248 59.1786666666667L20.2506666666667 58.6666666666667L64 58.6666666666667L107.7493333333333 58.6666666666667L108.752 59.1786666666667C110.7946666666667 60.224 111.7866666666667 61.7973333333333 111.7866666666667 64C111.7866666666667 66.1066666666667 110.9653333333333 67.52 109.12 68.5813333333333L108.2666666666667 69.0773333333333L75.2 69.168C57.0133333333333 69.216 37.0453333333333 69.2 30.8266666666667 69.136M30.8266666666667 37.136C18.1493333333333 36.9973333333333 18.8746666666667 37.0933333333333 17.408 35.3813333333333C16.5226666666667 34.3466666666667 16.2186666666667 33.4293333333333 16.2133333333333 31.8346666666667C16.2133333333333 29.8026666666667 17.264 28.1973333333333 19.248 27.1786666666667L20.2506666666667 26.6666666666667L64 26.6666666666667L107.7493333333333 26.6666666666667L108.752 27.1786666666667C110.7946666666667 28.224 111.7866666666667 29.7973333333333 111.7866666666667 32C111.7866666666667 34.1066666666667 110.9653333333333 35.52 109.12 36.5813333333334L108.2666666666667 37.0773333333333L75.2 37.168C57.0133333333333 37.216 37.0453333333333 37.2 30.8266666666667 37.136" />
-    <glyph glyph-name="menu-1"
-      unicode="&#x6D;&#x65;&#x6E;&#x75;"
-      horiz-adv-x="128" d="M30.8266666666667 101.136C18.1493333333333 100.9973333333333 18.8746666666667 101.0933333333333 17.408 99.3813333333334C16.5226666666667 98.3466666666667 16.2186666666667 97.4293333333333 16.2133333333333 95.8346666666667C16.2133333333333 93.8026666666667 17.264 92.1973333333333 19.248 91.1786666666667L20.2506666666667 90.6666666666667L64 90.6666666666667L107.7493333333333 90.6666666666667L108.752 91.1786666666667C110.7946666666667 92.224 111.7866666666667 93.7973333333333 111.7866666666667 96C111.7866666666667 98.1066666666667 110.9653333333333 99.52 109.12 100.5813333333333L108.2666666666667 101.0773333333333L75.2 101.168C57.0133333333333 101.216 37.0453333333333 101.2 30.8266666666667 101.136M30.8266666666667 69.136C18.1493333333333 68.9973333333333 18.8746666666667 69.0933333333333 17.408 67.3813333333334C16.5226666666667 66.3466666666667 16.2186666666667 65.4293333333334 16.2133333333333 63.8346666666667C16.2133333333333 61.8026666666667 17.264 60.1973333333334 19.248 59.1786666666667L20.2506666666667 58.6666666666667L64 58.6666666666667L107.7493333333333 58.6666666666667L108.752 59.1786666666667C110.7946666666667 60.224 111.7866666666667 61.7973333333333 111.7866666666667 64C111.7866666666667 66.1066666666667 110.9653333333333 67.52 109.12 68.5813333333333L108.2666666666667 69.0773333333333L75.2 69.168C57.0133333333333 69.216 37.0453333333333 69.2 30.8266666666667 69.136M30.8266666666667 37.136C18.1493333333333 36.9973333333333 18.8746666666667 37.0933333333333 17.408 35.3813333333333C16.5226666666667 34.3466666666667 16.2186666666667 33.4293333333333 16.2133333333333 31.8346666666667C16.2133333333333 29.8026666666667 17.264 28.1973333333333 19.248 27.1786666666667L20.2506666666667 26.6666666666667L64 26.6666666666667L107.7493333333333 26.6666666666667L108.752 27.1786666666667C110.7946666666667 28.224 111.7866666666667 29.7973333333333 111.7866666666667 32C111.7866666666667 34.1066666666667 110.9653333333333 35.52 109.12 36.5813333333334L108.2666666666667 37.0773333333333L75.2 37.168C57.0133333333333 37.216 37.0453333333333 37.2 30.8266666666667 37.136" />
-    <glyph glyph-name="lightbulb"
+    <glyph glyph-name="circle-help"
       unicode="&#xF12C;"
-      horiz-adv-x="128" d="M58.5493333333333 122.1226666666667C52.992 121.312 47.936 119.3333333333333 42.9653333333333 116.0266666666667C39.76 113.8933333333333 35.44 109.5733333333333 33.3066666666667 106.368C28.8426666666667 99.664 26.88 93.248 26.88 85.4133333333333C26.8853333333333 79.8826666666667 27.8133333333333 75.712 29.9893333333333 71.4666666666667C31.36 68.8 33.0346666666667 66.5066666666667 36.1493333333333 63.04C40.272 58.4533333333334 41.2053333333333 57.0026666666667 42.656 52.912C43.9306666666667 49.3386666666667 45.184 48.2293333333333 47.952 48.2186666666667C49.52 48.2133333333333 50.3893333333333 48.528 51.5146666666667 49.52C53.3386666666667 51.12 53.6053333333333 53.424 52.384 57.0773333333333C50.848 61.6693333333333 48.912 64.7146666666667 44.2506666666667 69.8666666666667C40.5386666666667 73.9733333333333 38.8 76.7573333333333 37.9306666666667 79.9733333333333C37.344 82.1493333333334 37.296 87.7173333333333 37.84 90.512C39.6053333333333 99.6053333333333 46.3733333333333 107.4186666666667 55.1466666666667 110.5066666666667C58.1546666666667 111.5626666666667 59.7333333333333 111.7866666666667 64.2026666666667 111.7866666666667C67.7226666666667 111.7866666666667 68.4533333333333 111.7226666666667 70.2133333333333 111.28C74.24 110.256 77.376 108.6933333333333 80.6346666666667 106.0853333333333C86.3573333333333 101.5093333333333 89.7386666666667 95.2533333333333 90.4693333333333 87.8933333333334C91.024 82.2986666666667 89.7653333333333 77.2906666666667 86.8533333333333 73.4933333333333C86.3146666666667 72.7893333333333 84.8746666666667 71.1093333333333 83.6533333333333 69.76C79.3226666666667 64.976 78.048 63.1733333333334 76.5653333333333 59.7333333333333C74.3626666666667 54.6293333333333 74.3413333333333 51.4026666666667 76.4853333333333 49.52C77.5786666666667 48.5546666666667 78.576 48.1706666666667 79.9946666666667 48.1546666666667C82.592 48.1333333333333 84.256 49.552 85.216 52.5973333333333C86.5333333333333 56.7733333333333 87.5253333333333 58.368 91.4026666666667 62.5066666666667C96.0053333333333 67.4186666666667 98.0213333333333 70.5973333333333 99.6213333333333 75.472C100.8693333333333 79.28 101.1946666666667 81.8506666666667 101.056 86.72C100.8906666666667 92.4746666666667 100.0053333333333 96.2133333333333 97.5893333333333 101.2853333333333C95.5413333333333 105.5946666666667 93.104 108.9493333333333 89.5626666666667 112.32C84.9653333333333 116.704 79.1253333333333 119.8933333333333 72.7626666666667 121.4986666666667C69.0933333333333 122.4266666666667 62.5653333333333 122.7146666666667 58.5493333333333 122.1226666666667M50.9866666666667 37.1413333333333C45.5946666666667 36.9973333333333 45.4186666666667 36.9546666666667 44.0746666666667 35.3813333333333C43.1893333333333 34.3466666666667 42.8853333333333 33.4293333333333 42.88 31.8346666666667C42.88 29.872 43.904 28.24 45.76 27.232L46.6133333333333 26.7733333333333L64 26.7733333333333L81.3866666666667 26.7733333333333L82.24 27.232C83.344 27.8293333333333 84.3733333333333 28.912 84.7893333333333 29.9146666666667C85.2426666666667 30.9973333333333 85.2106666666667 33.1733333333333 84.72 34.24C84.288 35.2 83.0346666666667 36.3946666666667 82.0426666666667 36.8C81.28 37.1146666666667 59.0986666666667 37.3546666666667 50.9866666666667 37.1413333333333M54.6133333333333 15.8133333333333C51.1146666666667 15.664 50.656 15.504 49.408 14.048C48.5226666666667 13.0133333333334 48.2186666666667 12.096 48.2133333333333 10.5013333333333C48.2133333333333 8.5386666666667 49.2373333333333 6.9066666666667 51.0933333333333 5.8986666666667C51.9413333333333 5.4453333333333 52.048 5.44 64 5.44C75.952 5.44 76.0586666666667 5.4453333333333 76.9066666666667 5.8986666666667C78.0106666666667 6.496 79.04 7.5786666666667 79.456 8.5813333333333C79.9093333333333 9.664 79.8773333333333 11.84 79.3866666666667 12.9066666666667C78.9546666666667 13.8666666666667 77.7013333333333 15.0613333333334 76.7093333333333 15.472C75.9466666666667 15.7813333333333 59.776 16.032 54.6133333333333 15.8133333333333" />
-    <glyph glyph-name="lightbulb-1"
-      unicode="&#x6C;&#x69;&#x67;&#x68;&#x74;&#x62;&#x75;&#x6C;&#x62;"
-      horiz-adv-x="128" d="M58.5493333333333 122.1226666666667C52.992 121.312 47.936 119.3333333333333 42.9653333333333 116.0266666666667C39.76 113.8933333333333 35.44 109.5733333333333 33.3066666666667 106.368C28.8426666666667 99.664 26.88 93.248 26.88 85.4133333333333C26.8853333333333 79.8826666666667 27.8133333333333 75.712 29.9893333333333 71.4666666666667C31.36 68.8 33.0346666666667 66.5066666666667 36.1493333333333 63.04C40.272 58.4533333333334 41.2053333333333 57.0026666666667 42.656 52.912C43.9306666666667 49.3386666666667 45.184 48.2293333333333 47.952 48.2186666666667C49.52 48.2133333333333 50.3893333333333 48.528 51.5146666666667 49.52C53.3386666666667 51.12 53.6053333333333 53.424 52.384 57.0773333333333C50.848 61.6693333333333 48.912 64.7146666666667 44.2506666666667 69.8666666666667C40.5386666666667 73.9733333333333 38.8 76.7573333333333 37.9306666666667 79.9733333333333C37.344 82.1493333333334 37.296 87.7173333333333 37.84 90.512C39.6053333333333 99.6053333333333 46.3733333333333 107.4186666666667 55.1466666666667 110.5066666666667C58.1546666666667 111.5626666666667 59.7333333333333 111.7866666666667 64.2026666666667 111.7866666666667C67.7226666666667 111.7866666666667 68.4533333333333 111.7226666666667 70.2133333333333 111.28C74.24 110.256 77.376 108.6933333333333 80.6346666666667 106.0853333333333C86.3573333333333 101.5093333333333 89.7386666666667 95.2533333333333 90.4693333333333 87.8933333333334C91.024 82.2986666666667 89.7653333333333 77.2906666666667 86.8533333333333 73.4933333333333C86.3146666666667 72.7893333333333 84.8746666666667 71.1093333333333 83.6533333333333 69.76C79.3226666666667 64.976 78.048 63.1733333333334 76.5653333333333 59.7333333333333C74.3626666666667 54.6293333333333 74.3413333333333 51.4026666666667 76.4853333333333 49.52C77.5786666666667 48.5546666666667 78.576 48.1706666666667 79.9946666666667 48.1546666666667C82.592 48.1333333333333 84.256 49.552 85.216 52.5973333333333C86.5333333333333 56.7733333333333 87.5253333333333 58.368 91.4026666666667 62.5066666666667C96.0053333333333 67.4186666666667 98.0213333333333 70.5973333333333 99.6213333333333 75.472C100.8693333333333 79.28 101.1946666666667 81.8506666666667 101.056 86.72C100.8906666666667 92.4746666666667 100.0053333333333 96.2133333333333 97.5893333333333 101.2853333333333C95.5413333333333 105.5946666666667 93.104 108.9493333333333 89.5626666666667 112.32C84.9653333333333 116.704 79.1253333333333 119.8933333333333 72.7626666666667 121.4986666666667C69.0933333333333 122.4266666666667 62.5653333333333 122.7146666666667 58.5493333333333 122.1226666666667M50.9866666666667 37.1413333333333C45.5946666666667 36.9973333333333 45.4186666666667 36.9546666666667 44.0746666666667 35.3813333333333C43.1893333333333 34.3466666666667 42.8853333333333 33.4293333333333 42.88 31.8346666666667C42.88 29.872 43.904 28.24 45.76 27.232L46.6133333333333 26.7733333333333L64 26.7733333333333L81.3866666666667 26.7733333333333L82.24 27.232C83.344 27.8293333333333 84.3733333333333 28.912 84.7893333333333 29.9146666666667C85.2426666666667 30.9973333333333 85.2106666666667 33.1733333333333 84.72 34.24C84.288 35.2 83.0346666666667 36.3946666666667 82.0426666666667 36.8C81.28 37.1146666666667 59.0986666666667 37.3546666666667 50.9866666666667 37.1413333333333M54.6133333333333 15.8133333333333C51.1146666666667 15.664 50.656 15.504 49.408 14.048C48.5226666666667 13.0133333333334 48.2186666666667 12.096 48.2133333333333 10.5013333333333C48.2133333333333 8.5386666666667 49.2373333333333 6.9066666666667 51.0933333333333 5.8986666666667C51.9413333333333 5.4453333333333 52.048 5.44 64 5.44C75.952 5.44 76.0586666666667 5.4453333333333 76.9066666666667 5.8986666666667C78.0106666666667 6.496 79.04 7.5786666666667 79.456 8.5813333333333C79.9093333333333 9.664 79.8773333333333 11.84 79.3866666666667 12.9066666666667C78.9546666666667 13.8666666666667 77.7013333333333 15.0613333333334 76.7093333333333 15.472C75.9466666666667 15.7813333333333 59.776 16.032 54.6133333333333 15.8133333333333" />
-    <glyph glyph-name="server-cog"
+      horiz-adv-x="128" d="M60.16 122.4373333333333C48.3626666666667 121.7066666666667 36.6826666666667 117.1786666666667 27.312 109.712C24.704 107.632 20.368 103.296 18.288 100.688C13.088 94.16 9.0293333333333 85.904 7.0666666666667 77.8346666666667C4.9173333333333 69.0346666666667 4.9173333333333 58.9653333333333 7.0666666666667 50.1653333333333C9.0293333333333 42.096 13.088 33.84 18.288 27.312C20.368 24.704 24.704 20.368 27.312 18.288C32.192 14.4 39.0506666666667 10.608 44.7253333333333 8.6666666666667C59.7493333333333 3.52 75.8186666666667 4.5333333333333 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M61.6533333333333 95.872C55.0453333333333 95.104 49.504 91.8666666666667 46.0266666666667 86.7466666666667C44.5066666666667 84.5066666666667 43.4453333333333 81.9946666666667 43.3493333333333 80.3946666666667C43.2373333333333 78.624 43.5253333333333 77.7386666666667 44.592 76.5226666666667C46.1493333333333 74.752 48.7573333333333 74.2826666666667 50.9173333333333 75.3813333333334C52.256 76.0533333333333 52.688 76.5866666666667 53.76 78.8746666666667C54.816 81.136 56.608 83.0666666666667 58.64 84.1333333333333C60.3786666666667 85.0453333333333 61.7066666666667 85.3653333333333 63.68 85.3493333333333C66.5013333333333 85.3226666666667 68.7146666666667 84.416 70.8373333333333 82.416C73.9466666666667 79.4773333333333 75.088 75.2853333333333 73.616 72.176C72.2346666666667 69.2533333333333 68.1493333333333 66.2453333333333 62.2346666666667 63.792C59.536 62.672 58.3786666666667 61.136 58.3733333333333 58.6666666666667C58.3626666666667 56.08 60.0106666666667 54.0853333333333 62.608 53.5466666666667C63.232 53.4186666666667 64.0106666666667 53.376 64.3466666666667 53.4506666666667C66.6346666666667 53.9626666666667 71.2106666666667 56.1333333333333 74.24 58.1493333333334C78.784 61.1626666666667 81.5093333333333 64.0693333333333 83.216 67.712C84.3413333333333 70.1226666666667 84.736 71.936 84.736 74.7733333333333C84.736 78.5653333333333 84.1173333333333 81.1893333333333 82.432 84.48C79.568 90.0853333333333 74.1973333333333 94.176 67.9893333333333 95.4773333333333C66.4586666666667 95.8026666666667 62.9226666666667 96.0213333333333 61.6533333333333 95.872M62.9333333333333 42.4693333333333C58.9013333333333 41.6426666666667 57.3813333333333 36.544 60.2933333333333 33.6266666666667C61.7706666666667 32.1546666666667 64.4 31.6746666666667 66.24 32.5493333333334C67.9946666666667 33.3813333333333 69.3333333333333 35.4506666666667 69.3333333333333 37.3333333333333C69.3333333333333 39.1786666666667 67.9893333333333 41.3013333333333 66.336 42.064C65.4133333333333 42.4906666666667 63.9093333333333 42.6666666666667 62.9333333333333 42.4693333333333" />
+    <glyph glyph-name="circle-help-1"
+      unicode="&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x68;&#x65;&#x6C;&#x70;"
+      horiz-adv-x="128" d="M60.16 122.4373333333333C48.3626666666667 121.7066666666667 36.6826666666667 117.1786666666667 27.312 109.712C24.704 107.632 20.368 103.296 18.288 100.688C13.088 94.16 9.0293333333333 85.904 7.0666666666667 77.8346666666667C4.9173333333333 69.0346666666667 4.9173333333333 58.9653333333333 7.0666666666667 50.1653333333333C9.0293333333333 42.096 13.088 33.84 18.288 27.312C20.368 24.704 24.704 20.368 27.312 18.288C32.192 14.4 39.0506666666667 10.608 44.7253333333333 8.6666666666667C59.7493333333333 3.52 75.8186666666667 4.5333333333333 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M61.6533333333333 95.872C55.0453333333333 95.104 49.504 91.8666666666667 46.0266666666667 86.7466666666667C44.5066666666667 84.5066666666667 43.4453333333333 81.9946666666667 43.3493333333333 80.3946666666667C43.2373333333333 78.624 43.5253333333333 77.7386666666667 44.592 76.5226666666667C46.1493333333333 74.752 48.7573333333333 74.2826666666667 50.9173333333333 75.3813333333334C52.256 76.0533333333333 52.688 76.5866666666667 53.76 78.8746666666667C54.816 81.136 56.608 83.0666666666667 58.64 84.1333333333333C60.3786666666667 85.0453333333333 61.7066666666667 85.3653333333333 63.68 85.3493333333333C66.5013333333333 85.3226666666667 68.7146666666667 84.416 70.8373333333333 82.416C73.9466666666667 79.4773333333333 75.088 75.2853333333333 73.616 72.176C72.2346666666667 69.2533333333333 68.1493333333333 66.2453333333333 62.2346666666667 63.792C59.536 62.672 58.3786666666667 61.136 58.3733333333333 58.6666666666667C58.3626666666667 56.08 60.0106666666667 54.0853333333333 62.608 53.5466666666667C63.232 53.4186666666667 64.0106666666667 53.376 64.3466666666667 53.4506666666667C66.6346666666667 53.9626666666667 71.2106666666667 56.1333333333333 74.24 58.1493333333334C78.784 61.1626666666667 81.5093333333333 64.0693333333333 83.216 67.712C84.3413333333333 70.1226666666667 84.736 71.936 84.736 74.7733333333333C84.736 78.5653333333333 84.1173333333333 81.1893333333333 82.432 84.48C79.568 90.0853333333333 74.1973333333333 94.176 67.9893333333333 95.4773333333333C66.4586666666667 95.8026666666667 62.9226666666667 96.0213333333333 61.6533333333333 95.872M62.9333333333333 42.4693333333333C58.9013333333333 41.6426666666667 57.3813333333333 36.544 60.2933333333333 33.6266666666667C61.7706666666667 32.1546666666667 64.4 31.6746666666667 66.24 32.5493333333334C67.9946666666667 33.3813333333333 69.3333333333333 35.4506666666667 69.3333333333333 37.3333333333333C69.3333333333333 39.1786666666667 67.9893333333333 41.3013333333333 66.336 42.064C65.4133333333333 42.4906666666667 63.9093333333333 42.6666666666667 62.9333333333333 42.4693333333333" />
+    <glyph glyph-name="circle-play"
       unicode="&#xF12D;"
-      horiz-adv-x="128" d="M19.4133333333333 122.464C15.8186666666667 122.0746666666667 12.864 120.6133333333333 10.1226666666667 117.8773333333334C7.9466666666667 115.696 6.7733333333333 113.7226666666667 5.9306666666667 110.816C5.44 109.1306666666667 5.44 109.056 5.44 96C5.44 82.944 5.44 82.8693333333334 5.9306666666667 81.184C6.7733333333333 78.2773333333333 7.9466666666667 76.304 10.1226666666667 74.1226666666667C12.32 71.9306666666667 14.3253333333333 70.7466666666667 17.184 69.952C19.3973333333333 69.3386666666667 24.8213333333333 69.232 26.0266666666667 69.7813333333333C30.2666666666667 71.712 30.2666666666667 77.7493333333333 26.0266666666667 79.5253333333333C25.5946666666667 79.7066666666667 24.128 79.8986666666667 22.5066666666667 79.984C20.304 80.1013333333333 19.5573333333333 80.224 18.88 80.5813333333333C17.7706666666667 81.1626666666667 16.9813333333333 82.0106666666667 16.4426666666667 83.2C16.0213333333333 84.128 16.0106666666667 84.544 16.0106666666667 96C16.0106666666667 107.456 16.0213333333333 107.872 16.4426666666667 108.8C17.0293333333333 110.0906666666667 17.8133333333333 110.8853333333333 19.0933333333333 111.4933333333333L20.16 111.9946666666667L64 111.9946666666667L107.84 111.9946666666667L108.9066666666667 111.4933333333333C110.1866666666667 110.8853333333333 110.9706666666667 110.0906666666667 111.5573333333333 108.8C111.9786666666667 107.872 111.9893333333333 107.456 111.9893333333333 96C111.9893333333333 84.544 111.9786666666667 84.128 111.5573333333333 83.2C111.0186666666667 82.0106666666667 110.2293333333333 81.1626666666667 109.12 80.5813333333333C108.4426666666667 80.224 107.696 80.1013333333333 105.4933333333333 79.984C103.872 79.8986666666667 102.4053333333333 79.7066666666667 101.9733333333333 79.5253333333333C99.248 78.384 98.016 75.1306666666667 99.28 72.416C99.8133333333333 71.264 100.7733333333333 70.3306666666667 101.9733333333333 69.7813333333333C103.1786666666667 69.232 108.6026666666667 69.3386666666667 110.816 69.952C113.6746666666667 70.7466666666667 115.68 71.9306666666667 117.8773333333333 74.1226666666667C120.0533333333334 76.304 121.2266666666667 78.2773333333333 122.0693333333333 81.184C122.56 82.8693333333334 122.56 82.944 122.56 96C122.56 109.056 122.56 109.1306666666667 122.0693333333333 110.816C121.2266666666667 113.7226666666667 120.0533333333334 115.696 117.8773333333333 117.8773333333334C115.7386666666667 120.0106666666667 113.8026666666667 121.1786666666667 110.928 122.064L109.3333333333333 122.5546666666667L65.0666666666667 122.5813333333333C40.72 122.5973333333334 20.176 122.544 19.4133333333333 122.464M30.9333333333333 101.136C26.9013333333333 100.3093333333333 25.3813333333333 95.2106666666667 28.2933333333333 92.2933333333333C29.7706666666667 90.8213333333333 32.4 90.3413333333333 34.24 91.216C35.9946666666667 92.048 37.3333333333333 94.1173333333333 37.3333333333333 96C37.3333333333333 97.8453333333333 35.9893333333333 99.968 34.336 100.7306666666667C33.4133333333333 101.1573333333333 31.9093333333333 101.3333333333333 30.9333333333333 101.136M53.104 88.3733333333333C50.9706666666667 87.2906666666667 49.8346666666667 84.9493333333333 50.3466666666667 82.672C50.4693333333333 82.112 50.6666666666667 81.4826666666667 50.7733333333333 81.28C50.9386666666667 80.976 50.7413333333333 80.6826666666667 49.7546666666667 79.76C49.0826666666667 79.1306666666667 48.0906666666667 78.096 47.5573333333333 77.4666666666667L46.5813333333333 76.32L45.4346666666667 76.5653333333333C42.208 77.2586666666667 39.36 75.1253333333334 39.0933333333333 71.8133333333333C38.9173333333333 69.5893333333333 40.16 67.4773333333333 42.1333333333333 66.6506666666667L42.8053333333333 66.3733333333333L42.832 63.4773333333333L42.8533333333333 60.5813333333333L42.176 60.2986666666667C38.5653333333333 58.784 37.9626666666667 53.6426666666667 41.1146666666667 51.2693333333333C42.6293333333333 50.128 45.1093333333333 49.9093333333333 46.72 50.7733333333333C47.024 50.9386666666667 47.3173333333333 50.7413333333333 48.24 49.7546666666667C48.8693333333333 49.0826666666667 49.904 48.0906666666667 50.5386666666667 47.552L51.6853333333333 46.576L51.424 45.488C50.6453333333333 42.2346666666667 53.1786666666667 39.0293333333333 56.5173333333333 39.0453333333333C58.5226666666667 39.0506666666667 60.384 40.1813333333333 61.2106666666667 41.888L61.6533333333333 42.8053333333333L64.5386666666667 42.832L67.4186666666667 42.8533333333333L67.7013333333333 42.176C69.216 38.5653333333333 74.3573333333333 37.9626666666667 76.7306666666667 41.1146666666667C77.872 42.6293333333333 78.0906666666667 45.1093333333333 77.2266666666667 46.72C77.0613333333333 47.024 77.2586666666667 47.3173333333333 78.2453333333333 48.24C78.9173333333333 48.8693333333333 79.9093333333333 49.8986666666667 80.4426666666667 50.528L81.4133333333333 51.6746666666667L82.5866666666667 51.4293333333333C85.8186666666667 50.7573333333333 88.64 52.88 88.9066666666667 56.1866666666667C89.0826666666667 58.4106666666667 87.84 60.5226666666667 85.8666666666667 61.3493333333333L85.1946666666667 61.6266666666667L85.168 64.5226666666667L85.1466666666667 67.4186666666667L85.824 67.7013333333333C89.4346666666667 69.216 90.0373333333333 74.3573333333333 86.8853333333333 76.7306666666667C85.3706666666667 77.872 82.8906666666667 78.0906666666667 81.28 77.2266666666667C80.976 77.0613333333333 80.6826666666667 77.2586666666667 79.76 78.2453333333333C79.1306666666667 78.9173333333334 78.1013333333333 79.9093333333333 77.472 80.4426666666667L76.3253333333333 81.4133333333333L76.5706666666667 82.5866666666667C77.072 85.0133333333333 76.0053333333333 87.2693333333333 73.8293333333333 88.3733333333333C71.136 89.7386666666667 67.7813333333333 88.56 66.6453333333333 85.8506666666667L66.3733333333333 85.1946666666667L63.4773333333333 85.168L60.5813333333333 85.1466666666667L60.2986666666667 85.824C59.152 88.56 55.808 89.744 53.104 88.3733333333333M66.5386666666667 74.4426666666667C67.0506666666667 74.32 68 73.9733333333333 68.64 73.6693333333333C69.8666666666667 73.0933333333333 72.4906666666667 70.784 72.8906666666667 69.936C73.0186666666667 69.664 73.44 68.768 73.8293333333333 67.9466666666667C75.0186666666667 65.4346666666667 74.96 62.08 73.68 59.3706666666667C73.0933333333333 58.1333333333333 70.7893333333333 55.5093333333333 69.936 55.1093333333333C69.664 54.9813333333333 68.768 54.56 67.9466666666667 54.1706666666667C65.4346666666667 52.9813333333333 62.08 53.04 59.3706666666667 54.32C58.1333333333333 54.9066666666667 55.5093333333333 57.2106666666667 55.1093333333333 58.064C54.9813333333333 58.336 54.56 59.232 54.1706666666667 60.0533333333333C52.9813333333333 62.5653333333333 53.04 65.92 54.32 68.6293333333333C54.9013333333333 69.856 57.2 72.48 58.064 72.896C59.696 73.6906666666667 61.1893333333333 74.3466666666667 61.6533333333333 74.4693333333333C62.4906666666667 74.6986666666667 65.504 74.6773333333333 66.5386666666667 74.4426666666667M19.4133333333333 58.4746666666667C15.7706666666667 58.048 12.8586666666667 56.608 10.1226666666667 53.8773333333333C7.9466666666667 51.696 6.7733333333333 49.7226666666667 5.9306666666667 46.816C5.44 45.1306666666667 5.44 45.056 5.44 32C5.44 18.944 5.44 18.8693333333333 5.9306666666667 17.184C6.7733333333333 14.2773333333333 7.9466666666667 12.304 10.1226666666667 10.1226666666667C12.304 7.9466666666667 14.2773333333333 6.7733333333333 17.184 5.9306666666667L18.88 5.44L64 5.44L109.12 5.44L110.816 5.9306666666667C113.7226666666667 6.7733333333333 115.696 7.9466666666667 117.8773333333333 10.1226666666667C120.0533333333334 12.304 121.2266666666667 14.2773333333333 122.0693333333333 17.184C122.56 18.8693333333333 122.56 18.944 122.56 32C122.56 45.056 122.56 45.1306666666667 122.0693333333333 46.816C121.2266666666667 49.7226666666667 120.0533333333334 51.696 117.8773333333333 53.8773333333333C115.68 56.0693333333333 113.6746666666667 57.2533333333333 110.816 58.048C108.6026666666667 58.6613333333334 103.1786666666667 58.768 101.9733333333333 58.2186666666667C97.7333333333333 56.288 97.7333333333333 50.2506666666667 101.9733333333333 48.4746666666667C102.4053333333333 48.2933333333333 103.872 48.1013333333333 105.4933333333333 48.016C107.696 47.8986666666667 108.4426666666667 47.776 109.12 47.4186666666667C110.2293333333333 46.8373333333333 111.0186666666667 45.9893333333333 111.5573333333333 44.8C111.9786666666667 43.872 111.9893333333333 43.456 111.9893333333333 32C111.9893333333333 20.544 111.9786666666667 20.128 111.5573333333333 19.2C110.9706666666667 17.9093333333333 110.1866666666667 17.1146666666667 108.9066666666667 16.5066666666667L107.84 16.0053333333333L64 16.0053333333333L20.16 16.0053333333333L19.0933333333333 16.5066666666667C17.8133333333333 17.1146666666667 17.0293333333333 17.9093333333333 16.4426666666667 19.2C16.0213333333333 20.128 16.0106666666667 20.544 16.0106666666667 32C16.0106666666667 43.456 16.0213333333333 43.872 16.4426666666667 44.8C16.9813333333333 45.9893333333333 17.7706666666667 46.8373333333333 18.88 47.4186666666667C19.5573333333333 47.776 20.304 47.8986666666667 22.5066666666667 48.016C24.128 48.1013333333333 25.5946666666667 48.2933333333333 26.0266666666667 48.4746666666667C30.2613333333333 50.2506666666667 30.256 56.4106666666667 26.0266666666667 58.192C25.1573333333333 58.56 21.488 58.7146666666667 19.4133333333333 58.4746666666667M30.9333333333333 37.136C26.9013333333333 36.3093333333333 25.3813333333333 31.2106666666667 28.2933333333333 28.2933333333333C29.7706666666667 26.8213333333333 32.4 26.3413333333333 34.24 27.216C35.9946666666667 28.048 37.3333333333333 30.1173333333333 37.3333333333333 32C37.3333333333333 33.8453333333333 35.9893333333333 35.968 34.336 36.7306666666667C33.4133333333333 37.1573333333333 31.9093333333333 37.3333333333333 30.9333333333333 37.136" />
-    <glyph glyph-name="server-cog-1"
-      unicode="&#x73;&#x65;&#x72;&#x76;&#x65;&#x72;&#x2D;&#x63;&#x6F;&#x67;"
-      horiz-adv-x="128" d="M19.4133333333333 122.464C15.8186666666667 122.0746666666667 12.864 120.6133333333333 10.1226666666667 117.8773333333334C7.9466666666667 115.696 6.7733333333333 113.7226666666667 5.9306666666667 110.816C5.44 109.1306666666667 5.44 109.056 5.44 96C5.44 82.944 5.44 82.8693333333334 5.9306666666667 81.184C6.7733333333333 78.2773333333333 7.9466666666667 76.304 10.1226666666667 74.1226666666667C12.32 71.9306666666667 14.3253333333333 70.7466666666667 17.184 69.952C19.3973333333333 69.3386666666667 24.8213333333333 69.232 26.0266666666667 69.7813333333333C30.2666666666667 71.712 30.2666666666667 77.7493333333333 26.0266666666667 79.5253333333333C25.5946666666667 79.7066666666667 24.128 79.8986666666667 22.5066666666667 79.984C20.304 80.1013333333333 19.5573333333333 80.224 18.88 80.5813333333333C17.7706666666667 81.1626666666667 16.9813333333333 82.0106666666667 16.4426666666667 83.2C16.0213333333333 84.128 16.0106666666667 84.544 16.0106666666667 96C16.0106666666667 107.456 16.0213333333333 107.872 16.4426666666667 108.8C17.0293333333333 110.0906666666667 17.8133333333333 110.8853333333333 19.0933333333333 111.4933333333333L20.16 111.9946666666667L64 111.9946666666667L107.84 111.9946666666667L108.9066666666667 111.4933333333333C110.1866666666667 110.8853333333333 110.9706666666667 110.0906666666667 111.5573333333333 108.8C111.9786666666667 107.872 111.9893333333333 107.456 111.9893333333333 96C111.9893333333333 84.544 111.9786666666667 84.128 111.5573333333333 83.2C111.0186666666667 82.0106666666667 110.2293333333333 81.1626666666667 109.12 80.5813333333333C108.4426666666667 80.224 107.696 80.1013333333333 105.4933333333333 79.984C103.872 79.8986666666667 102.4053333333333 79.7066666666667 101.9733333333333 79.5253333333333C99.248 78.384 98.016 75.1306666666667 99.28 72.416C99.8133333333333 71.264 100.7733333333333 70.3306666666667 101.9733333333333 69.7813333333333C103.1786666666667 69.232 108.6026666666667 69.3386666666667 110.816 69.952C113.6746666666667 70.7466666666667 115.68 71.9306666666667 117.8773333333333 74.1226666666667C120.0533333333334 76.304 121.2266666666667 78.2773333333333 122.0693333333333 81.184C122.56 82.8693333333334 122.56 82.944 122.56 96C122.56 109.056 122.56 109.1306666666667 122.0693333333333 110.816C121.2266666666667 113.7226666666667 120.0533333333334 115.696 117.8773333333333 117.8773333333334C115.7386666666667 120.0106666666667 113.8026666666667 121.1786666666667 110.928 122.064L109.3333333333333 122.5546666666667L65.0666666666667 122.5813333333333C40.72 122.5973333333334 20.176 122.544 19.4133333333333 122.464M30.9333333333333 101.136C26.9013333333333 100.3093333333333 25.3813333333333 95.2106666666667 28.2933333333333 92.2933333333333C29.7706666666667 90.8213333333333 32.4 90.3413333333333 34.24 91.216C35.9946666666667 92.048 37.3333333333333 94.1173333333333 37.3333333333333 96C37.3333333333333 97.8453333333333 35.9893333333333 99.968 34.336 100.7306666666667C33.4133333333333 101.1573333333333 31.9093333333333 101.3333333333333 30.9333333333333 101.136M53.104 88.3733333333333C50.9706666666667 87.2906666666667 49.8346666666667 84.9493333333333 50.3466666666667 82.672C50.4693333333333 82.112 50.6666666666667 81.4826666666667 50.7733333333333 81.28C50.9386666666667 80.976 50.7413333333333 80.6826666666667 49.7546666666667 79.76C49.0826666666667 79.1306666666667 48.0906666666667 78.096 47.5573333333333 77.4666666666667L46.5813333333333 76.32L45.4346666666667 76.5653333333333C42.208 77.2586666666667 39.36 75.1253333333334 39.0933333333333 71.8133333333333C38.9173333333333 69.5893333333333 40.16 67.4773333333333 42.1333333333333 66.6506666666667L42.8053333333333 66.3733333333333L42.832 63.4773333333333L42.8533333333333 60.5813333333333L42.176 60.2986666666667C38.5653333333333 58.784 37.9626666666667 53.6426666666667 41.1146666666667 51.2693333333333C42.6293333333333 50.128 45.1093333333333 49.9093333333333 46.72 50.7733333333333C47.024 50.9386666666667 47.3173333333333 50.7413333333333 48.24 49.7546666666667C48.8693333333333 49.0826666666667 49.904 48.0906666666667 50.5386666666667 47.552L51.6853333333333 46.576L51.424 45.488C50.6453333333333 42.2346666666667 53.1786666666667 39.0293333333333 56.5173333333333 39.0453333333333C58.5226666666667 39.0506666666667 60.384 40.1813333333333 61.2106666666667 41.888L61.6533333333333 42.8053333333333L64.5386666666667 42.832L67.4186666666667 42.8533333333333L67.7013333333333 42.176C69.216 38.5653333333333 74.3573333333333 37.9626666666667 76.7306666666667 41.1146666666667C77.872 42.6293333333333 78.0906666666667 45.1093333333333 77.2266666666667 46.72C77.0613333333333 47.024 77.2586666666667 47.3173333333333 78.2453333333333 48.24C78.9173333333333 48.8693333333333 79.9093333333333 49.8986666666667 80.4426666666667 50.528L81.4133333333333 51.6746666666667L82.5866666666667 51.4293333333333C85.8186666666667 50.7573333333333 88.64 52.88 88.9066666666667 56.1866666666667C89.0826666666667 58.4106666666667 87.84 60.5226666666667 85.8666666666667 61.3493333333333L85.1946666666667 61.6266666666667L85.168 64.5226666666667L85.1466666666667 67.4186666666667L85.824 67.7013333333333C89.4346666666667 69.216 90.0373333333333 74.3573333333333 86.8853333333333 76.7306666666667C85.3706666666667 77.872 82.8906666666667 78.0906666666667 81.28 77.2266666666667C80.976 77.0613333333333 80.6826666666667 77.2586666666667 79.76 78.2453333333333C79.1306666666667 78.9173333333334 78.1013333333333 79.9093333333333 77.472 80.4426666666667L76.3253333333333 81.4133333333333L76.5706666666667 82.5866666666667C77.072 85.0133333333333 76.0053333333333 87.2693333333333 73.8293333333333 88.3733333333333C71.136 89.7386666666667 67.7813333333333 88.56 66.6453333333333 85.8506666666667L66.3733333333333 85.1946666666667L63.4773333333333 85.168L60.5813333333333 85.1466666666667L60.2986666666667 85.824C59.152 88.56 55.808 89.744 53.104 88.3733333333333M66.5386666666667 74.4426666666667C67.0506666666667 74.32 68 73.9733333333333 68.64 73.6693333333333C69.8666666666667 73.0933333333333 72.4906666666667 70.784 72.8906666666667 69.936C73.0186666666667 69.664 73.44 68.768 73.8293333333333 67.9466666666667C75.0186666666667 65.4346666666667 74.96 62.08 73.68 59.3706666666667C73.0933333333333 58.1333333333333 70.7893333333333 55.5093333333333 69.936 55.1093333333333C69.664 54.9813333333333 68.768 54.56 67.9466666666667 54.1706666666667C65.4346666666667 52.9813333333333 62.08 53.04 59.3706666666667 54.32C58.1333333333333 54.9066666666667 55.5093333333333 57.2106666666667 55.1093333333333 58.064C54.9813333333333 58.336 54.56 59.232 54.1706666666667 60.0533333333333C52.9813333333333 62.5653333333333 53.04 65.92 54.32 68.6293333333333C54.9013333333333 69.856 57.2 72.48 58.064 72.896C59.696 73.6906666666667 61.1893333333333 74.3466666666667 61.6533333333333 74.4693333333333C62.4906666666667 74.6986666666667 65.504 74.6773333333333 66.5386666666667 74.4426666666667M19.4133333333333 58.4746666666667C15.7706666666667 58.048 12.8586666666667 56.608 10.1226666666667 53.8773333333333C7.9466666666667 51.696 6.7733333333333 49.7226666666667 5.9306666666667 46.816C5.44 45.1306666666667 5.44 45.056 5.44 32C5.44 18.944 5.44 18.8693333333333 5.9306666666667 17.184C6.7733333333333 14.2773333333333 7.9466666666667 12.304 10.1226666666667 10.1226666666667C12.304 7.9466666666667 14.2773333333333 6.7733333333333 17.184 5.9306666666667L18.88 5.44L64 5.44L109.12 5.44L110.816 5.9306666666667C113.7226666666667 6.7733333333333 115.696 7.9466666666667 117.8773333333333 10.1226666666667C120.0533333333334 12.304 121.2266666666667 14.2773333333333 122.0693333333333 17.184C122.56 18.8693333333333 122.56 18.944 122.56 32C122.56 45.056 122.56 45.1306666666667 122.0693333333333 46.816C121.2266666666667 49.7226666666667 120.0533333333334 51.696 117.8773333333333 53.8773333333333C115.68 56.0693333333333 113.6746666666667 57.2533333333333 110.816 58.048C108.6026666666667 58.6613333333334 103.1786666666667 58.768 101.9733333333333 58.2186666666667C97.7333333333333 56.288 97.7333333333333 50.2506666666667 101.9733333333333 48.4746666666667C102.4053333333333 48.2933333333333 103.872 48.1013333333333 105.4933333333333 48.016C107.696 47.8986666666667 108.4426666666667 47.776 109.12 47.4186666666667C110.2293333333333 46.8373333333333 111.0186666666667 45.9893333333333 111.5573333333333 44.8C111.9786666666667 43.872 111.9893333333333 43.456 111.9893333333333 32C111.9893333333333 20.544 111.9786666666667 20.128 111.5573333333333 19.2C110.9706666666667 17.9093333333333 110.1866666666667 17.1146666666667 108.9066666666667 16.5066666666667L107.84 16.0053333333333L64 16.0053333333333L20.16 16.0053333333333L19.0933333333333 16.5066666666667C17.8133333333333 17.1146666666667 17.0293333333333 17.9093333333333 16.4426666666667 19.2C16.0213333333333 20.128 16.0106666666667 20.544 16.0106666666667 32C16.0106666666667 43.456 16.0213333333333 43.872 16.4426666666667 44.8C16.9813333333333 45.9893333333333 17.7706666666667 46.8373333333333 18.88 47.4186666666667C19.5573333333333 47.776 20.304 47.8986666666667 22.5066666666667 48.016C24.128 48.1013333333333 25.5946666666667 48.2933333333333 26.0266666666667 48.4746666666667C30.2613333333333 50.2506666666667 30.256 56.4106666666667 26.0266666666667 58.192C25.1573333333333 58.56 21.488 58.7146666666667 19.4133333333333 58.4746666666667M30.9333333333333 37.136C26.9013333333333 36.3093333333333 25.3813333333333 31.2106666666667 28.2933333333333 28.2933333333333C29.7706666666667 26.8213333333333 32.4 26.3413333333333 34.24 27.216C35.9946666666667 28.048 37.3333333333333 30.1173333333333 37.3333333333333 32C37.3333333333333 33.8453333333333 35.9893333333333 35.968 34.336 36.7306666666667C33.4133333333333 37.1573333333333 31.9093333333333 37.3333333333333 30.9333333333333 37.136" />
-    <glyph glyph-name="save"
+      horiz-adv-x="128" d="M60.16 122.4373333333333C52.3573333333333 121.952 45.3546666666667 120.064 38.08 116.48C31.904 113.44 27.4186666666667 110.2293333333333 22.5973333333333 105.4026666666667C17.7706666666667 100.5813333333333 14.56 96.096 11.52 89.92C7.824 82.4213333333333 6.0533333333333 75.7013333333333 5.5466666666667 67.2693333333333C4.9333333333333 57.1413333333333 6.928 47.392 11.52 38.08C14.56 31.904 17.7706666666667 27.4186666666667 22.5973333333333 22.5973333333333C27.4133333333333 17.7813333333333 31.888 14.576 38.08 11.5093333333333C46.4693333333333 7.36 54.464 5.5093333333333 64 5.5093333333333C73.536 5.5093333333333 81.5306666666667 7.36 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M52.2666666666667 90.4693333333333C50.704 90.1493333333333 49.3973333333333 89.1253333333334 48.5653333333333 87.5786666666667L48.1066666666667 86.72L48.1066666666667 64L48.1066666666667 41.28L48.5653333333333 40.4213333333333C49.6053333333333 38.4853333333333 51.312 37.4506666666667 53.44 37.4666666666667C54.24 37.472 54.9973333333333 37.616 55.456 37.856C56.736 38.528 88.688 59.8986666666667 89.1733333333333 60.416C90.96 62.3093333333333 90.9653333333333 65.728 89.1786666666667 67.584C88.6933333333333 68.0906666666667 56.688 89.504 55.5626666666667 90.08C54.7626666666667 90.4853333333333 53.232 90.6666666666667 52.2666666666667 90.4693333333333M67.3866666666667 69.6533333333333C71.968 66.6026666666667 75.7226666666667 64.0586666666667 75.7226666666667 64C75.7226666666667 63.8933333333334 59.216 52.864 58.8586666666667 52.7306666666667C58.7466666666667 52.688 58.6666666666667 57.408 58.6666666666667 64C58.6666666666667 70.592 58.7466666666667 75.312 58.8586666666667 75.2693333333333C58.9653333333333 75.232 62.8 72.704 67.3866666666667 69.6533333333333" />
+    <glyph glyph-name="circle-play-1"
+      unicode="&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x70;&#x6C;&#x61;&#x79;"
+      horiz-adv-x="128" d="M60.16 122.4373333333333C52.3573333333333 121.952 45.3546666666667 120.064 38.08 116.48C31.904 113.44 27.4186666666667 110.2293333333333 22.5973333333333 105.4026666666667C17.7706666666667 100.5813333333333 14.56 96.096 11.52 89.92C7.824 82.4213333333333 6.0533333333333 75.7013333333333 5.5466666666667 67.2693333333333C4.9333333333333 57.1413333333333 6.928 47.392 11.52 38.08C14.56 31.904 17.7706666666667 27.4186666666667 22.5973333333333 22.5973333333333C27.4133333333333 17.7813333333333 31.888 14.576 38.08 11.5093333333333C46.4693333333333 7.36 54.464 5.5093333333333 64 5.5093333333333C73.536 5.5093333333333 81.5306666666667 7.36 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M52.2666666666667 90.4693333333333C50.704 90.1493333333333 49.3973333333333 89.1253333333334 48.5653333333333 87.5786666666667L48.1066666666667 86.72L48.1066666666667 64L48.1066666666667 41.28L48.5653333333333 40.4213333333333C49.6053333333333 38.4853333333333 51.312 37.4506666666667 53.44 37.4666666666667C54.24 37.472 54.9973333333333 37.616 55.456 37.856C56.736 38.528 88.688 59.8986666666667 89.1733333333333 60.416C90.96 62.3093333333333 90.9653333333333 65.728 89.1786666666667 67.584C88.6933333333333 68.0906666666667 56.688 89.504 55.5626666666667 90.08C54.7626666666667 90.4853333333333 53.232 90.6666666666667 52.2666666666667 90.4693333333333M67.3866666666667 69.6533333333333C71.968 66.6026666666667 75.7226666666667 64.0586666666667 75.7226666666667 64C75.7226666666667 63.8933333333334 59.216 52.864 58.8586666666667 52.7306666666667C58.7466666666667 52.688 58.6666666666667 57.408 58.6666666666667 64C58.6666666666667 70.592 58.7466666666667 75.312 58.8586666666667 75.2693333333333C58.9653333333333 75.232 62.8 72.704 67.3866666666667 69.6533333333333" />
+    <glyph glyph-name="receipt-text"
       unicode="&#xF12E;"
-      horiz-adv-x="128" d="M34.9866666666667 117.1413333333333C23.296 117.0133333333333 23.1306666666667 117.008 21.76 116.5173333333334C18.9066666666667 115.4986666666667 16.3626666666667 113.7013333333334 14.288 111.248C12.96 109.6746666666667 12.128 108.0906666666667 11.3173333333333 105.6L10.6666666666667 103.5893333333333L10.6666666666667 64L10.6666666666667 24.4106666666667L11.3173333333333 22.4C12.448 18.9066666666667 13.9253333333333 16.6933333333333 16.6666666666667 14.3626666666667C18.3146666666667 12.9653333333333 19.872 12.1386666666667 22.4 11.3173333333333L24.4106666666667 10.6666666666667L64 10.6666666666667L103.5893333333333 10.6666666666667L105.6 11.3173333333333C108.128 12.1386666666667 109.6213333333333 12.9333333333333 111.28 14.352C114.096 16.7573333333333 115.5573333333333 18.928 116.6826666666667 22.4L117.3333333333333 24.4106666666667L117.328 55.3493333333333C117.3226666666667 85.2266666666667 117.312 86.3253333333333 116.9226666666667 87.1786666666667C116.6826666666667 87.7013333333333 115.0773333333334 89.5893333333333 113.008 91.7653333333333C107.4613333333333 97.616 89.168 115.664 88.016 116.4266666666667L86.9653333333333 117.12L74.0426666666667 117.12C66.9333333333333 117.12 57.904 117.1573333333333 53.9733333333333 117.1946666666667C50.0426666666667 117.2373333333334 41.4986666666667 117.216 34.9866666666667 117.1413333333333M32.0373333333333 95.3066666666667C32.112 84.1653333333333 32.1226666666667 83.9306666666667 32.5706666666667 83.0933333333333C33.1466666666667 82.0213333333333 34.1866666666667 81.0346666666667 35.3493333333333 80.448C36.2453333333333 80 36.2933333333333 80 58.6666666666667 80L81.0826666666667 80L82.0853333333333 80.512C84.144 81.568 85.1253333333333 83.136 85.1146666666667 85.3813333333334C85.1093333333333 87.0293333333333 84.624 88.176 83.5146666666667 89.1466666666667C81.904 90.5653333333333 83.104 90.4853333333333 61.9306666666667 90.6133333333334L42.6666666666667 90.7306666666667L42.6666666666667 98.6986666666667L42.6666666666667 106.6666666666667L62.88 106.6666666666667L83.0933333333333 106.6666666666667L94.8906666666667 94.8693333333334L106.688 83.072L106.624 54.176L106.56 25.28L106.0586666666667 24.2666666666667C105.7866666666667 23.7066666666667 105.216 22.9653333333333 104.7946666666667 22.6186666666667C103.52 21.568 102.4693333333333 21.3333333333333 99.072 21.3333333333333L96.0373333333333 21.3333333333333L95.9626666666667 40.6933333333333C95.8933333333333 60.0373333333333 95.8933333333333 60.0533333333333 95.4293333333333 60.9066666666667C94.912 61.872 94.1066666666667 62.6826666666667 93.0133333333333 63.3386666666667L92.2666666666667 63.7866666666667L64 63.7866666666667L35.7333333333333 63.7866666666667L34.9866666666667 63.3386666666667C33.8933333333333 62.6826666666667 33.088 61.872 32.5706666666667 60.9066666666667C32.1066666666667 60.0533333333333 32.1066666666667 60.0373333333333 32.0373333333333 40.6933333333333L31.9626666666667 21.3333333333333L28.944 21.3333333333333C27.28 21.3333333333333 25.5626666666667 21.4346666666667 25.1253333333333 21.5573333333333C23.904 21.8986666666667 22.5973333333333 23.0186666666667 21.92 24.3146666666667L21.312 25.472L21.376 64.096L21.44 102.72L21.9413333333333 103.7333333333333C22.2133333333333 104.2933333333333 22.7893333333333 105.04 23.2213333333333 105.392C24.4213333333333 106.3893333333333 25.536 106.6346666666667 28.9386666666667 106.6506666666667L31.9626666666667 106.6666666666667L32.0373333333333 95.3066666666667M85.3333333333333 37.3333333333333L85.3333333333333 21.3333333333333L64 21.3333333333333L42.6666666666667 21.3333333333333L42.6666666666667 37.3333333333333L42.6666666666667 53.3333333333333L64 53.3333333333333L85.3333333333333 53.3333333333333L85.3333333333333 37.3333333333333" />
-    <glyph glyph-name="save-1"
-      unicode="&#x73;&#x61;&#x76;&#x65;"
-      horiz-adv-x="128" d="M34.9866666666667 117.1413333333333C23.296 117.0133333333333 23.1306666666667 117.008 21.76 116.5173333333334C18.9066666666667 115.4986666666667 16.3626666666667 113.7013333333334 14.288 111.248C12.96 109.6746666666667 12.128 108.0906666666667 11.3173333333333 105.6L10.6666666666667 103.5893333333333L10.6666666666667 64L10.6666666666667 24.4106666666667L11.3173333333333 22.4C12.448 18.9066666666667 13.9253333333333 16.6933333333333 16.6666666666667 14.3626666666667C18.3146666666667 12.9653333333333 19.872 12.1386666666667 22.4 11.3173333333333L24.4106666666667 10.6666666666667L64 10.6666666666667L103.5893333333333 10.6666666666667L105.6 11.3173333333333C108.128 12.1386666666667 109.6213333333333 12.9333333333333 111.28 14.352C114.096 16.7573333333333 115.5573333333333 18.928 116.6826666666667 22.4L117.3333333333333 24.4106666666667L117.328 55.3493333333333C117.3226666666667 85.2266666666667 117.312 86.3253333333333 116.9226666666667 87.1786666666667C116.6826666666667 87.7013333333333 115.0773333333334 89.5893333333333 113.008 91.7653333333333C107.4613333333333 97.616 89.168 115.664 88.016 116.4266666666667L86.9653333333333 117.12L74.0426666666667 117.12C66.9333333333333 117.12 57.904 117.1573333333333 53.9733333333333 117.1946666666667C50.0426666666667 117.2373333333334 41.4986666666667 117.216 34.9866666666667 117.1413333333333M32.0373333333333 95.3066666666667C32.112 84.1653333333333 32.1226666666667 83.9306666666667 32.5706666666667 83.0933333333333C33.1466666666667 82.0213333333333 34.1866666666667 81.0346666666667 35.3493333333333 80.448C36.2453333333333 80 36.2933333333333 80 58.6666666666667 80L81.0826666666667 80L82.0853333333333 80.512C84.144 81.568 85.1253333333333 83.136 85.1146666666667 85.3813333333334C85.1093333333333 87.0293333333333 84.624 88.176 83.5146666666667 89.1466666666667C81.904 90.5653333333333 83.104 90.4853333333333 61.9306666666667 90.6133333333334L42.6666666666667 90.7306666666667L42.6666666666667 98.6986666666667L42.6666666666667 106.6666666666667L62.88 106.6666666666667L83.0933333333333 106.6666666666667L94.8906666666667 94.8693333333334L106.688 83.072L106.624 54.176L106.56 25.28L106.0586666666667 24.2666666666667C105.7866666666667 23.7066666666667 105.216 22.9653333333333 104.7946666666667 22.6186666666667C103.52 21.568 102.4693333333333 21.3333333333333 99.072 21.3333333333333L96.0373333333333 21.3333333333333L95.9626666666667 40.6933333333333C95.8933333333333 60.0373333333333 95.8933333333333 60.0533333333333 95.4293333333333 60.9066666666667C94.912 61.872 94.1066666666667 62.6826666666667 93.0133333333333 63.3386666666667L92.2666666666667 63.7866666666667L64 63.7866666666667L35.7333333333333 63.7866666666667L34.9866666666667 63.3386666666667C33.8933333333333 62.6826666666667 33.088 61.872 32.5706666666667 60.9066666666667C32.1066666666667 60.0533333333333 32.1066666666667 60.0373333333333 32.0373333333333 40.6933333333333L31.9626666666667 21.3333333333333L28.944 21.3333333333333C27.28 21.3333333333333 25.5626666666667 21.4346666666667 25.1253333333333 21.5573333333333C23.904 21.8986666666667 22.5973333333333 23.0186666666667 21.92 24.3146666666667L21.312 25.472L21.376 64.096L21.44 102.72L21.9413333333333 103.7333333333333C22.2133333333333 104.2933333333333 22.7893333333333 105.04 23.2213333333333 105.392C24.4213333333333 106.3893333333333 25.536 106.6346666666667 28.9386666666667 106.6506666666667L31.9626666666667 106.6666666666667L32.0373333333333 95.3066666666667M85.3333333333333 37.3333333333333L85.3333333333333 21.3333333333333L64 21.3333333333333L42.6666666666667 21.3333333333333L42.6666666666667 37.3333333333333L42.6666666666667 53.3333333333333L64 53.3333333333333L85.3333333333333 53.3333333333333L85.3333333333333 37.3333333333333" />
-    <glyph glyph-name="database"
+      horiz-adv-x="128" d="M20.16 122.4746666666667C18.5653333333333 122.0693333333333 17.3973333333333 121.1253333333333 16.5653333333333 119.5733333333334L16.1066666666667 118.72L16.1066666666667 64L16.1066666666667 9.28L16.5653333333333 8.4213333333333C17.5893333333333 6.512 19.1786666666667 5.5093333333333 21.2586666666667 5.4666666666667C22.5546666666667 5.44 22.7413333333333 5.5093333333333 27.296 7.7813333333333L31.9893333333333 10.1226666666667L36.6506666666667 7.8133333333333C42.944 4.6933333333333 42.3893333333333 4.6933333333333 48.6773333333333 7.808L53.3333333333333 10.1173333333333L57.9893333333333 7.808C64.2773333333333 4.6933333333333 63.7226666666667 4.6933333333333 70.0106666666667 7.808L74.6666666666667 10.1173333333333L79.3226666666667 7.808C85.6106666666667 4.6933333333333 85.056 4.6933333333333 91.344 7.808L96 10.1173333333333L100.6933333333333 7.792C105.1626666666667 5.5786666666667 105.4506666666667 5.4666666666667 106.72 5.472C108.8213333333333 5.4773333333333 110.3733333333333 6.448 111.4346666666667 8.4266666666667L111.8933333333333 9.28L111.8933333333333 64L111.8933333333333 118.72L111.4346666666667 119.5786666666667C110.4106666666667 121.488 108.8213333333333 122.4906666666667 106.7413333333333 122.5333333333333C105.4453333333333 122.56 105.2586666666667 122.4906666666667 100.704 120.2186666666667L96.0106666666667 117.8773333333334L91.3493333333333 120.1866666666667C85.056 123.3066666666667 85.6106666666667 123.3066666666667 79.3226666666667 120.192L74.6666666666667 117.8826666666667L70.0106666666667 120.192C63.7226666666667 123.3066666666667 64.2773333333333 123.3066666666667 57.9893333333333 120.192L53.3333333333333 117.8826666666667L48.6773333333333 120.192C42.3893333333333 123.3066666666667 42.944 123.3066666666667 36.656 120.192L32 117.8826666666667L27.36 120.1653333333333C22.6346666666667 122.4853333333333 21.552 122.832 20.16 122.4746666666667M47.4133333333333 109.0986666666667C53.5893333333333 106.0373333333333 53.0666666666667 106.032 59.344 109.1413333333333L64 111.4506666666667L68.656 109.1413333333333C74.944 106.0266666666667 74.3893333333333 106.0266666666667 80.6773333333333 109.1413333333333L85.3333333333333 111.4506666666667L89.9893333333333 109.1413333333333C94.4106666666667 106.9546666666667 94.7093333333333 106.8373333333333 95.9786666666667 106.8373333333333C97.1253333333333 106.8373333333333 97.5946666666667 106.976 99.3226666666667 107.808L101.3333333333333 108.784L101.3333333333333 64L101.3333333333333 19.216L99.3226666666667 20.192C97.5946666666667 21.024 97.1253333333333 21.1626666666667 95.9786666666667 21.1626666666667C94.7093333333333 21.1626666666667 94.4106666666667 21.0453333333333 89.9893333333333 18.8586666666667L85.3333333333333 16.5493333333334L80.6773333333333 18.8586666666667C74.3893333333333 21.9733333333333 74.944 21.9733333333333 68.656 18.8586666666667L64 16.5493333333334L59.344 18.8586666666667C53.056 21.9733333333333 53.6106666666667 21.9733333333333 47.3226666666667 18.8586666666667L42.6666666666667 16.5493333333334L38.0106666666667 18.8586666666667C33.5893333333333 21.0453333333333 33.2906666666667 21.1626666666667 32.0213333333333 21.1626666666667C30.8746666666667 21.1626666666667 30.4053333333333 21.024 28.6773333333333 20.192L26.6666666666667 19.216L26.6666666666667 64L26.6666666666667 108.784L28.6773333333333 107.808C30.4053333333333 106.9706666666667 30.8746666666667 106.8373333333333 32.0266666666667 106.8373333333333C33.296 106.8373333333333 33.584 106.9493333333333 37.856 109.0826666666667C40.3253333333333 110.32 42.464 111.3386666666667 42.6026666666667 111.344C42.7466666666667 111.3546666666667 44.912 110.3413333333333 47.4133333333333 109.0986666666667M41.6 90.4693333333333C39.1306666666667 89.9573333333333 37.4826666666667 87.9093333333333 37.4826666666667 85.3333333333333C37.4826666666667 83.2106666666667 38.4693333333333 81.6106666666667 40.4213333333333 80.5653333333333C41.28 80.1066666666667 41.2853333333333 80.1066666666667 58.6666666666667 80.1066666666667C76.048 80.1066666666667 76.0533333333333 80.1066666666667 76.912 80.5653333333333C78.864 81.6106666666667 79.8506666666667 83.2106666666667 79.8506666666667 85.3333333333333C79.8506666666667 87.456 78.864 89.056 76.912 90.1013333333333C76.0533333333333 90.56 76.0053333333333 90.56 59.2 90.592C49.9306666666667 90.608 42.0106666666667 90.5546666666667 41.6 90.4693333333333M41.6 69.136C39.1306666666667 68.6293333333333 37.4826666666667 66.576 37.4826666666667 64C37.4826666666667 61.8773333333333 38.4693333333333 60.2773333333333 40.4213333333333 59.232L41.28 58.7733333333333L64 58.7733333333333L86.72 58.7733333333333L87.5786666666667 59.232C89.5306666666667 60.2773333333333 90.5173333333333 61.8773333333333 90.5173333333333 64C90.5173333333333 66.1226666666667 89.5306666666667 67.7226666666667 87.5786666666667 68.768L86.72 69.2266666666667L64.5333333333333 69.2586666666667C52.3306666666667 69.2746666666667 42.0106666666667 69.2213333333333 41.6 69.136M41.6 47.8026666666667C39.1253333333333 47.2906666666667 37.4826666666667 45.2373333333333 37.4826666666667 42.6666666666667C37.4826666666667 40.544 38.4693333333333 38.944 40.4213333333333 37.8986666666667C41.2746666666667 37.44 41.344 37.44 56 37.44C70.656 37.44 70.7253333333333 37.44 71.5786666666667 37.8986666666667C73.5306666666667 38.944 74.5173333333333 40.544 74.5173333333333 42.6666666666667C74.5173333333333 44.7893333333333 73.5306666666667 46.3893333333333 71.5786666666667 47.4346666666667C70.7253333333333 47.888 70.608 47.8933333333333 56.5333333333333 47.9253333333333C48.7306666666667 47.9466666666667 42.0106666666667 47.888 41.6 47.8026666666667" />
+    <glyph glyph-name="receipt-text-1"
+      unicode="&#x72;&#x65;&#x63;&#x65;&#x69;&#x70;&#x74;&#x2D;&#x74;&#x65;&#x78;&#x74;"
+      horiz-adv-x="128" d="M20.16 122.4746666666667C18.5653333333333 122.0693333333333 17.3973333333333 121.1253333333333 16.5653333333333 119.5733333333334L16.1066666666667 118.72L16.1066666666667 64L16.1066666666667 9.28L16.5653333333333 8.4213333333333C17.5893333333333 6.512 19.1786666666667 5.5093333333333 21.2586666666667 5.4666666666667C22.5546666666667 5.44 22.7413333333333 5.5093333333333 27.296 7.7813333333333L31.9893333333333 10.1226666666667L36.6506666666667 7.8133333333333C42.944 4.6933333333333 42.3893333333333 4.6933333333333 48.6773333333333 7.808L53.3333333333333 10.1173333333333L57.9893333333333 7.808C64.2773333333333 4.6933333333333 63.7226666666667 4.6933333333333 70.0106666666667 7.808L74.6666666666667 10.1173333333333L79.3226666666667 7.808C85.6106666666667 4.6933333333333 85.056 4.6933333333333 91.344 7.808L96 10.1173333333333L100.6933333333333 7.792C105.1626666666667 5.5786666666667 105.4506666666667 5.4666666666667 106.72 5.472C108.8213333333333 5.4773333333333 110.3733333333333 6.448 111.4346666666667 8.4266666666667L111.8933333333333 9.28L111.8933333333333 64L111.8933333333333 118.72L111.4346666666667 119.5786666666667C110.4106666666667 121.488 108.8213333333333 122.4906666666667 106.7413333333333 122.5333333333333C105.4453333333333 122.56 105.2586666666667 122.4906666666667 100.704 120.2186666666667L96.0106666666667 117.8773333333334L91.3493333333333 120.1866666666667C85.056 123.3066666666667 85.6106666666667 123.3066666666667 79.3226666666667 120.192L74.6666666666667 117.8826666666667L70.0106666666667 120.192C63.7226666666667 123.3066666666667 64.2773333333333 123.3066666666667 57.9893333333333 120.192L53.3333333333333 117.8826666666667L48.6773333333333 120.192C42.3893333333333 123.3066666666667 42.944 123.3066666666667 36.656 120.192L32 117.8826666666667L27.36 120.1653333333333C22.6346666666667 122.4853333333333 21.552 122.832 20.16 122.4746666666667M47.4133333333333 109.0986666666667C53.5893333333333 106.0373333333333 53.0666666666667 106.032 59.344 109.1413333333333L64 111.4506666666667L68.656 109.1413333333333C74.944 106.0266666666667 74.3893333333333 106.0266666666667 80.6773333333333 109.1413333333333L85.3333333333333 111.4506666666667L89.9893333333333 109.1413333333333C94.4106666666667 106.9546666666667 94.7093333333333 106.8373333333333 95.9786666666667 106.8373333333333C97.1253333333333 106.8373333333333 97.5946666666667 106.976 99.3226666666667 107.808L101.3333333333333 108.784L101.3333333333333 64L101.3333333333333 19.216L99.3226666666667 20.192C97.5946666666667 21.024 97.1253333333333 21.1626666666667 95.9786666666667 21.1626666666667C94.7093333333333 21.1626666666667 94.4106666666667 21.0453333333333 89.9893333333333 18.8586666666667L85.3333333333333 16.5493333333334L80.6773333333333 18.8586666666667C74.3893333333333 21.9733333333333 74.944 21.9733333333333 68.656 18.8586666666667L64 16.5493333333334L59.344 18.8586666666667C53.056 21.9733333333333 53.6106666666667 21.9733333333333 47.3226666666667 18.8586666666667L42.6666666666667 16.5493333333334L38.0106666666667 18.8586666666667C33.5893333333333 21.0453333333333 33.2906666666667 21.1626666666667 32.0213333333333 21.1626666666667C30.8746666666667 21.1626666666667 30.4053333333333 21.024 28.6773333333333 20.192L26.6666666666667 19.216L26.6666666666667 64L26.6666666666667 108.784L28.6773333333333 107.808C30.4053333333333 106.9706666666667 30.8746666666667 106.8373333333333 32.0266666666667 106.8373333333333C33.296 106.8373333333333 33.584 106.9493333333333 37.856 109.0826666666667C40.3253333333333 110.32 42.464 111.3386666666667 42.6026666666667 111.344C42.7466666666667 111.3546666666667 44.912 110.3413333333333 47.4133333333333 109.0986666666667M41.6 90.4693333333333C39.1306666666667 89.9573333333333 37.4826666666667 87.9093333333333 37.4826666666667 85.3333333333333C37.4826666666667 83.2106666666667 38.4693333333333 81.6106666666667 40.4213333333333 80.5653333333333C41.28 80.1066666666667 41.2853333333333 80.1066666666667 58.6666666666667 80.1066666666667C76.048 80.1066666666667 76.0533333333333 80.1066666666667 76.912 80.5653333333333C78.864 81.6106666666667 79.8506666666667 83.2106666666667 79.8506666666667 85.3333333333333C79.8506666666667 87.456 78.864 89.056 76.912 90.1013333333333C76.0533333333333 90.56 76.0053333333333 90.56 59.2 90.592C49.9306666666667 90.608 42.0106666666667 90.5546666666667 41.6 90.4693333333333M41.6 69.136C39.1306666666667 68.6293333333333 37.4826666666667 66.576 37.4826666666667 64C37.4826666666667 61.8773333333333 38.4693333333333 60.2773333333333 40.4213333333333 59.232L41.28 58.7733333333333L64 58.7733333333333L86.72 58.7733333333333L87.5786666666667 59.232C89.5306666666667 60.2773333333333 90.5173333333333 61.8773333333333 90.5173333333333 64C90.5173333333333 66.1226666666667 89.5306666666667 67.7226666666667 87.5786666666667 68.768L86.72 69.2266666666667L64.5333333333333 69.2586666666667C52.3306666666667 69.2746666666667 42.0106666666667 69.2213333333333 41.6 69.136M41.6 47.8026666666667C39.1253333333333 47.2906666666667 37.4826666666667 45.2373333333333 37.4826666666667 42.6666666666667C37.4826666666667 40.544 38.4693333333333 38.944 40.4213333333333 37.8986666666667C41.2746666666667 37.44 41.344 37.44 56 37.44C70.656 37.44 70.7253333333333 37.44 71.5786666666667 37.8986666666667C73.5306666666667 38.944 74.5173333333333 40.544 74.5173333333333 42.6666666666667C74.5173333333333 44.7893333333333 73.5306666666667 46.3893333333333 71.5786666666667 47.4346666666667C70.7253333333333 47.888 70.608 47.8933333333333 56.5333333333333 47.9253333333333C48.7306666666667 47.9466666666667 42.0106666666667 47.888 41.6 47.8026666666667" />
+    <glyph glyph-name="eraser"
       unicode="&#xF12F;"
-      horiz-adv-x="128" d="M59.9466666666667 122.528C48.1813333333333 122.1973333333333 38.064 120.6826666666667 29.344 117.9413333333333C19.2906666666667 114.784 13.0986666666667 110.2453333333333 11.2853333333333 104.7093333333333L10.7733333333333 103.1466666666667L10.7733333333333 63.8933333333334L10.7733333333333 24.64L11.2746666666667 23.2533333333333C12.944 18.6026666666667 17.1573333333333 14.9333333333333 24.3306666666667 11.8826666666667C31.6746666666667 8.7573333333333 42.2186666666667 6.56 53.76 5.7493333333333C58.288 5.4293333333333 69.712 5.4293333333333 74.24 5.7493333333333C88.1386666666667 6.7253333333333 100.4106666666667 9.7013333333333 107.7813333333333 13.8826666666667C113.6 17.1733333333333 116.5813333333333 20.864 117.136 25.4453333333333C117.2693333333333 26.5653333333333 117.328 40.9493333333333 117.2853333333333 65.28L117.2266666666667 103.36L116.6506666666667 104.9333333333333C114.9973333333333 109.472 110.784 113.0986666666667 103.6693333333333 116.1173333333333C96.2666666666667 119.264 85.1413333333333 121.568 74.24 122.224C70.128 122.4693333333334 63.1413333333333 122.6186666666667 59.9466666666667 122.528M73.2106666666667 111.7813333333333C88.5333333333333 110.752 102.304 106.752 106.1813333333333 102.208C106.848 101.424 106.784 101.0773333333333 105.8026666666667 100.0906666666667C102.8426666666667 97.1306666666667 96.2133333333333 94.5013333333333 87.1466666666667 92.6933333333333C80 91.264 73.1626666666667 90.6666666666667 64 90.6666666666667C60.8853333333333 90.6666666666667 56.8053333333333 90.7626666666667 54.928 90.8853333333333C39.6533333333333 91.8613333333333 25.712 95.8933333333334 21.8186666666667 100.4586666666667C21.2266666666667 101.1573333333333 21.2266666666667 101.5093333333333 21.8186666666667 102.208C25.6266666666667 106.6666666666667 39.488 110.7466666666667 54.2933333333333 111.7653333333333C58.0746666666667 112.0213333333333 69.4506666666667 112.032 73.2106666666667 111.7813333333333M29.3333333333333 84.7253333333333C36.48 82.4853333333333 44.528 81.0666666666667 53.76 80.416C58.288 80.096 69.712 80.096 74.24 80.416C86.0533333333333 81.248 96.4853333333333 83.456 104.0533333333333 86.7253333333333L106.6666666666667 87.8506666666667L106.6613333333333 75.7653333333333C106.6506666666667 62.096 106.8533333333333 63.568 104.7466666666667 61.856C99.744 57.8026666666667 87.1733333333333 54.5386666666667 72.7466666666667 53.5466666666667C68.768 53.2746666666667 59.232 53.2746666666667 55.2533333333333 53.5466666666667C40.8266666666667 54.5386666666667 28.256 57.8026666666667 23.2533333333333 61.856C21.1466666666667 63.568 21.3493333333333 62.096 21.3386666666667 75.7653333333333L21.3333333333333 87.8506666666667L23.9466666666667 86.7253333333333C25.3866666666667 86.1013333333333 27.808 85.2053333333333 29.3333333333333 84.7253333333333M29.3333333333333 47.392C36.48 45.152 44.528 43.7333333333333 53.76 43.0826666666667C58.288 42.7626666666667 69.712 42.7626666666667 74.24 43.0826666666667C86.0533333333333 43.9146666666667 96.4853333333333 46.1226666666667 104.0533333333333 49.392L106.6666666666667 50.5173333333333L106.6666666666667 38.416L106.6666666666667 26.3093333333333L105.8666666666667 25.504C101.2906666666667 20.896 88.432 17.2906666666667 72.7466666666667 16.2133333333333C68.768 15.9413333333333 59.232 15.9413333333333 55.2533333333333 16.2133333333333C39.2693333333333 17.312 25.8186666666667 21.1626666666667 21.8186666666667 25.7973333333333L21.3493333333333 26.3466666666667L21.3386666666667 38.432L21.3333333333333 50.5173333333333L23.9466666666667 49.392C25.3866666666667 48.768 27.808 47.872 29.3333333333333 47.392" />
-    <glyph glyph-name="database-1"
-      unicode="&#x64;&#x61;&#x74;&#x61;&#x62;&#x61;&#x73;&#x65;"
-      horiz-adv-x="128" d="M59.9466666666667 122.528C48.1813333333333 122.1973333333333 38.064 120.6826666666667 29.344 117.9413333333333C19.2906666666667 114.784 13.0986666666667 110.2453333333333 11.2853333333333 104.7093333333333L10.7733333333333 103.1466666666667L10.7733333333333 63.8933333333334L10.7733333333333 24.64L11.2746666666667 23.2533333333333C12.944 18.6026666666667 17.1573333333333 14.9333333333333 24.3306666666667 11.8826666666667C31.6746666666667 8.7573333333333 42.2186666666667 6.56 53.76 5.7493333333333C58.288 5.4293333333333 69.712 5.4293333333333 74.24 5.7493333333333C88.1386666666667 6.7253333333333 100.4106666666667 9.7013333333333 107.7813333333333 13.8826666666667C113.6 17.1733333333333 116.5813333333333 20.864 117.136 25.4453333333333C117.2693333333333 26.5653333333333 117.328 40.9493333333333 117.2853333333333 65.28L117.2266666666667 103.36L116.6506666666667 104.9333333333333C114.9973333333333 109.472 110.784 113.0986666666667 103.6693333333333 116.1173333333333C96.2666666666667 119.264 85.1413333333333 121.568 74.24 122.224C70.128 122.4693333333334 63.1413333333333 122.6186666666667 59.9466666666667 122.528M73.2106666666667 111.7813333333333C88.5333333333333 110.752 102.304 106.752 106.1813333333333 102.208C106.848 101.424 106.784 101.0773333333333 105.8026666666667 100.0906666666667C102.8426666666667 97.1306666666667 96.2133333333333 94.5013333333333 87.1466666666667 92.6933333333333C80 91.264 73.1626666666667 90.6666666666667 64 90.6666666666667C60.8853333333333 90.6666666666667 56.8053333333333 90.7626666666667 54.928 90.8853333333333C39.6533333333333 91.8613333333333 25.712 95.8933333333334 21.8186666666667 100.4586666666667C21.2266666666667 101.1573333333333 21.2266666666667 101.5093333333333 21.8186666666667 102.208C25.6266666666667 106.6666666666667 39.488 110.7466666666667 54.2933333333333 111.7653333333333C58.0746666666667 112.0213333333333 69.4506666666667 112.032 73.2106666666667 111.7813333333333M29.3333333333333 84.7253333333333C36.48 82.4853333333333 44.528 81.0666666666667 53.76 80.416C58.288 80.096 69.712 80.096 74.24 80.416C86.0533333333333 81.248 96.4853333333333 83.456 104.0533333333333 86.7253333333333L106.6666666666667 87.8506666666667L106.6613333333333 75.7653333333333C106.6506666666667 62.096 106.8533333333333 63.568 104.7466666666667 61.856C99.744 57.8026666666667 87.1733333333333 54.5386666666667 72.7466666666667 53.5466666666667C68.768 53.2746666666667 59.232 53.2746666666667 55.2533333333333 53.5466666666667C40.8266666666667 54.5386666666667 28.256 57.8026666666667 23.2533333333333 61.856C21.1466666666667 63.568 21.3493333333333 62.096 21.3386666666667 75.7653333333333L21.3333333333333 87.8506666666667L23.9466666666667 86.7253333333333C25.3866666666667 86.1013333333333 27.808 85.2053333333333 29.3333333333333 84.7253333333333M29.3333333333333 47.392C36.48 45.152 44.528 43.7333333333333 53.76 43.0826666666667C58.288 42.7626666666667 69.712 42.7626666666667 74.24 43.0826666666667C86.0533333333333 43.9146666666667 96.4853333333333 46.1226666666667 104.0533333333333 49.392L106.6666666666667 50.5173333333333L106.6666666666667 38.416L106.6666666666667 26.3093333333333L105.8666666666667 25.504C101.2906666666667 20.896 88.432 17.2906666666667 72.7466666666667 16.2133333333333C68.768 15.9413333333333 59.232 15.9413333333333 55.2533333333333 16.2133333333333C39.2693333333333 17.312 25.8186666666667 21.1626666666667 21.8186666666667 25.7973333333333L21.3493333333333 26.3466666666667L21.3386666666667 38.432L21.3333333333333 50.5173333333333L23.9466666666667 49.392C25.3866666666667 48.768 27.808 47.872 29.3333333333333 47.392" />
-    <glyph glyph-name="lock-open"
+      horiz-adv-x="128" d="M72.1066666666667 117.3226666666667C68.6186666666667 116.8053333333333 65.4453333333333 115.2053333333333 62.2826666666667 112.3626666666667C61.1733333333333 111.3653333333333 48.688 98.9493333333333 34.5386666666667 84.768C6.384 56.56 7.4933333333333 57.7653333333333 6.1386666666667 53.84C4.4746666666667 49.0026666666667 4.9973333333333 43.5893333333333 7.5466666666667 39.2426666666667C8.912 36.9226666666667 10.8213333333333 34.8853333333333 23.1786666666667 22.5866666666667C32.8533333333333 12.96 34.3733333333333 11.5253333333334 35.3066666666667 11.1733333333333C36.336 10.784 37.7333333333333 10.7733333333333 77.5466666666667 10.7733333333333L118.72 10.7733333333333L119.5786666666667 11.232C121.4826666666667 12.2506666666667 122.496 13.9093333333333 122.496 16C122.496 18.0906666666667 121.4826666666667 19.7493333333333 119.5786666666667 20.768C118.72 21.2266666666667 118.6773333333333 21.2266666666667 100.4906666666667 21.2853333333333L82.2666666666667 21.3493333333333L100.7253333333333 39.8453333333333C120.912 60.0746666666667 120.5333333333333 59.6533333333333 121.8613333333333 63.4933333333333C122.736 66.032 123.024 68.5653333333333 122.7253333333333 71.0773333333333C122.2346666666667 75.2213333333333 120.7893333333333 78.272 117.696 81.7173333333333C116.6986666666667 82.8266666666667 109.0826666666667 90.512 100.768 98.7946666666667C84.288 115.2106666666667 84.2666666666667 115.232 80.576 116.5013333333333C77.6746666666667 117.4933333333334 75.0186666666667 117.7493333333334 72.1066666666667 117.3226666666667M77.4506666666667 106.416C78.2346666666667 106.0906666666667 81.5733333333333 102.8533333333333 94.8693333333333 89.536C110.704 73.6746666666667 111.328 73.0186666666667 111.7813333333333 71.7866666666667C112.4053333333333 70.0853333333333 112.4106666666667 68.0586666666667 111.7973333333333 66.6346666666667C111.4186666666667 65.7546666666667 108.384 62.624 93.008 47.248L74.6666666666667 28.9066666666667L54.4533333333333 49.12L34.24 69.3333333333333L52.3733333333333 87.472C71.632 106.7413333333333 71.3546666666667 106.4853333333333 73.7386666666667 106.8533333333333C75.0826666666667 107.0613333333333 76.2453333333333 106.928 77.4506666666667 106.416M46.9333333333333 41.4933333333333L67.0933333333333 21.3333333333333L53.328 21.3333333333333L39.5626666666667 21.3333333333333L28.128 32.8C17.216 43.744 16.672 44.3253333333333 16.2186666666667 45.5466666666667C15.5946666666667 47.2533333333333 15.5893333333333 49.296 16.2026666666667 50.6986666666667C16.5493333333333 51.4933333333333 17.8026666666667 52.8853333333333 21.6053333333333 56.6933333333333C24.3306666666667 59.424 26.608 61.6533333333333 26.6666666666667 61.6533333333333C26.7253333333333 61.6533333333333 35.8453333333333 52.5813333333333 46.9333333333333 41.4933333333333" />
+    <glyph glyph-name="eraser-1"
+      unicode="&#x65;&#x72;&#x61;&#x73;&#x65;&#x72;"
+      horiz-adv-x="128" d="M72.1066666666667 117.3226666666667C68.6186666666667 116.8053333333333 65.4453333333333 115.2053333333333 62.2826666666667 112.3626666666667C61.1733333333333 111.3653333333333 48.688 98.9493333333333 34.5386666666667 84.768C6.384 56.56 7.4933333333333 57.7653333333333 6.1386666666667 53.84C4.4746666666667 49.0026666666667 4.9973333333333 43.5893333333333 7.5466666666667 39.2426666666667C8.912 36.9226666666667 10.8213333333333 34.8853333333333 23.1786666666667 22.5866666666667C32.8533333333333 12.96 34.3733333333333 11.5253333333334 35.3066666666667 11.1733333333333C36.336 10.784 37.7333333333333 10.7733333333333 77.5466666666667 10.7733333333333L118.72 10.7733333333333L119.5786666666667 11.232C121.4826666666667 12.2506666666667 122.496 13.9093333333333 122.496 16C122.496 18.0906666666667 121.4826666666667 19.7493333333333 119.5786666666667 20.768C118.72 21.2266666666667 118.6773333333333 21.2266666666667 100.4906666666667 21.2853333333333L82.2666666666667 21.3493333333333L100.7253333333333 39.8453333333333C120.912 60.0746666666667 120.5333333333333 59.6533333333333 121.8613333333333 63.4933333333333C122.736 66.032 123.024 68.5653333333333 122.7253333333333 71.0773333333333C122.2346666666667 75.2213333333333 120.7893333333333 78.272 117.696 81.7173333333333C116.6986666666667 82.8266666666667 109.0826666666667 90.512 100.768 98.7946666666667C84.288 115.2106666666667 84.2666666666667 115.232 80.576 116.5013333333333C77.6746666666667 117.4933333333334 75.0186666666667 117.7493333333334 72.1066666666667 117.3226666666667M77.4506666666667 106.416C78.2346666666667 106.0906666666667 81.5733333333333 102.8533333333333 94.8693333333333 89.536C110.704 73.6746666666667 111.328 73.0186666666667 111.7813333333333 71.7866666666667C112.4053333333333 70.0853333333333 112.4106666666667 68.0586666666667 111.7973333333333 66.6346666666667C111.4186666666667 65.7546666666667 108.384 62.624 93.008 47.248L74.6666666666667 28.9066666666667L54.4533333333333 49.12L34.24 69.3333333333333L52.3733333333333 87.472C71.632 106.7413333333333 71.3546666666667 106.4853333333333 73.7386666666667 106.8533333333333C75.0826666666667 107.0613333333333 76.2453333333333 106.928 77.4506666666667 106.416M46.9333333333333 41.4933333333333L67.0933333333333 21.3333333333333L53.328 21.3333333333333L39.5626666666667 21.3333333333333L28.128 32.8C17.216 43.744 16.672 44.3253333333333 16.2186666666667 45.5466666666667C15.5946666666667 47.2533333333333 15.5893333333333 49.296 16.2026666666667 50.6986666666667C16.5493333333333 51.4933333333333 17.8026666666667 52.8853333333333 21.6053333333333 56.6933333333333C24.3306666666667 59.424 26.608 61.6533333333333 26.6666666666667 61.6533333333333C26.7253333333333 61.6533333333333 35.8453333333333 52.5813333333333 46.9333333333333 41.4933333333333" />
+    <glyph glyph-name="dot"
       unicode="&#xF130;"
-      horiz-adv-x="128" d="M59.52 122.3253333333333C59.2266666666667 122.272 58.0746666666667 122.032 56.96 121.7813333333333C46.32 119.424 37.216 111.1946666666667 33.744 100.784C32.304 96.4693333333333 32 93.2426666666667 32 82.3253333333333L32 74.7306666666667L28.3466666666667 74.5813333333333C26.336 74.5013333333333 23.968 74.2986666666667 23.088 74.128C19.968 73.5306666666667 16.816 71.568 14.4053333333333 68.72C12.9653333333333 67.0133333333333 12.144 65.4773333333333 11.3173333333333 62.9333333333333L10.6666666666667 60.9226666666667L10.6666666666667 40L10.6666666666667 19.0773333333333L11.3173333333333 17.0666666666667C12.1386666666667 14.5386666666667 12.9653333333333 12.9813333333333 14.3626666666667 11.3333333333333C16.6933333333333 8.592 18.9066666666667 7.1146666666667 22.4 5.984L24.4106666666667 5.3333333333333L64 5.3333333333333L103.5893333333333 5.3333333333333L105.6 5.984C109.072 7.1093333333333 111.2426666666667 8.5706666666667 113.648 11.3866666666667C115.0666666666667 13.0453333333333 115.8613333333333 14.5386666666667 116.6826666666667 17.0666666666667L117.3333333333333 19.0773333333333L117.3333333333333 40L117.3333333333333 60.9226666666667L116.6826666666667 62.9333333333333C115.5413333333334 66.4533333333334 114.1493333333333 68.528 111.28 70.9813333333333C109.7653333333333 72.2773333333333 108.2666666666667 73.1093333333333 106.0426666666667 73.904L104.4533333333333 74.4746666666667L73.5253333333333 74.6026666666667L42.5973333333333 74.736L42.7253333333333 84.8213333333333L42.8586666666667 94.9066666666667L43.52 96.896C45.12 101.6586666666667 48.2453333333333 105.808 52.32 108.5653333333333C53.7866666666667 109.5573333333333 56.144 110.6186666666667 58.3466666666667 111.28C60.1226666666667 111.8186666666667 60.5493333333333 111.8613333333333 64 111.856C67.1466666666667 111.856 68 111.7813333333333 69.44 111.3973333333333C73.344 110.3466666666667 77.6533333333333 107.5573333333333 80.3466666666667 104.3413333333333C82.2666666666667 102.048 83.3866666666667 99.936 84.5333333333333 96.448C85.0933333333333 94.7573333333333 85.776 93.072 86.0533333333333 92.7093333333333C86.6506666666667 91.9253333333333 88.304 90.992 89.4506666666667 90.7893333333333C91.0986666666667 90.496 93.376 91.552 94.4213333333333 93.0933333333333C95.6373333333333 94.88 95.6 96.752 94.2773333333333 100.72C92.6933333333333 105.456 89.664 110.2453333333333 86.0426666666667 113.744C83.3813333333333 116.3146666666667 78.688 119.2426666666667 74.9866666666667 120.6346666666667C71.472 121.9626666666667 69.5946666666667 122.272 64.64 122.352C62.1173333333333 122.3893333333333 59.8133333333333 122.3786666666667 59.52 122.3253333333333M103.1946666666667 63.6746666666667C104.4053333333333 63.168 105.3226666666667 62.3733333333333 105.968 61.2746666666667L106.56 60.2666666666667L106.6293333333333 42.4533333333334C106.672 32.656 106.6346666666667 23.4613333333333 106.5546666666667 22.016C106.416 19.5466666666667 106.368 19.3386666666667 105.7386666666667 18.3946666666667C105.3226666666667 17.776 104.6186666666667 17.1253333333333 103.904 16.6933333333333L102.7413333333333 16L64 16L25.2586666666667 16L24.096 16.6933333333333C23.3813333333333 17.1253333333333 22.6773333333333 17.776 22.2613333333333 18.3946666666667C21.632 19.3386666666667 21.584 19.5466666666667 21.4453333333333 22.016C21.3653333333333 23.4613333333333 21.328 32.656 21.3706666666667 42.4533333333334L21.44 60.2666666666667L22.032 61.2746666666667C22.6666666666667 62.352 23.5786666666667 63.152 24.7573333333333 63.664C25.4026666666667 63.9413333333334 30.2613333333333 63.984 63.952 63.9893333333333C98.016 64 102.5013333333333 63.9626666666667 103.1946666666667 63.6746666666667" />
-    <glyph glyph-name="lock-open-1"
-      unicode="&#x6C;&#x6F;&#x63;&#x6B;&#x2D;&#x6F;&#x70;&#x65;&#x6E;"
-      horiz-adv-x="128" d="M59.52 122.3253333333333C59.2266666666667 122.272 58.0746666666667 122.032 56.96 121.7813333333333C46.32 119.424 37.216 111.1946666666667 33.744 100.784C32.304 96.4693333333333 32 93.2426666666667 32 82.3253333333333L32 74.7306666666667L28.3466666666667 74.5813333333333C26.336 74.5013333333333 23.968 74.2986666666667 23.088 74.128C19.968 73.5306666666667 16.816 71.568 14.4053333333333 68.72C12.9653333333333 67.0133333333333 12.144 65.4773333333333 11.3173333333333 62.9333333333333L10.6666666666667 60.9226666666667L10.6666666666667 40L10.6666666666667 19.0773333333333L11.3173333333333 17.0666666666667C12.1386666666667 14.5386666666667 12.9653333333333 12.9813333333333 14.3626666666667 11.3333333333333C16.6933333333333 8.592 18.9066666666667 7.1146666666667 22.4 5.984L24.4106666666667 5.3333333333333L64 5.3333333333333L103.5893333333333 5.3333333333333L105.6 5.984C109.072 7.1093333333333 111.2426666666667 8.5706666666667 113.648 11.3866666666667C115.0666666666667 13.0453333333333 115.8613333333333 14.5386666666667 116.6826666666667 17.0666666666667L117.3333333333333 19.0773333333333L117.3333333333333 40L117.3333333333333 60.9226666666667L116.6826666666667 62.9333333333333C115.5413333333334 66.4533333333334 114.1493333333333 68.528 111.28 70.9813333333333C109.7653333333333 72.2773333333333 108.2666666666667 73.1093333333333 106.0426666666667 73.904L104.4533333333333 74.4746666666667L73.5253333333333 74.6026666666667L42.5973333333333 74.736L42.7253333333333 84.8213333333333L42.8586666666667 94.9066666666667L43.52 96.896C45.12 101.6586666666667 48.2453333333333 105.808 52.32 108.5653333333333C53.7866666666667 109.5573333333333 56.144 110.6186666666667 58.3466666666667 111.28C60.1226666666667 111.8186666666667 60.5493333333333 111.8613333333333 64 111.856C67.1466666666667 111.856 68 111.7813333333333 69.44 111.3973333333333C73.344 110.3466666666667 77.6533333333333 107.5573333333333 80.3466666666667 104.3413333333333C82.2666666666667 102.048 83.3866666666667 99.936 84.5333333333333 96.448C85.0933333333333 94.7573333333333 85.776 93.072 86.0533333333333 92.7093333333333C86.6506666666667 91.9253333333333 88.304 90.992 89.4506666666667 90.7893333333333C91.0986666666667 90.496 93.376 91.552 94.4213333333333 93.0933333333333C95.6373333333333 94.88 95.6 96.752 94.2773333333333 100.72C92.6933333333333 105.456 89.664 110.2453333333333 86.0426666666667 113.744C83.3813333333333 116.3146666666667 78.688 119.2426666666667 74.9866666666667 120.6346666666667C71.472 121.9626666666667 69.5946666666667 122.272 64.64 122.352C62.1173333333333 122.3893333333333 59.8133333333333 122.3786666666667 59.52 122.3253333333333M103.1946666666667 63.6746666666667C104.4053333333333 63.168 105.3226666666667 62.3733333333333 105.968 61.2746666666667L106.56 60.2666666666667L106.6293333333333 42.4533333333334C106.672 32.656 106.6346666666667 23.4613333333333 106.5546666666667 22.016C106.416 19.5466666666667 106.368 19.3386666666667 105.7386666666667 18.3946666666667C105.3226666666667 17.776 104.6186666666667 17.1253333333333 103.904 16.6933333333333L102.7413333333333 16L64 16L25.2586666666667 16L24.096 16.6933333333333C23.3813333333333 17.1253333333333 22.6773333333333 17.776 22.2613333333333 18.3946666666667C21.632 19.3386666666667 21.584 19.5466666666667 21.4453333333333 22.016C21.3653333333333 23.4613333333333 21.328 32.656 21.3706666666667 42.4533333333334L21.44 60.2666666666667L22.032 61.2746666666667C22.6666666666667 62.352 23.5786666666667 63.152 24.7573333333333 63.664C25.4026666666667 63.9413333333334 30.2613333333333 63.984 63.952 63.9893333333333C98.016 64 102.5013333333333 63.9626666666667 103.1946666666667 63.6746666666667" />
-    <glyph glyph-name="log-out"
+      horiz-adv-x="128" d="M62.3733333333333 73.824C60.9706666666667 73.6053333333333 58.5493333333333 72.3306666666667 57.3386666666667 71.1733333333334C55.2586666666667 69.1733333333334 54.1973333333333 66.9813333333333 54.0373333333333 64.32C53.8986666666667 62.1013333333333 54.3786666666667 59.824 55.3013333333333 58.288C56.2186666666667 56.7626666666667 58.528 54.6026666666667 60.016 53.8773333333333C62.432 52.6933333333333 66.6293333333333 52.6986666666667 69.072 53.8826666666667C70.6986666666667 54.6666666666667 73.3333333333333 57.3013333333333 74.1173333333333 58.928C75.3013333333333 61.36 75.3066666666667 65.5733333333333 74.1333333333333 67.968C73.472 69.312 71.6106666666667 71.4133333333333 70.24 72.3573333333333C69.7226666666667 72.7146666666667 68.8 73.1786666666667 68.1973333333333 73.3866666666667C66.896 73.84 63.9146666666667 74.064 62.3733333333333 73.824" />
+    <glyph glyph-name="dot-1"
+      unicode="&#x64;&#x6F;&#x74;"
+      horiz-adv-x="128" d="M62.3733333333333 73.824C60.9706666666667 73.6053333333333 58.5493333333333 72.3306666666667 57.3386666666667 71.1733333333334C55.2586666666667 69.1733333333334 54.1973333333333 66.9813333333333 54.0373333333333 64.32C53.8986666666667 62.1013333333333 54.3786666666667 59.824 55.3013333333333 58.288C56.2186666666667 56.7626666666667 58.528 54.6026666666667 60.016 53.8773333333333C62.432 52.6933333333333 66.6293333333333 52.6986666666667 69.072 53.8826666666667C70.6986666666667 54.6666666666667 73.3333333333333 57.3013333333333 74.1173333333333 58.928C75.3013333333333 61.36 75.3066666666667 65.5733333333333 74.1333333333333 67.968C73.472 69.312 71.6106666666667 71.4133333333333 70.24 72.3573333333333C69.7226666666667 72.7146666666667 68.8 73.1786666666667 68.1973333333333 73.3866666666667C66.896 73.84 63.9146666666667 74.064 62.3733333333333 73.824" />
+    <glyph glyph-name="square-power"
       unicode="&#xF131;"
-      horiz-adv-x="128" d="M24.7466666666667 117.1306666666667C21.1413333333333 116.736 18.1973333333333 115.28 15.456 112.544C13.28 110.3626666666667 12.1066666666667 108.3893333333333 11.264 105.4826666666667L10.7733333333333 103.7866666666667L10.7733333333333 64L10.7733333333333 24.2133333333333L11.264 22.5173333333333C12.1066666666667 19.6106666666667 13.28 17.6373333333333 15.456 15.456C17.6373333333333 13.28 19.6106666666667 12.1066666666667 22.5173333333333 11.264C24.2026666666667 10.7786666666667 24.2986666666667 10.7733333333333 36.8 10.7733333333333C49.2693333333333 10.7733333333333 49.392 10.7786666666667 50.2453333333333 11.232C52.1973333333333 12.2773333333333 53.184 13.8773333333333 53.184 16C53.184 18.1226666666667 52.1973333333333 19.7226666666667 50.2453333333333 20.768C49.4026666666667 21.216 49.1573333333333 21.2266666666667 37.2266666666667 21.3333333333333C25.2746666666667 21.44 25.0506666666667 21.4453333333333 24.2133333333333 21.8986666666667C23.0986666666667 22.5013333333334 22.3146666666667 23.3493333333333 21.776 24.5333333333333C21.344 25.488 21.344 25.7173333333333 21.344 64C21.344 102.2826666666667 21.344 102.512 21.776 103.4666666666667C22.3146666666667 104.6506666666667 23.0986666666667 105.4986666666667 24.2133333333333 106.1013333333333C25.0506666666667 106.5546666666667 25.2746666666667 106.56 37.2266666666667 106.6666666666667C49.1573333333333 106.7733333333333 49.4026666666667 106.784 50.2453333333333 107.232C52.1973333333333 108.2773333333333 53.184 109.8773333333333 53.184 112C53.184 114.1226666666667 52.1973333333333 115.7226666666667 50.2453333333333 116.768C49.3973333333333 117.2213333333333 49.2213333333333 117.2266666666667 37.76 117.2533333333333C31.3653333333333 117.2693333333333 25.5093333333333 117.216 24.7466666666667 117.1306666666667M84.2666666666667 95.8026666666667C82.6933333333333 95.4826666666667 81.3653333333333 94.4373333333333 80.5866666666667 92.912C79.968 91.696 79.9893333333333 89.6053333333333 80.6346666666667 88.32C80.9653333333333 87.6586666666667 83.92 84.544 90.0906666666667 78.352L99.072 69.344L72.8426666666667 69.2853333333333L46.6133333333333 69.2266666666667L45.7546666666667 68.768C43.8026666666667 67.7226666666667 42.816 66.1226666666667 42.816 64C42.816 61.8773333333333 43.8026666666667 60.2773333333333 45.7546666666667 59.232L46.6133333333333 58.7733333333333L72.8426666666667 58.7146666666667L99.072 58.656L90.0906666666667 49.648C83.92 43.456 80.9653333333333 40.3413333333333 80.6346666666667 39.68C79.664 37.7493333333333 80.0906666666667 35.168 81.6266666666667 33.6266666666667C83.168 32.0906666666667 85.7493333333333 31.664 87.68 32.6293333333333C89.0346666666667 33.3066666666667 116.0266666666667 60.2986666666667 116.704 61.6533333333333C117.0506666666667 62.352 117.184 62.992 117.184 64C117.184 65.008 117.0506666666667 65.648 116.704 66.3466666666667C116.0693333333333 67.6213333333333 89.04 94.6986666666667 87.7866666666667 95.312C86.7733333333333 95.808 85.3013333333333 96.016 84.2666666666667 95.8026666666667" />
-    <glyph glyph-name="log-out-1"
-      unicode="&#x6C;&#x6F;&#x67;&#x2D;&#x6F;&#x75;&#x74;"
-      horiz-adv-x="128" d="M24.7466666666667 117.1306666666667C21.1413333333333 116.736 18.1973333333333 115.28 15.456 112.544C13.28 110.3626666666667 12.1066666666667 108.3893333333333 11.264 105.4826666666667L10.7733333333333 103.7866666666667L10.7733333333333 64L10.7733333333333 24.2133333333333L11.264 22.5173333333333C12.1066666666667 19.6106666666667 13.28 17.6373333333333 15.456 15.456C17.6373333333333 13.28 19.6106666666667 12.1066666666667 22.5173333333333 11.264C24.2026666666667 10.7786666666667 24.2986666666667 10.7733333333333 36.8 10.7733333333333C49.2693333333333 10.7733333333333 49.392 10.7786666666667 50.2453333333333 11.232C52.1973333333333 12.2773333333333 53.184 13.8773333333333 53.184 16C53.184 18.1226666666667 52.1973333333333 19.7226666666667 50.2453333333333 20.768C49.4026666666667 21.216 49.1573333333333 21.2266666666667 37.2266666666667 21.3333333333333C25.2746666666667 21.44 25.0506666666667 21.4453333333333 24.2133333333333 21.8986666666667C23.0986666666667 22.5013333333334 22.3146666666667 23.3493333333333 21.776 24.5333333333333C21.344 25.488 21.344 25.7173333333333 21.344 64C21.344 102.2826666666667 21.344 102.512 21.776 103.4666666666667C22.3146666666667 104.6506666666667 23.0986666666667 105.4986666666667 24.2133333333333 106.1013333333333C25.0506666666667 106.5546666666667 25.2746666666667 106.56 37.2266666666667 106.6666666666667C49.1573333333333 106.7733333333333 49.4026666666667 106.784 50.2453333333333 107.232C52.1973333333333 108.2773333333333 53.184 109.8773333333333 53.184 112C53.184 114.1226666666667 52.1973333333333 115.7226666666667 50.2453333333333 116.768C49.3973333333333 117.2213333333333 49.2213333333333 117.2266666666667 37.76 117.2533333333333C31.3653333333333 117.2693333333333 25.5093333333333 117.216 24.7466666666667 117.1306666666667M84.2666666666667 95.8026666666667C82.6933333333333 95.4826666666667 81.3653333333333 94.4373333333333 80.5866666666667 92.912C79.968 91.696 79.9893333333333 89.6053333333333 80.6346666666667 88.32C80.9653333333333 87.6586666666667 83.92 84.544 90.0906666666667 78.352L99.072 69.344L72.8426666666667 69.2853333333333L46.6133333333333 69.2266666666667L45.7546666666667 68.768C43.8026666666667 67.7226666666667 42.816 66.1226666666667 42.816 64C42.816 61.8773333333333 43.8026666666667 60.2773333333333 45.7546666666667 59.232L46.6133333333333 58.7733333333333L72.8426666666667 58.7146666666667L99.072 58.656L90.0906666666667 49.648C83.92 43.456 80.9653333333333 40.3413333333333 80.6346666666667 39.68C79.664 37.7493333333333 80.0906666666667 35.168 81.6266666666667 33.6266666666667C83.168 32.0906666666667 85.7493333333333 31.664 87.68 32.6293333333333C89.0346666666667 33.3066666666667 116.0266666666667 60.2986666666667 116.704 61.6533333333333C117.0506666666667 62.352 117.184 62.992 117.184 64C117.184 65.008 117.0506666666667 65.648 116.704 66.3466666666667C116.0693333333333 67.6213333333333 89.04 94.6986666666667 87.7866666666667 95.312C86.7733333333333 95.808 85.3013333333333 96.016 84.2666666666667 95.8026666666667" />
-    <glyph glyph-name="layout-panel-left"
+      horiz-adv-x="128" d="M24.7466666666667 117.1306666666667C21.152 116.7413333333333 18.1973333333333 115.28 15.456 112.544C13.28 110.3626666666667 12.1066666666667 108.3893333333333 11.264 105.4826666666667L10.7733333333333 103.7866666666667L10.7733333333333 64L10.7733333333333 24.2133333333333L11.264 22.5173333333333C12.1066666666667 19.6106666666667 13.28 17.6373333333333 15.456 15.456C17.6373333333333 13.28 19.6106666666667 12.1066666666667 22.5173333333333 11.264L24.2133333333333 10.7733333333333L64 10.7733333333333L103.7866666666667 10.7733333333333L105.4826666666667 11.264C108.3893333333333 12.1066666666667 110.3626666666667 13.28 112.544 15.456C114.72 17.6373333333333 115.8933333333333 19.6106666666667 116.736 22.5173333333333L117.2266666666667 24.2133333333333L117.2266666666667 64L117.2266666666667 103.7866666666667L116.736 105.4826666666667C115.8933333333333 108.3893333333333 114.72 110.3626666666667 112.544 112.544C110.4053333333333 114.6773333333333 108.4693333333333 115.8453333333333 105.5946666666667 116.7306666666667L104 117.2213333333333L65.0666666666667 117.248C43.6533333333333 117.264 25.5093333333333 117.2106666666667 24.7466666666667 117.1306666666667M103.5733333333333 106.16C104.8533333333333 105.552 105.6373333333333 104.7573333333333 106.224 103.4666666666667C106.656 102.512 106.656 102.2826666666667 106.656 64C106.656 25.7173333333333 106.656 25.488 106.224 24.5333333333333C105.6373333333333 23.2426666666667 104.8533333333333 22.448 103.5733333333333 21.84L102.5066666666667 21.3386666666667L64 21.3386666666667C25.7173333333333 21.344 25.488 21.344 24.5333333333333 21.776C23.2426666666667 22.3626666666667 22.448 23.1466666666667 21.84 24.4266666666667L21.3386666666667 25.4933333333333L21.3386666666667 64C21.344 102.2826666666667 21.344 102.512 21.776 103.4666666666667C22.3626666666667 104.7573333333333 23.1466666666667 105.552 24.4266666666667 106.16L25.4933333333333 106.6613333333333L64 106.6613333333333L102.5066666666667 106.6613333333333L103.5733333333333 106.16M62.9333333333333 95.8026666666667C61.3706666666667 95.4826666666667 60.064 94.4586666666667 59.232 92.912C58.7733333333333 92.0586666666667 58.7733333333333 91.9893333333333 58.7733333333333 77.3333333333333C58.7733333333333 62.6773333333333 58.7733333333333 62.608 59.232 61.7546666666667C60.2773333333333 59.8026666666667 61.8773333333333 58.816 64 58.816C66.1226666666667 58.816 67.7226666666667 59.8026666666667 68.768 61.7546666666667C69.2266666666667 62.608 69.2266666666667 62.6773333333333 69.2266666666667 77.3333333333333C69.2266666666667 91.9893333333333 69.2266666666667 92.0586666666667 68.768 92.912C67.584 95.12 65.248 96.2773333333333 62.9333333333333 95.8026666666667M41.216 85.0293333333333C39.824 84.5813333333333 38.9653333333333 83.8933333333334 38 82.464C36.0106666666667 79.52 34.1813333333333 75.0346666666667 33.3386666666667 71.04C32.7946666666667 68.432 32.7946666666667 60.8213333333333 33.3493333333333 58.24C34.7146666666667 51.84 37.728 46.2933333333333 42.3306666666667 41.6906666666667C46.8853333333333 37.136 52.2826666666667 34.1333333333333 58.24 32.848C65.088 31.36 71.744 32.1226666666667 78.0693333333333 35.1146666666667C81.4346666666667 36.704 84.0853333333333 38.608 86.944 41.472C92.16 46.704 95.104 52.7786666666667 95.9946666666667 60.1546666666667C96.7093333333333 66.0426666666667 95.488 72.8 92.7253333333333 78.2293333333333C92.032 79.5893333333333 89.792 82.944 89.0826666666667 83.68C87.1306666666667 85.7066666666667 83.7546666666667 85.7333333333333 81.6533333333333 83.7386666666667C80.656 82.7893333333333 80.1493333333333 81.5466666666667 80.144 80C80.1333333333333 78.464 80.3573333333333 77.9093333333333 81.8186666666667 75.84C87.5573333333333 67.7173333333333 86.7626666666667 56.5333333333333 79.9306666666667 49.344C74.3253333333333 43.44 66.3893333333333 41.264 58.88 43.568C50.928 46.0053333333333 44.7253333333333 53.2693333333333 43.5306666666667 61.5466666666667C42.7946666666667 66.6506666666667 43.7813333333333 71.408 46.5973333333333 76.3466666666667C47.7386666666667 78.3413333333333 47.84 78.6293333333333 47.8506666666667 79.8453333333333C47.8773333333333 83.4826666666667 44.5226666666667 86.1013333333333 41.216 85.0293333333333" />
+    <glyph glyph-name="square-power-1"
+      unicode="&#x73;&#x71;&#x75;&#x61;&#x72;&#x65;&#x2D;&#x70;&#x6F;&#x77;&#x65;&#x72;"
+      horiz-adv-x="128" d="M24.7466666666667 117.1306666666667C21.152 116.7413333333333 18.1973333333333 115.28 15.456 112.544C13.28 110.3626666666667 12.1066666666667 108.3893333333333 11.264 105.4826666666667L10.7733333333333 103.7866666666667L10.7733333333333 64L10.7733333333333 24.2133333333333L11.264 22.5173333333333C12.1066666666667 19.6106666666667 13.28 17.6373333333333 15.456 15.456C17.6373333333333 13.28 19.6106666666667 12.1066666666667 22.5173333333333 11.264L24.2133333333333 10.7733333333333L64 10.7733333333333L103.7866666666667 10.7733333333333L105.4826666666667 11.264C108.3893333333333 12.1066666666667 110.3626666666667 13.28 112.544 15.456C114.72 17.6373333333333 115.8933333333333 19.6106666666667 116.736 22.5173333333333L117.2266666666667 24.2133333333333L117.2266666666667 64L117.2266666666667 103.7866666666667L116.736 105.4826666666667C115.8933333333333 108.3893333333333 114.72 110.3626666666667 112.544 112.544C110.4053333333333 114.6773333333333 108.4693333333333 115.8453333333333 105.5946666666667 116.7306666666667L104 117.2213333333333L65.0666666666667 117.248C43.6533333333333 117.264 25.5093333333333 117.2106666666667 24.7466666666667 117.1306666666667M103.5733333333333 106.16C104.8533333333333 105.552 105.6373333333333 104.7573333333333 106.224 103.4666666666667C106.656 102.512 106.656 102.2826666666667 106.656 64C106.656 25.7173333333333 106.656 25.488 106.224 24.5333333333333C105.6373333333333 23.2426666666667 104.8533333333333 22.448 103.5733333333333 21.84L102.5066666666667 21.3386666666667L64 21.3386666666667C25.7173333333333 21.344 25.488 21.344 24.5333333333333 21.776C23.2426666666667 22.3626666666667 22.448 23.1466666666667 21.84 24.4266666666667L21.3386666666667 25.4933333333333L21.3386666666667 64C21.344 102.2826666666667 21.344 102.512 21.776 103.4666666666667C22.3626666666667 104.7573333333333 23.1466666666667 105.552 24.4266666666667 106.16L25.4933333333333 106.6613333333333L64 106.6613333333333L102.5066666666667 106.6613333333333L103.5733333333333 106.16M62.9333333333333 95.8026666666667C61.3706666666667 95.4826666666667 60.064 94.4586666666667 59.232 92.912C58.7733333333333 92.0586666666667 58.7733333333333 91.9893333333333 58.7733333333333 77.3333333333333C58.7733333333333 62.6773333333333 58.7733333333333 62.608 59.232 61.7546666666667C60.2773333333333 59.8026666666667 61.8773333333333 58.816 64 58.816C66.1226666666667 58.816 67.7226666666667 59.8026666666667 68.768 61.7546666666667C69.2266666666667 62.608 69.2266666666667 62.6773333333333 69.2266666666667 77.3333333333333C69.2266666666667 91.9893333333333 69.2266666666667 92.0586666666667 68.768 92.912C67.584 95.12 65.248 96.2773333333333 62.9333333333333 95.8026666666667M41.216 85.0293333333333C39.824 84.5813333333333 38.9653333333333 83.8933333333334 38 82.464C36.0106666666667 79.52 34.1813333333333 75.0346666666667 33.3386666666667 71.04C32.7946666666667 68.432 32.7946666666667 60.8213333333333 33.3493333333333 58.24C34.7146666666667 51.84 37.728 46.2933333333333 42.3306666666667 41.6906666666667C46.8853333333333 37.136 52.2826666666667 34.1333333333333 58.24 32.848C65.088 31.36 71.744 32.1226666666667 78.0693333333333 35.1146666666667C81.4346666666667 36.704 84.0853333333333 38.608 86.944 41.472C92.16 46.704 95.104 52.7786666666667 95.9946666666667 60.1546666666667C96.7093333333333 66.0426666666667 95.488 72.8 92.7253333333333 78.2293333333333C92.032 79.5893333333333 89.792 82.944 89.0826666666667 83.68C87.1306666666667 85.7066666666667 83.7546666666667 85.7333333333333 81.6533333333333 83.7386666666667C80.656 82.7893333333333 80.1493333333333 81.5466666666667 80.144 80C80.1333333333333 78.464 80.3573333333333 77.9093333333333 81.8186666666667 75.84C87.5573333333333 67.7173333333333 86.7626666666667 56.5333333333333 79.9306666666667 49.344C74.3253333333333 43.44 66.3893333333333 41.264 58.88 43.568C50.928 46.0053333333333 44.7253333333333 53.2693333333333 43.5306666666667 61.5466666666667C42.7946666666667 66.6506666666667 43.7813333333333 71.408 46.5973333333333 76.3466666666667C47.7386666666667 78.3413333333333 47.84 78.6293333333333 47.8506666666667 79.8453333333333C47.8773333333333 83.4826666666667 44.5226666666667 86.1013333333333 41.216 85.0293333333333" />
+    <glyph glyph-name="panel-bottom"
       unicode="&#xF132;"
-      horiz-adv-x="128" d="M19.5253333333333 117.0933333333333C15.232 116.4693333333334 11.52 112.6773333333333 10.8906666666667 108.2666666666667C10.5973333333333 106.224 10.5973333333333 21.776 10.8906666666667 19.7333333333333C11.536 15.2213333333333 15.2213333333333 11.536 19.7333333333333 10.8906666666667C21.712 10.608 47.6213333333333 10.608 49.6 10.8906666666667C54.112 11.536 57.7973333333333 15.2213333333333 58.4426666666667 19.7333333333333C58.736 21.776 58.736 106.224 58.4426666666667 108.2666666666667C57.7973333333333 112.7786666666667 54.112 116.464 49.6 117.1093333333334C47.7653333333333 117.376 21.3386666666667 117.36 19.5253333333333 117.0933333333333M78.192 117.0933333333333C73.8986666666667 116.4693333333334 70.1866666666667 112.6773333333333 69.5573333333333 108.2666666666667C69.2746666666667 106.288 69.2746666666667 80.3786666666667 69.5573333333333 78.4C70.2026666666667 73.888 73.888 70.2026666666667 78.4 69.5573333333333C80.3786666666667 69.2746666666667 106.288 69.2746666666667 108.2666666666667 69.5573333333333C112.7786666666667 70.2026666666667 116.464 73.888 117.1093333333333 78.4C117.392 80.3786666666667 117.392 106.288 117.1093333333333 108.2666666666667C116.464 112.7786666666667 112.7786666666667 116.464 108.2666666666667 117.1093333333334C106.432 117.376 80.0053333333333 117.36 78.192 117.0933333333333M48 64L48 21.3333333333333L34.6666666666667 21.3333333333333L21.3333333333333 21.3333333333333L21.3333333333333 64L21.3333333333333 106.6666666666667L34.6666666666667 106.6666666666667L48 106.6666666666667L48 64M106.6666666666667 93.3333333333333L106.6666666666667 80L93.3333333333333 80L80 80L80 93.3333333333333L80 106.6666666666667L93.3333333333333 106.6666666666667L106.6666666666667 106.6666666666667L106.6666666666667 93.3333333333333M78.192 58.4266666666667C73.8986666666667 57.8026666666667 70.1866666666667 54.0106666666667 69.5573333333333 49.6C69.2746666666667 47.6213333333333 69.2746666666667 21.712 69.5573333333333 19.7333333333333C70.2026666666667 15.2213333333333 73.888 11.536 78.4 10.8906666666667C79.2693333333333 10.7626666666667 85.504 10.6773333333333 93.3333333333333 10.6773333333333C101.1626666666667 10.6773333333333 107.3973333333333 10.7626666666667 108.2666666666667 10.8906666666667C112.7786666666667 11.536 116.464 15.2213333333333 117.1093333333333 19.7333333333333C117.392 21.712 117.392 47.6213333333333 117.1093333333333 49.6C116.464 54.112 112.7786666666667 57.7973333333333 108.2666666666667 58.4426666666667C106.432 58.7093333333333 80.0053333333333 58.6933333333333 78.192 58.4266666666667M106.6666666666667 34.6666666666667L106.6666666666667 21.3333333333333L93.3333333333333 21.3333333333333L80 21.3333333333333L80 34.6666666666667L80 48L93.3333333333333 48L106.6666666666667 48L106.6666666666667 34.6666666666667" />
-    <glyph glyph-name="layout-panel-left-1"
-      unicode="&#x6C;&#x61;&#x79;&#x6F;&#x75;&#x74;&#x2D;&#x70;&#x61;&#x6E;&#x65;&#x6C;&#x2D;&#x6C;&#x65;&#x66;&#x74;"
-      horiz-adv-x="128" d="M19.5253333333333 117.0933333333333C15.232 116.4693333333334 11.52 112.6773333333333 10.8906666666667 108.2666666666667C10.5973333333333 106.224 10.5973333333333 21.776 10.8906666666667 19.7333333333333C11.536 15.2213333333333 15.2213333333333 11.536 19.7333333333333 10.8906666666667C21.712 10.608 47.6213333333333 10.608 49.6 10.8906666666667C54.112 11.536 57.7973333333333 15.2213333333333 58.4426666666667 19.7333333333333C58.736 21.776 58.736 106.224 58.4426666666667 108.2666666666667C57.7973333333333 112.7786666666667 54.112 116.464 49.6 117.1093333333334C47.7653333333333 117.376 21.3386666666667 117.36 19.5253333333333 117.0933333333333M78.192 117.0933333333333C73.8986666666667 116.4693333333334 70.1866666666667 112.6773333333333 69.5573333333333 108.2666666666667C69.2746666666667 106.288 69.2746666666667 80.3786666666667 69.5573333333333 78.4C70.2026666666667 73.888 73.888 70.2026666666667 78.4 69.5573333333333C80.3786666666667 69.2746666666667 106.288 69.2746666666667 108.2666666666667 69.5573333333333C112.7786666666667 70.2026666666667 116.464 73.888 117.1093333333333 78.4C117.392 80.3786666666667 117.392 106.288 117.1093333333333 108.2666666666667C116.464 112.7786666666667 112.7786666666667 116.464 108.2666666666667 117.1093333333334C106.432 117.376 80.0053333333333 117.36 78.192 117.0933333333333M48 64L48 21.3333333333333L34.6666666666667 21.3333333333333L21.3333333333333 21.3333333333333L21.3333333333333 64L21.3333333333333 106.6666666666667L34.6666666666667 106.6666666666667L48 106.6666666666667L48 64M106.6666666666667 93.3333333333333L106.6666666666667 80L93.3333333333333 80L80 80L80 93.3333333333333L80 106.6666666666667L93.3333333333333 106.6666666666667L106.6666666666667 106.6666666666667L106.6666666666667 93.3333333333333M78.192 58.4266666666667C73.8986666666667 57.8026666666667 70.1866666666667 54.0106666666667 69.5573333333333 49.6C69.2746666666667 47.6213333333333 69.2746666666667 21.712 69.5573333333333 19.7333333333333C70.2026666666667 15.2213333333333 73.888 11.536 78.4 10.8906666666667C79.2693333333333 10.7626666666667 85.504 10.6773333333333 93.3333333333333 10.6773333333333C101.1626666666667 10.6773333333333 107.3973333333333 10.7626666666667 108.2666666666667 10.8906666666667C112.7786666666667 11.536 116.464 15.2213333333333 117.1093333333333 19.7333333333333C117.392 21.712 117.392 47.6213333333333 117.1093333333333 49.6C116.464 54.112 112.7786666666667 57.7973333333333 108.2666666666667 58.4426666666667C106.432 58.7093333333333 80.0053333333333 58.6933333333333 78.192 58.4266666666667M106.6666666666667 34.6666666666667L106.6666666666667 21.3333333333333L93.3333333333333 21.3333333333333L80 21.3333333333333L80 34.6666666666667L80 48L93.3333333333333 48L106.6666666666667 48L106.6666666666667 34.6666666666667" />
-    <glyph glyph-name="server-off"
+      horiz-adv-x="128" d="M22.848 116.7893333333333C19.0346666666667 115.9626666666667 14.5706666666667 112.4853333333333 12.6133333333333 108.8213333333333C12.2613333333333 108.1546666666667 11.6746666666667 106.704 11.3173333333333 105.6L10.6666666666667 103.5893333333333L10.6666666666667 64L10.6666666666667 24.4106666666667L11.3173333333333 22.4C12.448 18.9066666666667 13.9253333333333 16.6933333333333 16.6666666666667 14.3626666666667C18.3146666666667 12.9653333333333 19.872 12.1386666666667 22.4 11.3173333333333L24.4106666666667 10.6666666666667L64 10.6666666666667L103.5893333333333 10.6666666666667L105.6 11.3173333333333C108.128 12.1386666666667 109.6213333333333 12.9333333333333 111.28 14.352C114.096 16.7573333333333 115.5573333333333 18.928 116.6826666666667 22.4L117.3333333333333 24.4106666666667L117.3333333333333 64L117.3333333333333 103.5893333333333L116.6826666666667 105.6C115.5413333333334 109.12 114.1493333333333 111.1946666666667 111.28 113.648C109.7706666666667 114.9386666666667 108.2666666666667 115.776 106.0693333333333 116.5653333333333L104.5066666666667 117.12L64.3626666666667 117.104C30.9653333333333 117.088 23.984 117.0346666666667 22.848 116.7893333333333M103.36 106.2666666666667C104.6186666666667 105.696 105.504 104.864 106.064 103.728L106.56 102.72L106.624 78.0266666666667L106.688 53.3333333333333L64 53.3333333333333L21.312 53.3333333333333L21.376 78.0266666666667L21.44 102.72L21.936 103.728C22.496 104.864 23.3813333333333 105.696 24.64 106.2666666666667C25.456 106.64 27.1893333333333 106.656 64 106.656C100.8106666666667 106.656 102.544 106.64 103.36 106.2666666666667M106.6506666666667 34.72C106.64 30.352 106.5653333333333 26.2666666666667 106.4746666666667 25.648C106.2666666666667 24.176 105.3653333333333 22.9066666666667 103.8933333333333 22.0266666666667L102.7413333333333 21.3333333333333L64 21.3333333333333L25.2586666666667 21.3333333333333L24.1066666666667 22.0266666666667C22.704 22.8693333333333 21.7546666666667 24.16 21.5253333333333 25.536C21.4346666666667 26.096 21.3546666666667 30.1866666666667 21.344 34.6133333333333L21.3333333333333 42.6666666666667L64 42.6666666666667L106.6666666666667 42.6666666666667L106.6506666666667 34.72" />
+    <glyph glyph-name="panel-bottom-1"
+      unicode="&#x70;&#x61;&#x6E;&#x65;&#x6C;&#x2D;&#x62;&#x6F;&#x74;&#x74;&#x6F;&#x6D;"
+      horiz-adv-x="128" d="M22.848 116.7893333333333C19.0346666666667 115.9626666666667 14.5706666666667 112.4853333333333 12.6133333333333 108.8213333333333C12.2613333333333 108.1546666666667 11.6746666666667 106.704 11.3173333333333 105.6L10.6666666666667 103.5893333333333L10.6666666666667 64L10.6666666666667 24.4106666666667L11.3173333333333 22.4C12.448 18.9066666666667 13.9253333333333 16.6933333333333 16.6666666666667 14.3626666666667C18.3146666666667 12.9653333333333 19.872 12.1386666666667 22.4 11.3173333333333L24.4106666666667 10.6666666666667L64 10.6666666666667L103.5893333333333 10.6666666666667L105.6 11.3173333333333C108.128 12.1386666666667 109.6213333333333 12.9333333333333 111.28 14.352C114.096 16.7573333333333 115.5573333333333 18.928 116.6826666666667 22.4L117.3333333333333 24.4106666666667L117.3333333333333 64L117.3333333333333 103.5893333333333L116.6826666666667 105.6C115.5413333333334 109.12 114.1493333333333 111.1946666666667 111.28 113.648C109.7706666666667 114.9386666666667 108.2666666666667 115.776 106.0693333333333 116.5653333333333L104.5066666666667 117.12L64.3626666666667 117.104C30.9653333333333 117.088 23.984 117.0346666666667 22.848 116.7893333333333M103.36 106.2666666666667C104.6186666666667 105.696 105.504 104.864 106.064 103.728L106.56 102.72L106.624 78.0266666666667L106.688 53.3333333333333L64 53.3333333333333L21.312 53.3333333333333L21.376 78.0266666666667L21.44 102.72L21.936 103.728C22.496 104.864 23.3813333333333 105.696 24.64 106.2666666666667C25.456 106.64 27.1893333333333 106.656 64 106.656C100.8106666666667 106.656 102.544 106.64 103.36 106.2666666666667M106.6506666666667 34.72C106.64 30.352 106.5653333333333 26.2666666666667 106.4746666666667 25.648C106.2666666666667 24.176 105.3653333333333 22.9066666666667 103.8933333333333 22.0266666666667L102.7413333333333 21.3333333333333L64 21.3333333333333L25.2586666666667 21.3333333333333L24.1066666666667 22.0266666666667C22.704 22.8693333333333 21.7546666666667 24.16 21.5253333333333 25.536C21.4346666666667 26.096 21.3546666666667 30.1866666666667 21.344 34.6133333333333L21.3333333333333 42.6666666666667L64 42.6666666666667L106.6666666666667 42.6666666666667L106.6506666666667 34.72" />
+    <glyph glyph-name="chevron-right"
       unicode="&#xF133;"
-      horiz-adv-x="128" d="M9.6 122.4693333333334C7.3173333333333 122 5.5466666666667 119.9733333333333 5.5413333333333 117.8186666666667C5.5413333333333 117.2586666666667 5.5146666666667 114.496 5.488 111.68C5.4613333333333 108.864 5.44 101.232 5.44 94.72C5.44 83.0026666666667 5.4453333333333 82.864 5.9306666666667 81.184C6.7733333333333 78.2826666666667 7.9466666666667 76.304 10.1226666666667 74.1226666666667C12.2666666666667 71.984 14.2186666666667 70.8106666666667 17.072 69.9466666666667C18.656 69.4666666666667 18.768 69.4613333333333 34.896 69.3866666666667L51.1253333333333 69.3066666666667L56.432 63.9946666666667L61.7333333333333 58.688L40.2026666666667 58.6133333333334L18.6666666666667 58.544L17.072 58.0586666666667C14.208 57.184 12.2666666666667 56.016 10.1226666666667 53.8773333333333C7.9466666666667 51.696 6.7733333333333 49.7226666666667 5.9306666666667 46.816C5.44 45.1306666666667 5.44 45.056 5.44 32C5.44 18.944 5.44 18.8693333333333 5.9306666666667 17.184C6.7733333333333 14.2773333333333 7.9466666666667 12.304 10.1226666666667 10.1226666666667C12.304 7.9466666666667 14.2773333333333 6.7733333333333 17.184 5.9306666666667L18.88 5.44L64.7466666666667 5.44L110.6133333333333 5.44L112.16 6.1653333333333C113.568 6.8213333333333 113.744 6.8586666666667 114.08 6.5653333333333C114.9226666666667 5.824 115.952 5.4826666666667 117.328 5.4826666666667C119.4613333333333 5.4826666666667 121.0933333333333 6.496 122.08 8.4213333333333C122.6986666666667 9.632 122.6773333333333 11.728 122.0373333333333 13.0133333333334C121.3973333333333 14.304 14.3893333333333 121.3546666666667 13.12 121.9786666666667C12.1066666666667 122.4746666666667 10.6346666666667 122.6826666666667 9.6 122.4693333333334M36.2666666666667 122.4693333333334C33.7973333333333 121.9626666666667 32.1493333333333 119.9093333333333 32.1493333333333 117.3333333333333C32.1493333333333 115.2106666666667 33.136 113.6106666666667 35.088 112.5653333333333L35.9466666666667 112.1066666666667L72.1066666666667 112L108.2666666666667 111.8933333333333L109.12 111.4346666666667C110.2346666666667 110.832 111.0186666666667 109.984 111.5573333333333 108.8C111.9786666666667 107.872 111.9893333333333 107.456 111.9893333333333 96C111.9893333333333 84.544 111.9786666666667 84.128 111.5573333333333 83.2C111.0186666666667 82.016 110.2346666666667 81.168 109.12 80.5653333333333C108.2773333333333 80.112 108.1226666666667 80.1066666666667 93.44 80C78.7786666666667 79.8933333333334 78.6026666666667 79.888 77.7546666666667 79.4346666666667C75.8026666666667 78.3893333333333 74.816 76.7893333333333 74.816 74.6666666666667C74.816 72.544 75.8026666666667 70.944 77.7546666666667 69.8986666666667C78.608 69.44 78.6666666666667 69.44 93.8666666666667 69.44L109.12 69.44L110.816 69.9306666666667C113.7226666666667 70.7733333333333 115.696 71.9466666666667 117.8773333333333 74.1226666666667C120.0533333333334 76.304 121.2266666666667 78.2773333333333 122.0693333333333 81.184C122.56 82.8693333333334 122.56 82.944 122.56 96C122.56 109.056 122.56 109.1306666666667 122.0693333333333 110.816C121.2266666666667 113.7226666666667 120.0533333333334 115.696 117.8773333333333 117.8773333333334C115.7386666666667 120.0106666666667 113.8026666666667 121.1786666666667 110.928 122.064L109.3333333333333 122.5493333333333L73.1733333333333 122.5866666666667C53.2853333333333 122.608 36.6773333333333 122.5546666666667 36.2666666666667 122.4693333333334M30.3466666666667 80.048C21.5093333333333 79.9946666666667 20.2666666666667 80.032 19.4453333333333 80.3413333333333C18.16 80.8266666666667 17.0933333333333 81.8293333333333 16.5013333333333 83.0933333333333L16.0053333333333 84.16L16 94.2933333333333L16 104.4266666666667L28.16 92.2666666666667L40.32 80.1066666666667L30.3466666666667 80.048M100.2666666666667 58.48C96.2133333333333 57.5786666666667 94.7093333333333 52.5493333333333 97.6266666666667 49.6266666666667C98.96 48.2986666666667 99.5626666666667 48.144 104.1066666666667 48.0106666666667C108.6613333333333 47.872 109.2906666666667 47.712 110.5333333333333 46.368C111.7706666666667 45.0346666666667 111.872 44.592 112.0106666666667 40.1066666666667C112.1173333333333 36.4586666666667 112.192 35.84 112.5813333333333 35.088C113.584 33.152 115.2053333333333 32.1493333333333 117.3333333333333 32.1493333333333C119.456 32.1493333333333 121.056 33.136 122.1013333333333 35.088C122.5333333333333 35.8933333333333 122.56 36.2346666666667 122.5493333333333 40.5333333333333C122.5333333333333 45.808 122.272 47.1626666666667 120.6933333333333 50.2293333333333C119.4506666666667 52.6293333333333 116.6293333333333 55.4506666666667 114.2346666666667 56.688C111.3546666666667 58.176 109.9573333333333 58.464 105.1733333333333 58.5653333333333C102.8853333333333 58.608 100.6773333333333 58.576 100.2666666666667 58.48M88.4266666666667 32L104.4266666666667 16L62.2933333333333 16L20.16 16.0053333333333L19.0933333333333 16.5066666666667C17.8133333333333 17.1146666666667 17.0293333333333 17.9093333333333 16.4426666666667 19.2C16.0213333333333 20.128 16.0106666666667 20.544 16.0106666666667 32C16.0106666666667 43.456 16.0213333333333 43.872 16.4426666666667 44.8C17.0293333333333 46.0906666666667 17.8133333333333 46.8853333333333 19.0933333333333 47.4933333333333L20.16 47.9946666666667L46.2933333333333 48L72.4266666666667 48L88.4266666666667 32M30.9333333333333 37.136C26.9013333333333 36.3093333333333 25.3813333333333 31.2106666666667 28.2933333333333 28.2933333333333C29.7706666666667 26.8213333333333 32.4 26.3413333333333 34.24 27.216C35.9946666666667 28.048 37.3333333333333 30.1173333333333 37.3333333333333 32C37.3333333333333 33.8453333333333 35.9893333333333 35.968 34.336 36.7306666666667C33.4133333333333 37.1573333333333 31.9093333333333 37.3333333333333 30.9333333333333 37.136" />
-    <glyph glyph-name="server-off-1"
-      unicode="&#x73;&#x65;&#x72;&#x76;&#x65;&#x72;&#x2D;&#x6F;&#x66;&#x66;"
-      horiz-adv-x="128" d="M9.6 122.4693333333334C7.3173333333333 122 5.5466666666667 119.9733333333333 5.5413333333333 117.8186666666667C5.5413333333333 117.2586666666667 5.5146666666667 114.496 5.488 111.68C5.4613333333333 108.864 5.44 101.232 5.44 94.72C5.44 83.0026666666667 5.4453333333333 82.864 5.9306666666667 81.184C6.7733333333333 78.2826666666667 7.9466666666667 76.304 10.1226666666667 74.1226666666667C12.2666666666667 71.984 14.2186666666667 70.8106666666667 17.072 69.9466666666667C18.656 69.4666666666667 18.768 69.4613333333333 34.896 69.3866666666667L51.1253333333333 69.3066666666667L56.432 63.9946666666667L61.7333333333333 58.688L40.2026666666667 58.6133333333334L18.6666666666667 58.544L17.072 58.0586666666667C14.208 57.184 12.2666666666667 56.016 10.1226666666667 53.8773333333333C7.9466666666667 51.696 6.7733333333333 49.7226666666667 5.9306666666667 46.816C5.44 45.1306666666667 5.44 45.056 5.44 32C5.44 18.944 5.44 18.8693333333333 5.9306666666667 17.184C6.7733333333333 14.2773333333333 7.9466666666667 12.304 10.1226666666667 10.1226666666667C12.304 7.9466666666667 14.2773333333333 6.7733333333333 17.184 5.9306666666667L18.88 5.44L64.7466666666667 5.44L110.6133333333333 5.44L112.16 6.1653333333333C113.568 6.8213333333333 113.744 6.8586666666667 114.08 6.5653333333333C114.9226666666667 5.824 115.952 5.4826666666667 117.328 5.4826666666667C119.4613333333333 5.4826666666667 121.0933333333333 6.496 122.08 8.4213333333333C122.6986666666667 9.632 122.6773333333333 11.728 122.0373333333333 13.0133333333334C121.3973333333333 14.304 14.3893333333333 121.3546666666667 13.12 121.9786666666667C12.1066666666667 122.4746666666667 10.6346666666667 122.6826666666667 9.6 122.4693333333334M36.2666666666667 122.4693333333334C33.7973333333333 121.9626666666667 32.1493333333333 119.9093333333333 32.1493333333333 117.3333333333333C32.1493333333333 115.2106666666667 33.136 113.6106666666667 35.088 112.5653333333333L35.9466666666667 112.1066666666667L72.1066666666667 112L108.2666666666667 111.8933333333333L109.12 111.4346666666667C110.2346666666667 110.832 111.0186666666667 109.984 111.5573333333333 108.8C111.9786666666667 107.872 111.9893333333333 107.456 111.9893333333333 96C111.9893333333333 84.544 111.9786666666667 84.128 111.5573333333333 83.2C111.0186666666667 82.016 110.2346666666667 81.168 109.12 80.5653333333333C108.2773333333333 80.112 108.1226666666667 80.1066666666667 93.44 80C78.7786666666667 79.8933333333334 78.6026666666667 79.888 77.7546666666667 79.4346666666667C75.8026666666667 78.3893333333333 74.816 76.7893333333333 74.816 74.6666666666667C74.816 72.544 75.8026666666667 70.944 77.7546666666667 69.8986666666667C78.608 69.44 78.6666666666667 69.44 93.8666666666667 69.44L109.12 69.44L110.816 69.9306666666667C113.7226666666667 70.7733333333333 115.696 71.9466666666667 117.8773333333333 74.1226666666667C120.0533333333334 76.304 121.2266666666667 78.2773333333333 122.0693333333333 81.184C122.56 82.8693333333334 122.56 82.944 122.56 96C122.56 109.056 122.56 109.1306666666667 122.0693333333333 110.816C121.2266666666667 113.7226666666667 120.0533333333334 115.696 117.8773333333333 117.8773333333334C115.7386666666667 120.0106666666667 113.8026666666667 121.1786666666667 110.928 122.064L109.3333333333333 122.5493333333333L73.1733333333333 122.5866666666667C53.2853333333333 122.608 36.6773333333333 122.5546666666667 36.2666666666667 122.4693333333334M30.3466666666667 80.048C21.5093333333333 79.9946666666667 20.2666666666667 80.032 19.4453333333333 80.3413333333333C18.16 80.8266666666667 17.0933333333333 81.8293333333333 16.5013333333333 83.0933333333333L16.0053333333333 84.16L16 94.2933333333333L16 104.4266666666667L28.16 92.2666666666667L40.32 80.1066666666667L30.3466666666667 80.048M100.2666666666667 58.48C96.2133333333333 57.5786666666667 94.7093333333333 52.5493333333333 97.6266666666667 49.6266666666667C98.96 48.2986666666667 99.5626666666667 48.144 104.1066666666667 48.0106666666667C108.6613333333333 47.872 109.2906666666667 47.712 110.5333333333333 46.368C111.7706666666667 45.0346666666667 111.872 44.592 112.0106666666667 40.1066666666667C112.1173333333333 36.4586666666667 112.192 35.84 112.5813333333333 35.088C113.584 33.152 115.2053333333333 32.1493333333333 117.3333333333333 32.1493333333333C119.456 32.1493333333333 121.056 33.136 122.1013333333333 35.088C122.5333333333333 35.8933333333333 122.56 36.2346666666667 122.5493333333333 40.5333333333333C122.5333333333333 45.808 122.272 47.1626666666667 120.6933333333333 50.2293333333333C119.4506666666667 52.6293333333333 116.6293333333333 55.4506666666667 114.2346666666667 56.688C111.3546666666667 58.176 109.9573333333333 58.464 105.1733333333333 58.5653333333333C102.8853333333333 58.608 100.6773333333333 58.576 100.2666666666667 58.48M88.4266666666667 32L104.4266666666667 16L62.2933333333333 16L20.16 16.0053333333333L19.0933333333333 16.5066666666667C17.8133333333333 17.1146666666667 17.0293333333333 17.9093333333333 16.4426666666667 19.2C16.0213333333333 20.128 16.0106666666667 20.544 16.0106666666667 32C16.0106666666667 43.456 16.0213333333333 43.872 16.4426666666667 44.8C17.0293333333333 46.0906666666667 17.8133333333333 46.8853333333333 19.0933333333333 47.4933333333333L20.16 47.9946666666667L46.2933333333333 48L72.4266666666667 48L88.4266666666667 32M30.9333333333333 37.136C26.9013333333333 36.3093333333333 25.3813333333333 31.2106666666667 28.2933333333333 28.2933333333333C29.7706666666667 26.8213333333333 32.4 26.3413333333333 34.24 27.216C35.9946666666667 28.048 37.3333333333333 30.1173333333333 37.3333333333333 32C37.3333333333333 33.8453333333333 35.9893333333333 35.968 34.336 36.7306666666667C33.4133333333333 37.1573333333333 31.9093333333333 37.3333333333333 30.9333333333333 37.136" />
-    <glyph glyph-name="circle-slash"
+      horiz-adv-x="128" d="M45.9573333333333 100.816C44.944 100.3786666666667 43.7066666666667 99.1893333333333 43.28 98.24C42.8053333333333 97.2 42.7573333333333 95.008 43.184 93.9786666666667C43.5786666666667 93.04 46.0053333333333 90.5173333333333 60.4693333333333 76L72.4266666666667 64L60.4693333333333 52C45.8613333333333 37.344 43.5786666666667 34.96 43.1626666666667 33.968C42.7413333333333 32.9653333333334 42.752 31.0453333333333 43.184 30.032C43.6746666666667 28.8746666666667 44.7786666666667 27.7173333333333 45.84 27.248C46.9813333333333 26.7466666666667 48.88 26.6986666666667 49.936 27.1413333333333C51.7226666666667 27.8986666666667 84.0853333333333 60.2346666666667 84.8213333333333 62C85.2053333333333 62.9066666666667 85.2053333333333 65.088 84.8266666666667 65.9946666666667C84.368 67.0933333333333 68.7146666666667 83.0826666666667 56.6933333333333 94.7306666666667C51.888 99.3813333333334 50.384 100.72 49.76 100.896C48.6613333333333 101.2 46.7466666666667 101.1626666666667 45.9573333333333 100.816" />
+    <glyph glyph-name="chevron-right-1"
+      unicode="&#x63;&#x68;&#x65;&#x76;&#x72;&#x6F;&#x6E;&#x2D;&#x72;&#x69;&#x67;&#x68;&#x74;"
+      horiz-adv-x="128" d="M45.9573333333333 100.816C44.944 100.3786666666667 43.7066666666667 99.1893333333333 43.28 98.24C42.8053333333333 97.2 42.7573333333333 95.008 43.184 93.9786666666667C43.5786666666667 93.04 46.0053333333333 90.5173333333333 60.4693333333333 76L72.4266666666667 64L60.4693333333333 52C45.8613333333333 37.344 43.5786666666667 34.96 43.1626666666667 33.968C42.7413333333333 32.9653333333334 42.752 31.0453333333333 43.184 30.032C43.6746666666667 28.8746666666667 44.7786666666667 27.7173333333333 45.84 27.248C46.9813333333333 26.7466666666667 48.88 26.6986666666667 49.936 27.1413333333333C51.7226666666667 27.8986666666667 84.0853333333333 60.2346666666667 84.8213333333333 62C85.2053333333333 62.9066666666667 85.2053333333333 65.088 84.8266666666667 65.9946666666667C84.368 67.0933333333333 68.7146666666667 83.0826666666667 56.6933333333333 94.7306666666667C51.888 99.3813333333334 50.384 100.72 49.76 100.896C48.6613333333333 101.2 46.7466666666667 101.1626666666667 45.9573333333333 100.816" />
+    <glyph glyph-name="arrow-down"
       unicode="&#xF134;"
-      horiz-adv-x="128" d="M60.16 122.4373333333333C48.3626666666667 121.7066666666667 36.6826666666667 117.1786666666667 27.312 109.712C24.704 107.632 20.368 103.296 18.288 100.688C13.088 94.16 9.0293333333333 85.904 7.0666666666667 77.8346666666667C4.9173333333333 69.0346666666667 4.9173333333333 58.9653333333333 7.0666666666667 50.1653333333333C9.0293333333333 42.096 13.088 33.84 18.288 27.312C20.368 24.704 24.704 20.368 27.312 18.288C32.192 14.4 39.0506666666667 10.608 44.7253333333333 8.6666666666667C59.7493333333333 3.52 75.8186666666667 4.5333333333333 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M78.9333333333333 85.136C78.5226666666667 85.0506666666667 77.8506666666667 84.8106666666667 77.44 84.6026666666667C76.2666666666667 84.0053333333333 43.8773333333333 51.5093333333333 43.296 50.3466666666667C42.3306666666667 48.416 42.7573333333333 45.8346666666667 44.2933333333333 44.2933333333333C45.8346666666667 42.7573333333333 48.416 42.3306666666667 50.3466666666667 43.296C51.7066666666667 43.9733333333333 84.0266666666667 76.2933333333333 84.704 77.6533333333333C85.344 78.9386666666667 85.3653333333333 81.0293333333333 84.7466666666667 82.2453333333333C83.632 84.4266666666667 81.2533333333333 85.6106666666667 78.9333333333333 85.136" />
-    <glyph glyph-name="circle-slash-1"
-      unicode="&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x73;&#x6C;&#x61;&#x73;&#x68;"
-      horiz-adv-x="128" d="M60.16 122.4373333333333C48.3626666666667 121.7066666666667 36.6826666666667 117.1786666666667 27.312 109.712C24.704 107.632 20.368 103.296 18.288 100.688C13.088 94.16 9.0293333333333 85.904 7.0666666666667 77.8346666666667C4.9173333333333 69.0346666666667 4.9173333333333 58.9653333333333 7.0666666666667 50.1653333333333C9.0293333333333 42.096 13.088 33.84 18.288 27.312C20.368 24.704 24.704 20.368 27.312 18.288C32.192 14.4 39.0506666666667 10.608 44.7253333333333 8.6666666666667C59.7493333333333 3.52 75.8186666666667 4.5333333333333 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M78.9333333333333 85.136C78.5226666666667 85.0506666666667 77.8506666666667 84.8106666666667 77.44 84.6026666666667C76.2666666666667 84.0053333333333 43.8773333333333 51.5093333333333 43.296 50.3466666666667C42.3306666666667 48.416 42.7573333333333 45.8346666666667 44.2933333333333 44.2933333333333C45.8346666666667 42.7573333333333 48.416 42.3306666666667 50.3466666666667 43.296C51.7066666666667 43.9733333333333 84.0266666666667 76.2933333333333 84.704 77.6533333333333C85.344 78.9386666666667 85.3653333333333 81.0293333333333 84.7466666666667 82.2453333333333C83.632 84.4266666666667 81.2533333333333 85.6106666666667 78.9333333333333 85.136" />
-    <glyph glyph-name="arrow-right"
+      horiz-adv-x="128" d="M61.9573333333333 106.1493333333333C60.9226666666667 105.7013333333333 59.7493333333333 104.5546666666667 59.184 103.44L58.6666666666667 102.416L58.6666666666667 70.992L58.6666666666667 39.5733333333334L46.7733333333333 51.424C32.208 65.936 29.6213333333333 68.4266666666667 28.688 68.816C27.808 69.184 26.0586666666667 69.2106666666667 24.928 68.8746666666667C23.7866666666667 68.528 22.544 67.4026666666667 21.9786666666667 66.2026666666667C21.4186666666667 65.008 21.3493333333333 63.184 21.8186666666667 62.0533333333333C22.56 60.2773333333333 60.2346666666667 22.5813333333333 62.0106666666667 21.84C62.9066666666667 21.4613333333333 65.0933333333333 21.4613333333333 65.9893333333333 21.84C67.7653333333333 22.5813333333333 105.44 60.2773333333333 106.1813333333333 62.0533333333333C106.6506666666667 63.184 106.5813333333333 65.008 106.0213333333333 66.2026666666667C105.136 68.0906666666667 103.4133333333333 69.12 101.1413333333333 69.12C98.9066666666667 69.12 99.632 69.7653333333333 81.2266666666667 51.424L69.3333333333333 39.5733333333334L69.3333333333333 70.992L69.3333333333333 102.416L68.8213333333333 103.4186666666667C67.8026666666667 105.4186666666667 66.144 106.4586666666667 64.0053333333333 106.4426666666667C63.2373333333333 106.4426666666667 62.32 106.3093333333333 61.9573333333333 106.1493333333333" />
+    <glyph glyph-name="arrow-down-1"
+      unicode="&#x61;&#x72;&#x72;&#x6F;&#x77;&#x2D;&#x64;&#x6F;&#x77;&#x6E;"
+      horiz-adv-x="128" d="M61.9573333333333 106.1493333333333C60.9226666666667 105.7013333333333 59.7493333333333 104.5546666666667 59.184 103.44L58.6666666666667 102.416L58.6666666666667 70.992L58.6666666666667 39.5733333333334L46.7733333333333 51.424C32.208 65.936 29.6213333333333 68.4266666666667 28.688 68.816C27.808 69.184 26.0586666666667 69.2106666666667 24.928 68.8746666666667C23.7866666666667 68.528 22.544 67.4026666666667 21.9786666666667 66.2026666666667C21.4186666666667 65.008 21.3493333333333 63.184 21.8186666666667 62.0533333333333C22.56 60.2773333333333 60.2346666666667 22.5813333333333 62.0106666666667 21.84C62.9066666666667 21.4613333333333 65.0933333333333 21.4613333333333 65.9893333333333 21.84C67.7653333333333 22.5813333333333 105.44 60.2773333333333 106.1813333333333 62.0533333333333C106.6506666666667 63.184 106.5813333333333 65.008 106.0213333333333 66.2026666666667C105.136 68.0906666666667 103.4133333333333 69.12 101.1413333333333 69.12C98.9066666666667 69.12 99.632 69.7653333333333 81.2266666666667 51.424L69.3333333333333 39.5733333333334L69.3333333333333 70.992L69.3333333333333 102.416L68.8213333333333 103.4186666666667C67.8026666666667 105.4186666666667 66.144 106.4586666666667 64.0053333333333 106.4426666666667C63.2373333333333 106.4426666666667 62.32 106.3093333333333 61.9573333333333 106.1493333333333" />
+    <glyph glyph-name="circle-user"
       unicode="&#xF135;"
-      horiz-adv-x="128" d="M61.9573333333333 106.1493333333333C60.944 105.712 59.7066666666667 104.5226666666667 59.28 103.5733333333333C58.8053333333333 102.528 58.7573333333333 100.336 59.184 99.312C59.5733333333333 98.3786666666667 62.064 95.792 76.544 81.2586666666667L88.3626666666667 69.3973333333333L56.7786666666667 69.2853333333333L25.1946666666667 69.1733333333334L24.2773333333333 68.6346666666667C22.3573333333333 67.4986666666667 21.5466666666667 66.128 21.5466666666667 64C21.5466666666667 61.7973333333333 22.5386666666667 60.224 24.5813333333333 59.1786666666667L25.584 58.6666666666667L57.008 58.6666666666667L88.4266666666667 58.6666666666667L76.4693333333333 46.6666666666667C61.8613333333333 32.0106666666667 59.5786666666667 29.6266666666667 59.1626666666667 28.6346666666667C58.7413333333333 27.632 58.752 25.712 59.184 24.6986666666667C59.6746666666667 23.5413333333333 60.7786666666667 22.384 61.84 21.9146666666667C62.976 21.4133333333333 64.88 21.36 65.9306666666667 21.808C67.728 22.5706666666667 105.4186666666667 60.224 106.16 62.0053333333333C106.5386666666667 62.9066666666667 106.5386666666667 65.0933333333333 106.1653333333333 65.9893333333333C105.7013333333333 67.0986666666667 87.136 86.0053333333333 73.3386666666667 99.424C67.9786666666667 104.6346666666667 66.4 106.0533333333333 65.7653333333333 106.2293333333333C64.6613333333333 106.5333333333333 62.7466666666667 106.496 61.9573333333333 106.1493333333333" />
-    <glyph glyph-name="arrow-right-1"
-      unicode="&#x61;&#x72;&#x72;&#x6F;&#x77;&#x2D;&#x72;&#x69;&#x67;&#x68;&#x74;"
-      horiz-adv-x="128" d="M61.9573333333333 106.1493333333333C60.944 105.712 59.7066666666667 104.5226666666667 59.28 103.5733333333333C58.8053333333333 102.528 58.7573333333333 100.336 59.184 99.312C59.5733333333333 98.3786666666667 62.064 95.792 76.544 81.2586666666667L88.3626666666667 69.3973333333333L56.7786666666667 69.2853333333333L25.1946666666667 69.1733333333334L24.2773333333333 68.6346666666667C22.3573333333333 67.4986666666667 21.5466666666667 66.128 21.5466666666667 64C21.5466666666667 61.7973333333333 22.5386666666667 60.224 24.5813333333333 59.1786666666667L25.584 58.6666666666667L57.008 58.6666666666667L88.4266666666667 58.6666666666667L76.4693333333333 46.6666666666667C61.8613333333333 32.0106666666667 59.5786666666667 29.6266666666667 59.1626666666667 28.6346666666667C58.7413333333333 27.632 58.752 25.712 59.184 24.6986666666667C59.6746666666667 23.5413333333333 60.7786666666667 22.384 61.84 21.9146666666667C62.976 21.4133333333333 64.88 21.36 65.9306666666667 21.808C67.728 22.5706666666667 105.4186666666667 60.224 106.16 62.0053333333333C106.5386666666667 62.9066666666667 106.5386666666667 65.0933333333333 106.1653333333333 65.9893333333333C105.7013333333333 67.0986666666667 87.136 86.0053333333333 73.3386666666667 99.424C67.9786666666667 104.6346666666667 66.4 106.0533333333333 65.7653333333333 106.2293333333333C64.6613333333333 106.5333333333333 62.7466666666667 106.496 61.9573333333333 106.1493333333333" />
-    <glyph glyph-name="construction"
+      horiz-adv-x="128" d="M61.44 122.5173333333334C45.3653333333333 121.5733333333334 31.232 114.9386666666667 20.656 103.3706666666667C16.944 99.312 14.0853333333333 95.0933333333333 11.536 89.92C6.9813333333333 80.672 4.992 70.9706666666667 5.5626666666667 60.7786666666667C5.7973333333333 56.544 6.256 53.504 7.2533333333333 49.5893333333333C9.3173333333333 41.472 13.3973333333333 33.3386666666667 18.6453333333333 26.88C20.8213333333333 24.208 25.712 19.5093333333333 28.4853333333333 17.4293333333333C37.1786666666667 10.9226666666667 46.8 7.072 57.7066666666667 5.744C60.4106666666667 5.4133333333333 67.2586666666667 5.4186666666667 70.1866666666667 5.7493333333333C80.9333333333333 6.96 91.5146666666667 11.2373333333333 99.9626666666667 17.7866666666667C103.0933333333333 20.208 107.792 24.9066666666667 110.2133333333333 28.0373333333334C115.424 34.7573333333333 119.376 43.1146666666667 121.168 51.2C121.968 54.8106666666667 122.272 57.536 122.3893333333333 62.2186666666667C122.6133333333333 71.072 121.5146666666667 77.728 118.6133333333333 85.104C115.5413333333334 92.896 111.3226666666667 99.3813333333334 105.536 105.1946666666667C100.6133333333333 110.144 96.5493333333333 113.0773333333333 90.24 116.24C82.4693333333333 120.128 76.2293333333333 121.808 67.2 122.4426666666667C65.4986666666667 122.5653333333333 63.7706666666667 122.6453333333333 63.36 122.624C62.9493333333333 122.6026666666667 62.0853333333333 122.5546666666667 61.44 122.5173333333334M68.5493333333333 111.7866666666667C79.328 110.8906666666667 90.1173333333333 105.776 98.0266666666667 97.8133333333333C105.232 90.56 109.9573333333333 81.168 111.4933333333333 71.04C111.9573333333333 68.0053333333333 112.016 60.7893333333333 111.6053333333333 57.8133333333333C110.1066666666667 46.9813333333333 105.776 38.24 97.7333333333333 29.8133333333333C96.8693333333333 28.9066666666667 96.0746666666667 28.16 95.9733333333333 28.16C95.872 28.16 95.7866666666667 28.4693333333333 95.7866666666667 28.8533333333333C95.7813333333333 29.7386666666667 94.5386666666667 33.3546666666667 93.8133333333333 34.592C92.9706666666667 36.032 91.6746666666667 37.52 90.08 38.8746666666667C88.352 40.3466666666667 86.8586666666667 41.1733333333333 84.608 41.904L82.9333333333333 42.4533333333334L64 42.4533333333334L45.0666666666667 42.4533333333334L43.4346666666667 41.92C41.1626666666667 41.1786666666667 39.9786666666667 40.5386666666667 38.1546666666667 39.072C36.432 37.6853333333333 35.1573333333333 36.2613333333333 34.272 34.7466666666667C33.5733333333333 33.5466666666667 32.5333333333333 30.736 32.3253333333333 29.4933333333333C32.2453333333333 28.9973333333333 32.0906666666667 28.5386666666667 31.9893333333333 28.4693333333333C31.4613333333333 28.144 26.6133333333333 33.6106666666667 24.128 37.3333333333333C14.576 51.6266666666667 13.3546666666667 69.872 20.928 85.0986666666667C25.7813333333333 94.864 33.1893333333333 102.2826666666667 42.7733333333333 106.992C51.0933333333333 111.072 59.12 112.5653333333333 68.5493333333333 111.7866666666667M60.2986666666667 95.5733333333333C58.56 95.264 56.3146666666667 94.5066666666667 54.5173333333333 93.632C49.584 91.2266666666667 45.7013333333333 86.7253333333333 43.8186666666667 81.2373333333333L42.992 78.8266666666667L42.992 74.6666666666667L42.992 70.5066666666667L43.8186666666667 68.096C45.024 64.576 46.3733333333333 62.4266666666667 49.0666666666667 59.7333333333333C51.76 57.04 53.9093333333333 55.6906666666667 57.4293333333333 54.4853333333333L59.84 53.6586666666667L64 53.6586666666667L68.16 53.6586666666667L70.5706666666667 54.4853333333333C73.9306666666667 55.6373333333333 76.224 57.0506666666667 78.7413333333333 59.52C82.928 63.6266666666667 84.8266666666667 67.84 85.0613333333333 73.5306666666667C85.328 80.064 83.5893333333333 84.7946666666667 79.264 89.3493333333333C76.7253333333333 92.0213333333333 73.008 94.224 69.44 95.1733333333333C67.536 95.6746666666667 62.1813333333333 95.9146666666667 60.2986666666667 95.5733333333333M66.256 85.104C68.048 84.7733333333333 69.856 83.744 71.4666666666667 82.1333333333333C74.0693333333333 79.5306666666667 75.0346666666667 76.6026666666667 74.5013333333333 72.9493333333333C74.0213333333333 69.6426666666667 71.664 66.5653333333333 68.368 64.9386666666667L66.688 64.1066666666667L64 64.1066666666667L61.312 64.1066666666667L59.632 64.9386666666667C56.6666666666667 66.4 54.1653333333333 69.4293333333334 53.568 72.2773333333333C52.784 76.032 53.7973333333333 79.3973333333333 56.5333333333333 82.1333333333333C59.2693333333333 84.8693333333334 62.3626666666667 85.8133333333333 66.256 85.104M81.8613333333333 31.6746666666667C83.056 31.1733333333333 83.984 30.3786666666667 84.5973333333333 29.3333333333333C85.0506666666667 28.56 85.1733333333333 28.016 85.2746666666667 26.3946666666667C85.3386666666667 25.3013333333333 85.3226666666667 23.5786666666667 85.2373333333333 22.5706666666667L85.0826666666667 20.7306666666667L83.024 19.8826666666667C70.32 14.6613333333333 57.68 14.6613333333333 44.976 19.8826666666667L42.912 20.7306666666667L42.7626666666667 22.352C42.6773333333333 23.2426666666667 42.6613333333333 24.96 42.72 26.1653333333333C42.816 28.032 42.9173333333333 28.5066666666667 43.3973333333333 29.3226666666667C44 30.3573333333333 44.9226666666667 31.1573333333333 46.0906666666667 31.664C47.2106666666667 32.1493333333333 80.6986666666667 32.16 81.8613333333333 31.6746666666667" />
+    <glyph glyph-name="circle-user-1"
+      unicode="&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x75;&#x73;&#x65;&#x72;"
+      horiz-adv-x="128" d="M61.44 122.5173333333334C45.3653333333333 121.5733333333334 31.232 114.9386666666667 20.656 103.3706666666667C16.944 99.312 14.0853333333333 95.0933333333333 11.536 89.92C6.9813333333333 80.672 4.992 70.9706666666667 5.5626666666667 60.7786666666667C5.7973333333333 56.544 6.256 53.504 7.2533333333333 49.5893333333333C9.3173333333333 41.472 13.3973333333333 33.3386666666667 18.6453333333333 26.88C20.8213333333333 24.208 25.712 19.5093333333333 28.4853333333333 17.4293333333333C37.1786666666667 10.9226666666667 46.8 7.072 57.7066666666667 5.744C60.4106666666667 5.4133333333333 67.2586666666667 5.4186666666667 70.1866666666667 5.7493333333333C80.9333333333333 6.96 91.5146666666667 11.2373333333333 99.9626666666667 17.7866666666667C103.0933333333333 20.208 107.792 24.9066666666667 110.2133333333333 28.0373333333334C115.424 34.7573333333333 119.376 43.1146666666667 121.168 51.2C121.968 54.8106666666667 122.272 57.536 122.3893333333333 62.2186666666667C122.6133333333333 71.072 121.5146666666667 77.728 118.6133333333333 85.104C115.5413333333334 92.896 111.3226666666667 99.3813333333334 105.536 105.1946666666667C100.6133333333333 110.144 96.5493333333333 113.0773333333333 90.24 116.24C82.4693333333333 120.128 76.2293333333333 121.808 67.2 122.4426666666667C65.4986666666667 122.5653333333333 63.7706666666667 122.6453333333333 63.36 122.624C62.9493333333333 122.6026666666667 62.0853333333333 122.5546666666667 61.44 122.5173333333334M68.5493333333333 111.7866666666667C79.328 110.8906666666667 90.1173333333333 105.776 98.0266666666667 97.8133333333333C105.232 90.56 109.9573333333333 81.168 111.4933333333333 71.04C111.9573333333333 68.0053333333333 112.016 60.7893333333333 111.6053333333333 57.8133333333333C110.1066666666667 46.9813333333333 105.776 38.24 97.7333333333333 29.8133333333333C96.8693333333333 28.9066666666667 96.0746666666667 28.16 95.9733333333333 28.16C95.872 28.16 95.7866666666667 28.4693333333333 95.7866666666667 28.8533333333333C95.7813333333333 29.7386666666667 94.5386666666667 33.3546666666667 93.8133333333333 34.592C92.9706666666667 36.032 91.6746666666667 37.52 90.08 38.8746666666667C88.352 40.3466666666667 86.8586666666667 41.1733333333333 84.608 41.904L82.9333333333333 42.4533333333334L64 42.4533333333334L45.0666666666667 42.4533333333334L43.4346666666667 41.92C41.1626666666667 41.1786666666667 39.9786666666667 40.5386666666667 38.1546666666667 39.072C36.432 37.6853333333333 35.1573333333333 36.2613333333333 34.272 34.7466666666667C33.5733333333333 33.5466666666667 32.5333333333333 30.736 32.3253333333333 29.4933333333333C32.2453333333333 28.9973333333333 32.0906666666667 28.5386666666667 31.9893333333333 28.4693333333333C31.4613333333333 28.144 26.6133333333333 33.6106666666667 24.128 37.3333333333333C14.576 51.6266666666667 13.3546666666667 69.872 20.928 85.0986666666667C25.7813333333333 94.864 33.1893333333333 102.2826666666667 42.7733333333333 106.992C51.0933333333333 111.072 59.12 112.5653333333333 68.5493333333333 111.7866666666667M60.2986666666667 95.5733333333333C58.56 95.264 56.3146666666667 94.5066666666667 54.5173333333333 93.632C49.584 91.2266666666667 45.7013333333333 86.7253333333333 43.8186666666667 81.2373333333333L42.992 78.8266666666667L42.992 74.6666666666667L42.992 70.5066666666667L43.8186666666667 68.096C45.024 64.576 46.3733333333333 62.4266666666667 49.0666666666667 59.7333333333333C51.76 57.04 53.9093333333333 55.6906666666667 57.4293333333333 54.4853333333333L59.84 53.6586666666667L64 53.6586666666667L68.16 53.6586666666667L70.5706666666667 54.4853333333333C73.9306666666667 55.6373333333333 76.224 57.0506666666667 78.7413333333333 59.52C82.928 63.6266666666667 84.8266666666667 67.84 85.0613333333333 73.5306666666667C85.328 80.064 83.5893333333333 84.7946666666667 79.264 89.3493333333333C76.7253333333333 92.0213333333333 73.008 94.224 69.44 95.1733333333333C67.536 95.6746666666667 62.1813333333333 95.9146666666667 60.2986666666667 95.5733333333333M66.256 85.104C68.048 84.7733333333333 69.856 83.744 71.4666666666667 82.1333333333333C74.0693333333333 79.5306666666667 75.0346666666667 76.6026666666667 74.5013333333333 72.9493333333333C74.0213333333333 69.6426666666667 71.664 66.5653333333333 68.368 64.9386666666667L66.688 64.1066666666667L64 64.1066666666667L61.312 64.1066666666667L59.632 64.9386666666667C56.6666666666667 66.4 54.1653333333333 69.4293333333334 53.568 72.2773333333333C52.784 76.032 53.7973333333333 79.3973333333333 56.5333333333333 82.1333333333333C59.2693333333333 84.8693333333334 62.3626666666667 85.8133333333333 66.256 85.104M81.8613333333333 31.6746666666667C83.056 31.1733333333333 83.984 30.3786666666667 84.5973333333333 29.3333333333333C85.0506666666667 28.56 85.1733333333333 28.016 85.2746666666667 26.3946666666667C85.3386666666667 25.3013333333333 85.3226666666667 23.5786666666667 85.2373333333333 22.5706666666667L85.0826666666667 20.7306666666667L83.024 19.8826666666667C70.32 14.6613333333333 57.68 14.6613333333333 44.976 19.8826666666667L42.912 20.7306666666667L42.7626666666667 22.352C42.6773333333333 23.2426666666667 42.6613333333333 24.96 42.72 26.1653333333333C42.816 28.032 42.9173333333333 28.5066666666667 43.3973333333333 29.3226666666667C44 30.3573333333333 44.9226666666667 31.1573333333333 46.0906666666667 31.664C47.2106666666667 32.1493333333333 80.6986666666667 32.16 81.8613333333333 31.6746666666667" />
+    <glyph glyph-name="check"
       unicode="&#xF136;"
-      horiz-adv-x="128" d="M36.2666666666667 117.136C34.704 116.816 33.392 115.792 32.5653333333333 114.2453333333333C32.1333333333333 113.4346666666667 32.1066666666667 113.04 32.0373333333333 107.36L31.9626666666667 101.3333333333333L23.9306666666667 101.328C19.5093333333333 101.328 15.2213333333333 101.2266666666667 14.4 101.1093333333333C9.888 100.464 6.2026666666667 96.7786666666667 5.5573333333333 92.2666666666667C5.2693333333333 90.272 5.2693333333333 59.0613333333333 5.5573333333333 57.0666666666667C6.2026666666667 52.5546666666667 9.888 48.8693333333333 14.4 48.224C15.2213333333333 48.1066666666667 19.5146666666667 48.0053333333333 23.9413333333333 48.0053333333333L31.984 48L32.048 31.3066666666667C32.1066666666667 14.6933333333333 32.1066666666667 14.608 32.5653333333333 13.7546666666667C33.6106666666667 11.8026666666667 35.2106666666667 10.816 37.3333333333333 10.816C39.456 10.816 41.056 11.8026666666667 42.1013333333333 13.7546666666667C42.56 14.608 42.56 14.6933333333333 42.6186666666667 31.3066666666667L42.6826666666667 48L64 48L85.3173333333333 48L85.3813333333333 31.3066666666667C85.44 14.6933333333333 85.44 14.608 85.8986666666667 13.7546666666667C86.944 11.8026666666667 88.544 10.816 90.6666666666667 10.816C92.7893333333333 10.816 94.3893333333333 11.8026666666667 95.4346666666667 13.7546666666667C95.8933333333333 14.608 95.8933333333333 14.6933333333333 95.952 31.3066666666667L96.016 48L104.0586666666667 48.0053333333333C108.4853333333333 48.0053333333333 112.7786666666667 48.1066666666667 113.6 48.224C118.112 48.8693333333333 121.7973333333333 52.5546666666667 122.4426666666667 57.0666666666667C122.7306666666667 59.0613333333333 122.7306666666667 90.272 122.4426666666667 92.2666666666667C121.7973333333333 96.7786666666667 118.112 100.464 113.6 101.1093333333333C112.7786666666667 101.2266666666667 108.4906666666667 101.328 104.0693333333333 101.328L96.0373333333333 101.3333333333333L95.9626666666667 107.36C95.8933333333333 113.04 95.8666666666667 113.4346666666667 95.4346666666667 114.2453333333333C94.3893333333333 116.1973333333333 92.7893333333333 117.184 90.6666666666667 117.184C88.544 117.184 86.944 116.1973333333333 85.8986666666667 114.2453333333333C85.4666666666667 113.4346666666667 85.44 113.04 85.3706666666667 107.36L85.296 101.3333333333333L64 101.3333333333333L42.704 101.3333333333333L42.6293333333333 107.36C42.56 113.04 42.5333333333333 113.4346666666667 42.1013333333333 114.2453333333333C40.9226666666667 116.4533333333333 38.5813333333333 117.6106666666667 36.2666666666667 117.136M56.4266666666667 74.6666666666667L72.4266666666667 58.6666666666667L64 58.6666666666667L55.5733333333333 58.6666666666667L39.5733333333333 74.6666666666667L23.5733333333333 90.6666666666667L32 90.6666666666667L40.4266666666667 90.6666666666667L56.4266666666667 74.6666666666667M88.4266666666667 74.6666666666667L104.4266666666667 58.6666666666667L96 58.6666666666667L87.5733333333333 58.6666666666667L71.5733333333333 74.6666666666667L55.5733333333333 90.6666666666667L64 90.6666666666667L72.4266666666667 90.6666666666667L88.4266666666667 74.6666666666667M112 78.5066666666667C112 71.8186666666667 111.9733333333333 66.3466666666667 111.9466666666667 66.3466666666667C111.9146666666667 66.3466666666667 106.4213333333333 71.8186666666667 99.7333333333333 78.5066666666667L87.5733333333333 90.6666666666667L99.7866666666667 90.6666666666667L112 90.6666666666667L112 78.5066666666667M28.2666666666667 70.8266666666667L40.4266666666667 58.6666666666667L28.2133333333333 58.6666666666667L16 58.6666666666667L16 70.8266666666667C16 77.5146666666667 16.0266666666667 82.9866666666667 16.0533333333333 82.9866666666667C16.0853333333333 82.9866666666667 21.5786666666667 77.5146666666667 28.2666666666667 70.8266666666667" />
-    <glyph glyph-name="construction-1"
-      unicode="&#x63;&#x6F;&#x6E;&#x73;&#x74;&#x72;&#x75;&#x63;&#x74;&#x69;&#x6F;&#x6E;"
-      horiz-adv-x="128" d="M36.2666666666667 117.136C34.704 116.816 33.392 115.792 32.5653333333333 114.2453333333333C32.1333333333333 113.4346666666667 32.1066666666667 113.04 32.0373333333333 107.36L31.9626666666667 101.3333333333333L23.9306666666667 101.328C19.5093333333333 101.328 15.2213333333333 101.2266666666667 14.4 101.1093333333333C9.888 100.464 6.2026666666667 96.7786666666667 5.5573333333333 92.2666666666667C5.2693333333333 90.272 5.2693333333333 59.0613333333333 5.5573333333333 57.0666666666667C6.2026666666667 52.5546666666667 9.888 48.8693333333333 14.4 48.224C15.2213333333333 48.1066666666667 19.5146666666667 48.0053333333333 23.9413333333333 48.0053333333333L31.984 48L32.048 31.3066666666667C32.1066666666667 14.6933333333333 32.1066666666667 14.608 32.5653333333333 13.7546666666667C33.6106666666667 11.8026666666667 35.2106666666667 10.816 37.3333333333333 10.816C39.456 10.816 41.056 11.8026666666667 42.1013333333333 13.7546666666667C42.56 14.608 42.56 14.6933333333333 42.6186666666667 31.3066666666667L42.6826666666667 48L64 48L85.3173333333333 48L85.3813333333333 31.3066666666667C85.44 14.6933333333333 85.44 14.608 85.8986666666667 13.7546666666667C86.944 11.8026666666667 88.544 10.816 90.6666666666667 10.816C92.7893333333333 10.816 94.3893333333333 11.8026666666667 95.4346666666667 13.7546666666667C95.8933333333333 14.608 95.8933333333333 14.6933333333333 95.952 31.3066666666667L96.016 48L104.0586666666667 48.0053333333333C108.4853333333333 48.0053333333333 112.7786666666667 48.1066666666667 113.6 48.224C118.112 48.8693333333333 121.7973333333333 52.5546666666667 122.4426666666667 57.0666666666667C122.7306666666667 59.0613333333333 122.7306666666667 90.272 122.4426666666667 92.2666666666667C121.7973333333333 96.7786666666667 118.112 100.464 113.6 101.1093333333333C112.7786666666667 101.2266666666667 108.4906666666667 101.328 104.0693333333333 101.328L96.0373333333333 101.3333333333333L95.9626666666667 107.36C95.8933333333333 113.04 95.8666666666667 113.4346666666667 95.4346666666667 114.2453333333333C94.3893333333333 116.1973333333333 92.7893333333333 117.184 90.6666666666667 117.184C88.544 117.184 86.944 116.1973333333333 85.8986666666667 114.2453333333333C85.4666666666667 113.4346666666667 85.44 113.04 85.3706666666667 107.36L85.296 101.3333333333333L64 101.3333333333333L42.704 101.3333333333333L42.6293333333333 107.36C42.56 113.04 42.5333333333333 113.4346666666667 42.1013333333333 114.2453333333333C40.9226666666667 116.4533333333333 38.5813333333333 117.6106666666667 36.2666666666667 117.136M56.4266666666667 74.6666666666667L72.4266666666667 58.6666666666667L64 58.6666666666667L55.5733333333333 58.6666666666667L39.5733333333333 74.6666666666667L23.5733333333333 90.6666666666667L32 90.6666666666667L40.4266666666667 90.6666666666667L56.4266666666667 74.6666666666667M88.4266666666667 74.6666666666667L104.4266666666667 58.6666666666667L96 58.6666666666667L87.5733333333333 58.6666666666667L71.5733333333333 74.6666666666667L55.5733333333333 90.6666666666667L64 90.6666666666667L72.4266666666667 90.6666666666667L88.4266666666667 74.6666666666667M112 78.5066666666667C112 71.8186666666667 111.9733333333333 66.3466666666667 111.9466666666667 66.3466666666667C111.9146666666667 66.3466666666667 106.4213333333333 71.8186666666667 99.7333333333333 78.5066666666667L87.5733333333333 90.6666666666667L99.7866666666667 90.6666666666667L112 90.6666666666667L112 78.5066666666667M28.2666666666667 70.8266666666667L40.4266666666667 58.6666666666667L28.2133333333333 58.6666666666667L16 58.6666666666667L16 70.8266666666667C16 77.5146666666667 16.0266666666667 82.9866666666667 16.0533333333333 82.9866666666667C16.0853333333333 82.9866666666667 21.5786666666667 77.5146666666667 28.2666666666667 70.8266666666667" />
-    <glyph glyph-name="file-down"
+      horiz-adv-x="128" d="M104.5653333333333 100.7946666666667C103.7066666666667 100.4213333333333 98.9706666666667 95.7706666666667 70.1333333333333 66.9973333333333L48 44.9066666666667L38.3466666666667 54.5226666666667C23.376 69.424 23.728 69.12 21.5253333333333 69.12C19.2533333333333 69.12 17.5306666666667 68.0906666666667 16.6453333333333 66.2026666666667C16.08 65.008 16.016 63.184 16.4906666666667 62.0426666666667C17.2213333333333 60.2933333333333 44.2506666666667 33.2373333333333 46 32.5066666666667C46.9013333333333 32.1333333333333 49.088 32.128 49.984 32.5013333333334C51.728 33.232 110.768 92.2613333333333 111.4933333333333 94.0053333333333C111.888 94.944 111.8666666666667 97.104 111.456 98.0853333333333C110.688 99.9253333333333 108.768 101.1253333333334 106.6186666666667 101.1093333333333C105.8826666666667 101.1093333333333 104.96 100.9653333333333 104.5653333333333 100.7946666666667" />
+    <glyph glyph-name="check-1"
+      unicode="&#x63;&#x68;&#x65;&#x63;&#x6B;"
+      horiz-adv-x="128" d="M104.5653333333333 100.7946666666667C103.7066666666667 100.4213333333333 98.9706666666667 95.7706666666667 70.1333333333333 66.9973333333333L48 44.9066666666667L38.3466666666667 54.5226666666667C23.376 69.424 23.728 69.12 21.5253333333333 69.12C19.2533333333333 69.12 17.5306666666667 68.0906666666667 16.6453333333333 66.2026666666667C16.08 65.008 16.016 63.184 16.4906666666667 62.0426666666667C17.2213333333333 60.2933333333333 44.2506666666667 33.2373333333333 46 32.5066666666667C46.9013333333333 32.1333333333333 49.088 32.128 49.984 32.5013333333334C51.728 33.232 110.768 92.2613333333333 111.4933333333333 94.0053333333333C111.888 94.944 111.8666666666667 97.104 111.456 98.0853333333333C110.688 99.9253333333333 108.768 101.1253333333334 106.6186666666667 101.1093333333333C105.8826666666667 101.1093333333333 104.96 100.9653333333333 104.5653333333333 100.7946666666667" />
+    <glyph glyph-name="database-off"
       unicode="&#xF137;"
-      horiz-adv-x="128" d="M30.08 122.4586666666667C26.4853333333333 122.0746666666667 23.5306666666667 120.6133333333333 20.7893333333333 117.8773333333334C18.6133333333333 115.696 17.44 113.7226666666667 16.5973333333333 110.816L16.1066666666667 109.12L16.1066666666667 64L16.1066666666667 18.88L16.5973333333333 17.184C17.44 14.2773333333333 18.6133333333333 12.304 20.7893333333333 10.1226666666667C22.9706666666667 7.9466666666667 24.944 6.7733333333333 27.8506666666667 5.9306666666667L29.5466666666667 5.44L64 5.44L98.4533333333333 5.44L100.1493333333333 5.9306666666667C103.056 6.7733333333333 105.0293333333333 7.9466666666667 107.2106666666667 10.1226666666667C109.3866666666667 12.304 110.56 14.2773333333333 111.4026666666667 17.184L111.8933333333333 18.88L111.8933333333333 55.36L111.8933333333333 91.84L111.4026666666667 92.9066666666667C111.008 93.776 108.3413333333333 96.544 97.1093333333333 107.776C85.8773333333333 119.008 83.1093333333333 121.6746666666667 82.24 122.0693333333333L81.1733333333333 122.56L56.32 122.5866666666667C42.6506666666667 122.5973333333334 30.8426666666667 122.544 30.08 122.4586666666667M69.3866666666667 102.6666666666667C69.4933333333333 92.112 69.5253333333333 91.8986666666667 71.312 88.432C72.5493333333333 86.0373333333333 75.3706666666667 83.216 77.7653333333333 81.9786666666667C81.232 80.192 81.4453333333333 80.16 92 80.0533333333333L101.3333333333333 79.9573333333333L101.3333333333333 50.0586666666667L101.328 20.16L100.8266666666667 19.0933333333333C100.2186666666667 17.8133333333333 99.424 17.0293333333333 98.1333333333333 16.4426666666667C97.1786666666667 16.0106666666667 96.9173333333333 16.0106666666667 64 16.0106666666667C31.0826666666667 16.0106666666667 30.8213333333333 16.0106666666667 29.8666666666667 16.4426666666667C28.576 17.0293333333333 27.7813333333333 17.8133333333333 27.1733333333333 19.0933333333333L26.672 20.16L26.672 64C26.6773333333333 107.648 26.6773333333333 107.8453333333333 27.1093333333333 108.8C27.696 110.0906666666667 28.48 110.8853333333333 29.76 111.4933333333333L30.8266666666667 111.9946666666667L50.0586666666667 112L69.2906666666667 112L69.3866666666667 102.6666666666667M91.68 90.7146666666667C85.312 90.6613333333333 84.256 90.6986666666667 83.4453333333333 91.008C82.16 91.4933333333333 81.088 92.496 80.5013333333333 93.76C80.0106666666667 94.8106666666667 80.0053333333333 94.9226666666667 80 102.2933333333333L80 109.76L89.4933333333333 100.2666666666667L98.9866666666667 90.7733333333333L91.68 90.7146666666667M62.9333333333333 69.136C61.3706666666667 68.816 60.064 67.792 59.232 66.2453333333333C58.784 65.408 58.7733333333333 65.152 58.7093333333333 55.1733333333333L58.6453333333333 44.9546666666667L54.976 48.5813333333333C50.7946666666667 52.7146666666667 50.0853333333333 53.184 48 53.184C45.872 53.184 44.24 52.1706666666667 43.2533333333333 50.2453333333333C42.6346666666667 49.0293333333333 42.656 46.9386666666667 43.296 45.6533333333333C43.968 44.3093333333333 60.3093333333333 27.968 61.6533333333333 27.296C62.352 26.9493333333333 62.9866666666667 26.816 64 26.816C65.0133333333333 26.816 65.648 26.9493333333333 66.3466666666667 27.296C67.6906666666667 27.968 84.032 44.3093333333333 84.704 45.6533333333333C85.344 46.9386666666667 85.3653333333333 49.0293333333333 84.7466666666667 50.2453333333333C83.76 52.1706666666667 82.128 53.184 80 53.184C77.9146666666667 53.184 77.2053333333333 52.7146666666667 73.024 48.5813333333333L69.3546666666667 44.9546666666667L69.2906666666667 55.1733333333333C69.2266666666667 65.152 69.216 65.408 68.768 66.2453333333333C67.584 68.4533333333334 65.248 69.6106666666667 62.9333333333333 69.136" />
-    <glyph glyph-name="file-down-1"
-      unicode="&#x66;&#x69;&#x6C;&#x65;&#x2D;&#x64;&#x6F;&#x77;&#x6E;"
-      horiz-adv-x="128" d="M30.08 122.4586666666667C26.4853333333333 122.0746666666667 23.5306666666667 120.6133333333333 20.7893333333333 117.8773333333334C18.6133333333333 115.696 17.44 113.7226666666667 16.5973333333333 110.816L16.1066666666667 109.12L16.1066666666667 64L16.1066666666667 18.88L16.5973333333333 17.184C17.44 14.2773333333333 18.6133333333333 12.304 20.7893333333333 10.1226666666667C22.9706666666667 7.9466666666667 24.944 6.7733333333333 27.8506666666667 5.9306666666667L29.5466666666667 5.44L64 5.44L98.4533333333333 5.44L100.1493333333333 5.9306666666667C103.056 6.7733333333333 105.0293333333333 7.9466666666667 107.2106666666667 10.1226666666667C109.3866666666667 12.304 110.56 14.2773333333333 111.4026666666667 17.184L111.8933333333333 18.88L111.8933333333333 55.36L111.8933333333333 91.84L111.4026666666667 92.9066666666667C111.008 93.776 108.3413333333333 96.544 97.1093333333333 107.776C85.8773333333333 119.008 83.1093333333333 121.6746666666667 82.24 122.0693333333333L81.1733333333333 122.56L56.32 122.5866666666667C42.6506666666667 122.5973333333334 30.8426666666667 122.544 30.08 122.4586666666667M69.3866666666667 102.6666666666667C69.4933333333333 92.112 69.5253333333333 91.8986666666667 71.312 88.432C72.5493333333333 86.0373333333333 75.3706666666667 83.216 77.7653333333333 81.9786666666667C81.232 80.192 81.4453333333333 80.16 92 80.0533333333333L101.3333333333333 79.9573333333333L101.3333333333333 50.0586666666667L101.328 20.16L100.8266666666667 19.0933333333333C100.2186666666667 17.8133333333333 99.424 17.0293333333333 98.1333333333333 16.4426666666667C97.1786666666667 16.0106666666667 96.9173333333333 16.0106666666667 64 16.0106666666667C31.0826666666667 16.0106666666667 30.8213333333333 16.0106666666667 29.8666666666667 16.4426666666667C28.576 17.0293333333333 27.7813333333333 17.8133333333333 27.1733333333333 19.0933333333333L26.672 20.16L26.672 64C26.6773333333333 107.648 26.6773333333333 107.8453333333333 27.1093333333333 108.8C27.696 110.0906666666667 28.48 110.8853333333333 29.76 111.4933333333333L30.8266666666667 111.9946666666667L50.0586666666667 112L69.2906666666667 112L69.3866666666667 102.6666666666667M91.68 90.7146666666667C85.312 90.6613333333333 84.256 90.6986666666667 83.4453333333333 91.008C82.16 91.4933333333333 81.088 92.496 80.5013333333333 93.76C80.0106666666667 94.8106666666667 80.0053333333333 94.9226666666667 80 102.2933333333333L80 109.76L89.4933333333333 100.2666666666667L98.9866666666667 90.7733333333333L91.68 90.7146666666667M62.9333333333333 69.136C61.3706666666667 68.816 60.064 67.792 59.232 66.2453333333333C58.784 65.408 58.7733333333333 65.152 58.7093333333333 55.1733333333333L58.6453333333333 44.9546666666667L54.976 48.5813333333333C50.7946666666667 52.7146666666667 50.0853333333333 53.184 48 53.184C45.872 53.184 44.24 52.1706666666667 43.2533333333333 50.2453333333333C42.6346666666667 49.0293333333333 42.656 46.9386666666667 43.296 45.6533333333333C43.968 44.3093333333333 60.3093333333333 27.968 61.6533333333333 27.296C62.352 26.9493333333333 62.9866666666667 26.816 64 26.816C65.0133333333333 26.816 65.648 26.9493333333333 66.3466666666667 27.296C67.6906666666667 27.968 84.032 44.3093333333333 84.704 45.6533333333333C85.344 46.9386666666667 85.3653333333333 49.0293333333333 84.7466666666667 50.2453333333333C83.76 52.1706666666667 82.128 53.184 80 53.184C77.9146666666667 53.184 77.2053333333333 52.7146666666667 73.024 48.5813333333333L69.3546666666667 44.9546666666667L69.2906666666667 55.1733333333333C69.2266666666667 65.152 69.216 65.408 68.768 66.2453333333333C67.584 68.4533333333334 65.248 69.6106666666667 62.9333333333333 69.136" />
-    <glyph glyph-name="circle-divide"
+      horiz-adv-x="128" d="M60.16 125.0425263157895C46.0871111111111 124.645052631579 33.6497777777778 122.469052631579 24.3555555555556 118.784C20.3591111111111 117.1941052631579 17.7066666666667 115.6311578947369 15.2248888888889 113.3945263157895C13.248 111.616 12.0888888888889 109.952 11.4062222222222 107.9309473684211L10.88 106.3545263157895L10.88 69.0256842105263C10.8871111111111 28.0993684210526 10.8017777777778 30.848 12.1671111111111 28.2206315789474C13.5253333333333 25.6 17.5217777777778 22.2989473684211 21.7457777777778 20.2846315789474C28.5155555555556 17.0644210526316 38.1866666666667 14.7132631578947 49.2017777777778 13.6016842105263C51.2782222222222 13.3861052631579 51.712 13.3995789473684 52.6222222222222 13.6892631578948C54.9048888888889 14.4033684210526 56.32 16.2762105263158 56.3128888888889 18.56C56.3128888888889 20.096 55.8151111111111 21.1469473684211 54.5777777777778 22.2248421052632C53.3475555555556 23.2892631578948 52.9066666666667 23.4105263157895 48.5333333333333 23.909052631579C36.3591111111111 25.3035789473684 26.6666666666667 28.288 22.6702222222222 31.8652631578948L21.5466666666667 32.869052631579L21.5466666666667 44.4833684210526C21.5466666666667 55.4576842105263 21.568 56.0842105263158 21.9235555555556 55.9494736842105C24.8533333333333 54.8244210526316 28.6151111111111 53.8206315789474 33.28 52.9111578947368C37.6675555555556 52.0623157894737 49.6711111111111 50.1894736842105 50.752 50.1894736842105C52.7857777777778 50.1894736842105 54.8764444444444 51.6715789473684 55.5662222222222 53.5983157894737C56.1635555555556 55.2555789473684 55.936 56.6164210526316 54.784 58.2197894736842C53.6888888888889 59.749052631579 53.0346666666667 59.9646315789474 46.5066666666667 61.0021052631579C36.8355555555556 62.5313684210526 30.4995555555556 63.7844210526316 27.6266666666667 64.7343157894737C25.8773333333333 65.3136842105263 23.7013333333333 66.5734736842105 22.528 67.685052631579L21.5466666666667 68.6147368421053L21.5466666666667 80.2021052631579L21.5466666666667 91.7827368421053L24.1564444444444 90.7115789473684C29.6035555555556 88.4816842105263 37.0773333333333 86.629052631579 44.9066666666667 85.5646315789474C51.6053333333333 84.6551578947369 54.9546666666667 84.4665263157895 64.4266666666667 84.4530526315789C73.344 84.4463157894737 75.8613333333333 84.5608421052632 81.9697777777778 85.2614736842105C91.1786666666667 86.3124210526316 100.1457777777778 88.4749473684211 106.0622222222222 91.0686315789474L107.7048888888889 91.7827368421053L107.7688888888889 84.581052631579C107.8471111111111 76.416 107.8755555555556 76.288 109.6035555555556 74.8058947368421C110.4426666666667 74.0917894736842 112.1564444444445 73.4315789473684 113.1733333333333 73.4315789473684C114.2471111111111 73.4315789473684 115.9111111111111 74.0917894736842 116.8071111111111 74.8732631578947C118.5848888888889 76.4227368421053 118.5066666666667 75.6682105263158 118.5066666666667 91.9242105263158C118.5066666666667 106.1861052631579 118.5066666666667 106.2804210526316 118.0302222222222 107.6884210526316C115.9466666666667 113.9334736842105 108.7857777777778 118.4 95.36 121.8155789473684C89.8915555555556 123.2101052631579 82.3182222222222 124.3082105263158 75.0933333333333 124.7461052631579C71.3031111111111 124.9818947368421 63.4524444444444 125.1368421052632 60.16 125.0425263157895M74.0266666666667 114.6543157894737C89.4008888888889 113.6505263157895 102.5706666666667 110.1338947368421 106.944 105.8694736842105C107.8968888888889 104.9397894736842 107.9253333333333 104.576 107.1004444444444 103.6867368421053C103.7368888888889 100.0555789473684 91.7262222222222 96.4042105263158 79.0968888888889 95.1646315789474C68.352 94.1069473684211 55.9431111111111 94.3023157894737 45.9733333333333 95.6766315789474C36.5226666666667 96.9835789473684 28.1528888888889 99.5166315789474 23.8435555555556 102.3797894736842C22.6631111111111 103.168 21.5466666666667 104.3132631578947 21.5466666666667 104.7376842105263C21.5466666666667 105.1284210526316 22.8977777777778 106.4016842105263 24.1706666666667 107.2235789473684C29.824 110.8614736842105 42.24 113.8661052631579 54.8266666666667 114.6408421052632C58.7306666666667 114.8833684210526 70.4426666666667 114.8901052631579 74.0266666666667 114.6543157894737M68.9422222222222 60.9347368421053C66.8017777777778 60.2071578947368 65.4791111111111 58.4421052631579 65.4648888888889 56.2863157894737C65.4506666666667 54.0092631578948 65.5288888888889 53.9149473684211 74.8302222222222 45.0896842105263L83.2924444444444 37.0526315789474L74.8302222222222 29.0223157894737C68.1173333333333 22.6492631578948 66.2755555555556 20.7831578947369 65.9128888888889 20.0084210526316C65.3084444444444 18.7082105263158 65.3084444444444 16.9229473684211 65.92 15.7305263157895C67.1715555555556 13.2783157894737 70.5208888888889 12.1397894736842 73.0168888888889 13.3187368421053C73.3937777777778 13.5006315789474 77.568 17.3002105263158 82.2897777777778 21.76L90.8728888888889 29.8711578947368L99.4631111111111 21.7734736842105C105.0666666666667 16.4917894736842 108.352 13.541052631579 108.9066666666667 13.2917894736842C110.0657777777778 12.7797894736842 112.2488888888889 12.7797894736842 113.3653333333333 13.2985263157895C114.3537777777778 13.7566315789474 115.4844444444444 14.7873684210526 115.968 15.6631578947369C116.16 16.0134736842105 116.3662222222222 16.8286315789474 116.4231111111111 17.4821052631579C116.6506666666667 19.7928421052632 116.7431111111111 19.6715789473684 107.1217777777778 28.8134736842105L98.4604444444444 37.0526315789474L107.1217777777778 45.2917894736842C116.7431111111111 54.4336842105263 116.6506666666667 54.3124210526316 116.4231111111111 56.6231578947369C116.3662222222222 57.2766315789474 116.16 58.0917894736842 115.968 58.4421052631579C115.4844444444444 59.3178947368421 114.3537777777778 60.3486315789474 113.3653333333333 60.8067368421053C112.2488888888889 61.3254736842105 110.0657777777778 61.3254736842105 108.9066666666667 60.8134736842105C108.352 60.5642105263158 105.0666666666667 57.6134736842105 99.4631111111111 52.3317894736842L90.8728888888889 44.2341052631579L82.2897777777778 52.3452631578948C77.568 56.805052631579 73.3866666666667 60.6113684210527 72.9884444444444 60.8C71.8791111111111 61.3254736842105 70.2648888888889 61.3793684210527 68.9422222222222 60.9347368421053" />
+    <glyph glyph-name="database-off-1"
+      unicode="&#x64;&#x61;&#x74;&#x61;&#x62;&#x61;&#x73;&#x65;&#x2D;&#x6F;&#x66;&#x66;"
+      horiz-adv-x="128" d="M60.16 125.0425263157895C46.0871111111111 124.645052631579 33.6497777777778 122.469052631579 24.3555555555556 118.784C20.3591111111111 117.1941052631579 17.7066666666667 115.6311578947369 15.2248888888889 113.3945263157895C13.248 111.616 12.0888888888889 109.952 11.4062222222222 107.9309473684211L10.88 106.3545263157895L10.88 69.0256842105263C10.8871111111111 28.0993684210526 10.8017777777778 30.848 12.1671111111111 28.2206315789474C13.5253333333333 25.6 17.5217777777778 22.2989473684211 21.7457777777778 20.2846315789474C28.5155555555556 17.0644210526316 38.1866666666667 14.7132631578947 49.2017777777778 13.6016842105263C51.2782222222222 13.3861052631579 51.712 13.3995789473684 52.6222222222222 13.6892631578948C54.9048888888889 14.4033684210526 56.32 16.2762105263158 56.3128888888889 18.56C56.3128888888889 20.096 55.8151111111111 21.1469473684211 54.5777777777778 22.2248421052632C53.3475555555556 23.2892631578948 52.9066666666667 23.4105263157895 48.5333333333333 23.909052631579C36.3591111111111 25.3035789473684 26.6666666666667 28.288 22.6702222222222 31.8652631578948L21.5466666666667 32.869052631579L21.5466666666667 44.4833684210526C21.5466666666667 55.4576842105263 21.568 56.0842105263158 21.9235555555556 55.9494736842105C24.8533333333333 54.8244210526316 28.6151111111111 53.8206315789474 33.28 52.9111578947368C37.6675555555556 52.0623157894737 49.6711111111111 50.1894736842105 50.752 50.1894736842105C52.7857777777778 50.1894736842105 54.8764444444444 51.6715789473684 55.5662222222222 53.5983157894737C56.1635555555556 55.2555789473684 55.936 56.6164210526316 54.784 58.2197894736842C53.6888888888889 59.749052631579 53.0346666666667 59.9646315789474 46.5066666666667 61.0021052631579C36.8355555555556 62.5313684210526 30.4995555555556 63.7844210526316 27.6266666666667 64.7343157894737C25.8773333333333 65.3136842105263 23.7013333333333 66.5734736842105 22.528 67.685052631579L21.5466666666667 68.6147368421053L21.5466666666667 80.2021052631579L21.5466666666667 91.7827368421053L24.1564444444444 90.7115789473684C29.6035555555556 88.4816842105263 37.0773333333333 86.629052631579 44.9066666666667 85.5646315789474C51.6053333333333 84.6551578947369 54.9546666666667 84.4665263157895 64.4266666666667 84.4530526315789C73.344 84.4463157894737 75.8613333333333 84.5608421052632 81.9697777777778 85.2614736842105C91.1786666666667 86.3124210526316 100.1457777777778 88.4749473684211 106.0622222222222 91.0686315789474L107.7048888888889 91.7827368421053L107.7688888888889 84.581052631579C107.8471111111111 76.416 107.8755555555556 76.288 109.6035555555556 74.8058947368421C110.4426666666667 74.0917894736842 112.1564444444445 73.4315789473684 113.1733333333333 73.4315789473684C114.2471111111111 73.4315789473684 115.9111111111111 74.0917894736842 116.8071111111111 74.8732631578947C118.5848888888889 76.4227368421053 118.5066666666667 75.6682105263158 118.5066666666667 91.9242105263158C118.5066666666667 106.1861052631579 118.5066666666667 106.2804210526316 118.0302222222222 107.6884210526316C115.9466666666667 113.9334736842105 108.7857777777778 118.4 95.36 121.8155789473684C89.8915555555556 123.2101052631579 82.3182222222222 124.3082105263158 75.0933333333333 124.7461052631579C71.3031111111111 124.9818947368421 63.4524444444444 125.1368421052632 60.16 125.0425263157895M74.0266666666667 114.6543157894737C89.4008888888889 113.6505263157895 102.5706666666667 110.1338947368421 106.944 105.8694736842105C107.8968888888889 104.9397894736842 107.9253333333333 104.576 107.1004444444444 103.6867368421053C103.7368888888889 100.0555789473684 91.7262222222222 96.4042105263158 79.0968888888889 95.1646315789474C68.352 94.1069473684211 55.9431111111111 94.3023157894737 45.9733333333333 95.6766315789474C36.5226666666667 96.9835789473684 28.1528888888889 99.5166315789474 23.8435555555556 102.3797894736842C22.6631111111111 103.168 21.5466666666667 104.3132631578947 21.5466666666667 104.7376842105263C21.5466666666667 105.1284210526316 22.8977777777778 106.4016842105263 24.1706666666667 107.2235789473684C29.824 110.8614736842105 42.24 113.8661052631579 54.8266666666667 114.6408421052632C58.7306666666667 114.8833684210526 70.4426666666667 114.8901052631579 74.0266666666667 114.6543157894737M68.9422222222222 60.9347368421053C66.8017777777778 60.2071578947368 65.4791111111111 58.4421052631579 65.4648888888889 56.2863157894737C65.4506666666667 54.0092631578948 65.5288888888889 53.9149473684211 74.8302222222222 45.0896842105263L83.2924444444444 37.0526315789474L74.8302222222222 29.0223157894737C68.1173333333333 22.6492631578948 66.2755555555556 20.7831578947369 65.9128888888889 20.0084210526316C65.3084444444444 18.7082105263158 65.3084444444444 16.9229473684211 65.92 15.7305263157895C67.1715555555556 13.2783157894737 70.5208888888889 12.1397894736842 73.0168888888889 13.3187368421053C73.3937777777778 13.5006315789474 77.568 17.3002105263158 82.2897777777778 21.76L90.8728888888889 29.8711578947368L99.4631111111111 21.7734736842105C105.0666666666667 16.4917894736842 108.352 13.541052631579 108.9066666666667 13.2917894736842C110.0657777777778 12.7797894736842 112.2488888888889 12.7797894736842 113.3653333333333 13.2985263157895C114.3537777777778 13.7566315789474 115.4844444444444 14.7873684210526 115.968 15.6631578947369C116.16 16.0134736842105 116.3662222222222 16.8286315789474 116.4231111111111 17.4821052631579C116.6506666666667 19.7928421052632 116.7431111111111 19.6715789473684 107.1217777777778 28.8134736842105L98.4604444444444 37.0526315789474L107.1217777777778 45.2917894736842C116.7431111111111 54.4336842105263 116.6506666666667 54.3124210526316 116.4231111111111 56.6231578947369C116.3662222222222 57.2766315789474 116.16 58.0917894736842 115.968 58.4421052631579C115.4844444444444 59.3178947368421 114.3537777777778 60.3486315789474 113.3653333333333 60.8067368421053C112.2488888888889 61.3254736842105 110.0657777777778 61.3254736842105 108.9066666666667 60.8134736842105C108.352 60.5642105263158 105.0666666666667 57.6134736842105 99.4631111111111 52.3317894736842L90.8728888888889 44.2341052631579L82.2897777777778 52.3452631578948C77.568 56.805052631579 73.3866666666667 60.6113684210527 72.9884444444444 60.8C71.8791111111111 61.3254736842105 70.2648888888889 61.3793684210527 68.9422222222222 60.9347368421053" />
+    <glyph glyph-name="log-out"
       unicode="&#xF138;"
-      horiz-adv-x="128" d="M60.16 122.4373333333333C48.3626666666667 121.7066666666667 36.6826666666667 117.1786666666667 27.312 109.712C24.704 107.632 20.368 103.296 18.288 100.688C13.088 94.16 9.0293333333333 85.904 7.0666666666667 77.8346666666667C4.9173333333333 69.0346666666667 4.9173333333333 58.9653333333333 7.0666666666667 50.1653333333333C9.0293333333333 42.096 13.088 33.84 18.288 27.312C20.368 24.704 24.704 20.368 27.312 18.288C32.192 14.4 39.0506666666667 10.608 44.7253333333333 8.6666666666667C59.7493333333333 3.52 75.8186666666667 4.5333333333333 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M62.192 95.7706666666667C60.256 95.4773333333333 58.0053333333333 94.304 56.5173333333333 92.816C51.424 87.7226666666667 52.896 78.8906666666667 59.3493333333333 75.84C65.8773333333333 72.752 73.4613333333333 76.7413333333333 74.448 83.7866666666667C75.456 90.9706666666667 69.4293333333333 96.864 62.192 95.7706666666667M41.6 69.136C39.1306666666667 68.6293333333333 37.4826666666667 66.576 37.4826666666667 64C37.4826666666667 61.8773333333333 38.4693333333333 60.2773333333333 40.4213333333333 59.232L41.28 58.7733333333333L64 58.7733333333333L86.72 58.7733333333333L87.5786666666667 59.232C89.5306666666667 60.2773333333333 90.5173333333333 61.8773333333333 90.5173333333333 64C90.5173333333333 66.1226666666667 89.5306666666667 67.7226666666667 87.5786666666667 68.768L86.72 69.2266666666667L64.5333333333333 69.2586666666667C52.3306666666667 69.2746666666667 42.0106666666667 69.2213333333333 41.6 69.136M62.192 53.104C60.256 52.8106666666667 58.0053333333333 51.6373333333333 56.5173333333333 50.1493333333333C51.424 45.056 52.896 36.224 59.3493333333333 33.1733333333333C65.8773333333333 30.0853333333333 73.4613333333333 34.0746666666667 74.448 41.12C75.456 48.304 69.4293333333333 54.1973333333334 62.192 53.104" />
-    <glyph glyph-name="circle-divide-1"
-      unicode="&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x64;&#x69;&#x76;&#x69;&#x64;&#x65;"
-      horiz-adv-x="128" d="M60.16 122.4373333333333C48.3626666666667 121.7066666666667 36.6826666666667 117.1786666666667 27.312 109.712C24.704 107.632 20.368 103.296 18.288 100.688C13.088 94.16 9.0293333333333 85.904 7.0666666666667 77.8346666666667C4.9173333333333 69.0346666666667 4.9173333333333 58.9653333333333 7.0666666666667 50.1653333333333C9.0293333333333 42.096 13.088 33.84 18.288 27.312C20.368 24.704 24.704 20.368 27.312 18.288C32.192 14.4 39.0506666666667 10.608 44.7253333333333 8.6666666666667C59.7493333333333 3.52 75.8186666666667 4.5333333333333 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M62.192 95.7706666666667C60.256 95.4773333333333 58.0053333333333 94.304 56.5173333333333 92.816C51.424 87.7226666666667 52.896 78.8906666666667 59.3493333333333 75.84C65.8773333333333 72.752 73.4613333333333 76.7413333333333 74.448 83.7866666666667C75.456 90.9706666666667 69.4293333333333 96.864 62.192 95.7706666666667M41.6 69.136C39.1306666666667 68.6293333333333 37.4826666666667 66.576 37.4826666666667 64C37.4826666666667 61.8773333333333 38.4693333333333 60.2773333333333 40.4213333333333 59.232L41.28 58.7733333333333L64 58.7733333333333L86.72 58.7733333333333L87.5786666666667 59.232C89.5306666666667 60.2773333333333 90.5173333333333 61.8773333333333 90.5173333333333 64C90.5173333333333 66.1226666666667 89.5306666666667 67.7226666666667 87.5786666666667 68.768L86.72 69.2266666666667L64.5333333333333 69.2586666666667C52.3306666666667 69.2746666666667 42.0106666666667 69.2213333333333 41.6 69.136M62.192 53.104C60.256 52.8106666666667 58.0053333333333 51.6373333333333 56.5173333333333 50.1493333333333C51.424 45.056 52.896 36.224 59.3493333333333 33.1733333333333C65.8773333333333 30.0853333333333 73.4613333333333 34.0746666666667 74.448 41.12C75.456 48.304 69.4293333333333 54.1973333333334 62.192 53.104" />
-    <glyph glyph-name="network"
+      horiz-adv-x="128" d="M24.7466666666667 117.1306666666667C21.1413333333333 116.736 18.1973333333333 115.28 15.456 112.544C13.28 110.3626666666667 12.1066666666667 108.3893333333333 11.264 105.4826666666667L10.7733333333333 103.7866666666667L10.7733333333333 64L10.7733333333333 24.2133333333333L11.264 22.5173333333333C12.1066666666667 19.6106666666667 13.28 17.6373333333333 15.456 15.456C17.6373333333333 13.28 19.6106666666667 12.1066666666667 22.5173333333333 11.264C24.2026666666667 10.7786666666667 24.2986666666667 10.7733333333333 36.8 10.7733333333333C49.2693333333333 10.7733333333333 49.392 10.7786666666667 50.2453333333333 11.232C52.1973333333333 12.2773333333333 53.184 13.8773333333333 53.184 16C53.184 18.1226666666667 52.1973333333333 19.7226666666667 50.2453333333333 20.768C49.4026666666667 21.216 49.1573333333333 21.2266666666667 37.2266666666667 21.3333333333333C25.2746666666667 21.44 25.0506666666667 21.4453333333333 24.2133333333333 21.8986666666667C23.0986666666667 22.5013333333334 22.3146666666667 23.3493333333333 21.776 24.5333333333333C21.344 25.488 21.344 25.7173333333333 21.344 64C21.344 102.2826666666667 21.344 102.512 21.776 103.4666666666667C22.3146666666667 104.6506666666667 23.0986666666667 105.4986666666667 24.2133333333333 106.1013333333333C25.0506666666667 106.5546666666667 25.2746666666667 106.56 37.2266666666667 106.6666666666667C49.1573333333333 106.7733333333333 49.4026666666667 106.784 50.2453333333333 107.232C52.1973333333333 108.2773333333333 53.184 109.8773333333333 53.184 112C53.184 114.1226666666667 52.1973333333333 115.7226666666667 50.2453333333333 116.768C49.3973333333333 117.2213333333333 49.2213333333333 117.2266666666667 37.76 117.2533333333333C31.3653333333333 117.2693333333333 25.5093333333333 117.216 24.7466666666667 117.1306666666667M84.2666666666667 95.8026666666667C82.6933333333333 95.4826666666667 81.3653333333333 94.4373333333333 80.5866666666667 92.912C79.968 91.696 79.9893333333333 89.6053333333333 80.6346666666667 88.32C80.9653333333333 87.6586666666667 83.92 84.544 90.0906666666667 78.352L99.072 69.344L72.8426666666667 69.2853333333333L46.6133333333333 69.2266666666667L45.7546666666667 68.768C43.8026666666667 67.7226666666667 42.816 66.1226666666667 42.816 64C42.816 61.8773333333333 43.8026666666667 60.2773333333333 45.7546666666667 59.232L46.6133333333333 58.7733333333333L72.8426666666667 58.7146666666667L99.072 58.656L90.0906666666667 49.648C83.92 43.456 80.9653333333333 40.3413333333333 80.6346666666667 39.68C79.664 37.7493333333333 80.0906666666667 35.168 81.6266666666667 33.6266666666667C83.168 32.0906666666667 85.7493333333333 31.664 87.68 32.6293333333333C89.0346666666667 33.3066666666667 116.0266666666667 60.2986666666667 116.704 61.6533333333333C117.0506666666667 62.352 117.184 62.992 117.184 64C117.184 65.008 117.0506666666667 65.648 116.704 66.3466666666667C116.0693333333333 67.6213333333333 89.04 94.6986666666667 87.7866666666667 95.312C86.7733333333333 95.808 85.3013333333333 96.016 84.2666666666667 95.8026666666667" />
+    <glyph glyph-name="log-out-1"
+      unicode="&#x6C;&#x6F;&#x67;&#x2D;&#x6F;&#x75;&#x74;"
+      horiz-adv-x="128" d="M24.7466666666667 117.1306666666667C21.1413333333333 116.736 18.1973333333333 115.28 15.456 112.544C13.28 110.3626666666667 12.1066666666667 108.3893333333333 11.264 105.4826666666667L10.7733333333333 103.7866666666667L10.7733333333333 64L10.7733333333333 24.2133333333333L11.264 22.5173333333333C12.1066666666667 19.6106666666667 13.28 17.6373333333333 15.456 15.456C17.6373333333333 13.28 19.6106666666667 12.1066666666667 22.5173333333333 11.264C24.2026666666667 10.7786666666667 24.2986666666667 10.7733333333333 36.8 10.7733333333333C49.2693333333333 10.7733333333333 49.392 10.7786666666667 50.2453333333333 11.232C52.1973333333333 12.2773333333333 53.184 13.8773333333333 53.184 16C53.184 18.1226666666667 52.1973333333333 19.7226666666667 50.2453333333333 20.768C49.4026666666667 21.216 49.1573333333333 21.2266666666667 37.2266666666667 21.3333333333333C25.2746666666667 21.44 25.0506666666667 21.4453333333333 24.2133333333333 21.8986666666667C23.0986666666667 22.5013333333334 22.3146666666667 23.3493333333333 21.776 24.5333333333333C21.344 25.488 21.344 25.7173333333333 21.344 64C21.344 102.2826666666667 21.344 102.512 21.776 103.4666666666667C22.3146666666667 104.6506666666667 23.0986666666667 105.4986666666667 24.2133333333333 106.1013333333333C25.0506666666667 106.5546666666667 25.2746666666667 106.56 37.2266666666667 106.6666666666667C49.1573333333333 106.7733333333333 49.4026666666667 106.784 50.2453333333333 107.232C52.1973333333333 108.2773333333333 53.184 109.8773333333333 53.184 112C53.184 114.1226666666667 52.1973333333333 115.7226666666667 50.2453333333333 116.768C49.3973333333333 117.2213333333333 49.2213333333333 117.2266666666667 37.76 117.2533333333333C31.3653333333333 117.2693333333333 25.5093333333333 117.216 24.7466666666667 117.1306666666667M84.2666666666667 95.8026666666667C82.6933333333333 95.4826666666667 81.3653333333333 94.4373333333333 80.5866666666667 92.912C79.968 91.696 79.9893333333333 89.6053333333333 80.6346666666667 88.32C80.9653333333333 87.6586666666667 83.92 84.544 90.0906666666667 78.352L99.072 69.344L72.8426666666667 69.2853333333333L46.6133333333333 69.2266666666667L45.7546666666667 68.768C43.8026666666667 67.7226666666667 42.816 66.1226666666667 42.816 64C42.816 61.8773333333333 43.8026666666667 60.2773333333333 45.7546666666667 59.232L46.6133333333333 58.7733333333333L72.8426666666667 58.7146666666667L99.072 58.656L90.0906666666667 49.648C83.92 43.456 80.9653333333333 40.3413333333333 80.6346666666667 39.68C79.664 37.7493333333333 80.0906666666667 35.168 81.6266666666667 33.6266666666667C83.168 32.0906666666667 85.7493333333333 31.664 87.68 32.6293333333333C89.0346666666667 33.3066666666667 116.0266666666667 60.2986666666667 116.704 61.6533333333333C117.0506666666667 62.352 117.184 62.992 117.184 64C117.184 65.008 117.0506666666667 65.648 116.704 66.3466666666667C116.0693333333333 67.6213333333333 89.04 94.6986666666667 87.7866666666667 95.312C86.7733333333333 95.808 85.3013333333333 96.016 84.2666666666667 95.8026666666667" />
+    <glyph glyph-name="key"
       unicode="&#xF139;"
-      horiz-adv-x="128" d="M53.5466666666667 122.464C49.5626666666667 122.2453333333333 48.0373333333333 121.6266666666667 45.8506666666667 119.328C44.432 117.84 43.6906666666667 116.608 43.1626666666667 114.88C42.8053333333333 113.7013333333334 42.7733333333333 112.608 42.7733333333333 101.3333333333333C42.7733333333333 90.0373333333333 42.8053333333333 88.9653333333333 43.1626666666667 87.7866666666667C44.2293333333333 84.3146666666667 46.784 81.68 50.1333333333333 80.608C51.2266666666667 80.256 52.272 80.1386666666667 55.0933333333333 80.0533333333333L58.6666666666667 79.9466666666667L58.6666666666667 74.6666666666667L58.6666666666667 69.3813333333334L44.4266666666667 69.28C30.6453333333333 69.184 30.144 69.168 28.8 68.7306666666667C25.5786666666667 67.68 22.9866666666667 65.088 21.9306666666667 61.8666666666667C21.52 60.6133333333334 21.4666666666667 59.8773333333333 21.3813333333333 54.24L21.2906666666667 48L19.0133333333333 48C16.1013333333333 48 13.4933333333333 47.6693333333333 12.1226666666667 47.1306666666667C9.1093333333333 45.9466666666667 6.8106666666667 43.4186666666667 5.8293333333333 40.2133333333333C5.472 39.0346666666667 5.44 37.9626666666667 5.44 26.6666666666667C5.44 14.608 5.4453333333333 14.3733333333333 5.9093333333333 12.9066666666667C6.9813333333333 9.5146666666667 9.5146666666667 6.9813333333333 12.9066666666667 5.9093333333333C14.3733333333333 5.4453333333333 14.608 5.44 26.6666666666667 5.44C38.7253333333333 5.44 38.96 5.4453333333333 40.4266666666667 5.9093333333333C43.8186666666667 6.9813333333333 46.352 9.5146666666667 47.424 12.9066666666667C47.888 14.3733333333333 47.8933333333333 14.608 47.8933333333333 26.6666666666667C47.8933333333333 37.9626666666667 47.8613333333333 39.0346666666667 47.504 40.2133333333333C46.512 43.4506666666667 44.1706666666667 45.9786666666667 41.0293333333333 47.2053333333333C39.8346666666667 47.6746666666667 37.088 48 34.2986666666667 48L32 48L32 53.3333333333333L32 58.6666666666667L64 58.6666666666667L96 58.6666666666667L96 53.3333333333333L96 48L93.7013333333333 48C90.768 48 88.16 47.6746666666667 86.7893333333333 47.1306666666667C83.776 45.9466666666667 81.4773333333333 43.4186666666667 80.496 40.2133333333333C80.1386666666667 39.0346666666667 80.1066666666667 37.9626666666667 80.1066666666667 26.6666666666667C80.1066666666667 14.608 80.112 14.3733333333333 80.576 12.9066666666667C81.648 9.5146666666667 84.1813333333333 6.9813333333333 87.5733333333333 5.9093333333333C89.04 5.4453333333333 89.2746666666667 5.44 101.3333333333333 5.44C113.392 5.44 113.6266666666667 5.4453333333333 115.0933333333333 5.9093333333333C116.848 6.464 118.1493333333333 7.2533333333333 119.4453333333334 8.5546666666667C120.7466666666667 9.8506666666667 121.536 11.152 122.0906666666667 12.9066666666667C122.5546666666667 14.3733333333333 122.56 14.608 122.56 26.6666666666667C122.56 37.9626666666667 122.528 39.0346666666667 122.1706666666667 40.2133333333333C121.1786666666667 43.4506666666667 118.8373333333333 45.9786666666667 115.696 47.2053333333333C114.5013333333333 47.6746666666667 111.7546666666667 48 108.9866666666667 48L106.7093333333333 48L106.6186666666667 54.24C106.5333333333333 59.8773333333333 106.48 60.6133333333334 106.0693333333333 61.8666666666667C105.0133333333333 65.088 102.5333333333333 67.5626666666667 99.2 68.7146666666667C97.8293333333333 69.184 97.6533333333333 69.1946666666667 83.5733333333333 69.2853333333333L69.3333333333333 69.3813333333334L69.3333333333333 74.6666666666667L69.3333333333333 79.9466666666667L72.9066666666667 80.0533333333333C75.4026666666667 80.1333333333333 76.832 80.2773333333333 77.6533333333333 80.528C81.1093333333333 81.6 83.76 84.2826666666667 84.8373333333333 87.7866666666667C85.1946666666667 88.9653333333333 85.2266666666667 90.0373333333333 85.2266666666667 101.3333333333333C85.2266666666667 113.392 85.2213333333333 113.6266666666667 84.7573333333333 115.0933333333333C83.712 118.4 81.232 120.9013333333333 77.8666666666667 122.032C76.528 122.4853333333333 76.128 122.5066666666667 66.4533333333333 122.5653333333333C60.9386666666667 122.5973333333334 55.1306666666667 122.5546666666667 53.5466666666667 122.464M74.6666666666667 101.3333333333333L74.6666666666667 90.6666666666667L64 90.6666666666667L53.3333333333333 90.6666666666667L53.3333333333333 101.3333333333333L53.3333333333333 112L64 112L74.6666666666667 112L74.6666666666667 101.3333333333333M37.3333333333333 26.6666666666667L37.3333333333333 16L26.6666666666667 16L16 16L16 26.6666666666667L16 37.3333333333333L26.6666666666667 37.3333333333333L37.3333333333333 37.3333333333333L37.3333333333333 26.6666666666667M112 26.6666666666667L112 16L101.3333333333333 16L90.6666666666667 16L90.6666666666667 26.6666666666667L90.6666666666667 37.3333333333333L101.3333333333333 37.3333333333333L112 37.3333333333333L112 26.6666666666667" />
-    <glyph glyph-name="network-1"
-      unicode="&#x6E;&#x65;&#x74;&#x77;&#x6F;&#x72;&#x6B;"
-      horiz-adv-x="128" d="M53.5466666666667 122.464C49.5626666666667 122.2453333333333 48.0373333333333 121.6266666666667 45.8506666666667 119.328C44.432 117.84 43.6906666666667 116.608 43.1626666666667 114.88C42.8053333333333 113.7013333333334 42.7733333333333 112.608 42.7733333333333 101.3333333333333C42.7733333333333 90.0373333333333 42.8053333333333 88.9653333333333 43.1626666666667 87.7866666666667C44.2293333333333 84.3146666666667 46.784 81.68 50.1333333333333 80.608C51.2266666666667 80.256 52.272 80.1386666666667 55.0933333333333 80.0533333333333L58.6666666666667 79.9466666666667L58.6666666666667 74.6666666666667L58.6666666666667 69.3813333333334L44.4266666666667 69.28C30.6453333333333 69.184 30.144 69.168 28.8 68.7306666666667C25.5786666666667 67.68 22.9866666666667 65.088 21.9306666666667 61.8666666666667C21.52 60.6133333333334 21.4666666666667 59.8773333333333 21.3813333333333 54.24L21.2906666666667 48L19.0133333333333 48C16.1013333333333 48 13.4933333333333 47.6693333333333 12.1226666666667 47.1306666666667C9.1093333333333 45.9466666666667 6.8106666666667 43.4186666666667 5.8293333333333 40.2133333333333C5.472 39.0346666666667 5.44 37.9626666666667 5.44 26.6666666666667C5.44 14.608 5.4453333333333 14.3733333333333 5.9093333333333 12.9066666666667C6.9813333333333 9.5146666666667 9.5146666666667 6.9813333333333 12.9066666666667 5.9093333333333C14.3733333333333 5.4453333333333 14.608 5.44 26.6666666666667 5.44C38.7253333333333 5.44 38.96 5.4453333333333 40.4266666666667 5.9093333333333C43.8186666666667 6.9813333333333 46.352 9.5146666666667 47.424 12.9066666666667C47.888 14.3733333333333 47.8933333333333 14.608 47.8933333333333 26.6666666666667C47.8933333333333 37.9626666666667 47.8613333333333 39.0346666666667 47.504 40.2133333333333C46.512 43.4506666666667 44.1706666666667 45.9786666666667 41.0293333333333 47.2053333333333C39.8346666666667 47.6746666666667 37.088 48 34.2986666666667 48L32 48L32 53.3333333333333L32 58.6666666666667L64 58.6666666666667L96 58.6666666666667L96 53.3333333333333L96 48L93.7013333333333 48C90.768 48 88.16 47.6746666666667 86.7893333333333 47.1306666666667C83.776 45.9466666666667 81.4773333333333 43.4186666666667 80.496 40.2133333333333C80.1386666666667 39.0346666666667 80.1066666666667 37.9626666666667 80.1066666666667 26.6666666666667C80.1066666666667 14.608 80.112 14.3733333333333 80.576 12.9066666666667C81.648 9.5146666666667 84.1813333333333 6.9813333333333 87.5733333333333 5.9093333333333C89.04 5.4453333333333 89.2746666666667 5.44 101.3333333333333 5.44C113.392 5.44 113.6266666666667 5.4453333333333 115.0933333333333 5.9093333333333C116.848 6.464 118.1493333333333 7.2533333333333 119.4453333333334 8.5546666666667C120.7466666666667 9.8506666666667 121.536 11.152 122.0906666666667 12.9066666666667C122.5546666666667 14.3733333333333 122.56 14.608 122.56 26.6666666666667C122.56 37.9626666666667 122.528 39.0346666666667 122.1706666666667 40.2133333333333C121.1786666666667 43.4506666666667 118.8373333333333 45.9786666666667 115.696 47.2053333333333C114.5013333333333 47.6746666666667 111.7546666666667 48 108.9866666666667 48L106.7093333333333 48L106.6186666666667 54.24C106.5333333333333 59.8773333333333 106.48 60.6133333333334 106.0693333333333 61.8666666666667C105.0133333333333 65.088 102.5333333333333 67.5626666666667 99.2 68.7146666666667C97.8293333333333 69.184 97.6533333333333 69.1946666666667 83.5733333333333 69.2853333333333L69.3333333333333 69.3813333333334L69.3333333333333 74.6666666666667L69.3333333333333 79.9466666666667L72.9066666666667 80.0533333333333C75.4026666666667 80.1333333333333 76.832 80.2773333333333 77.6533333333333 80.528C81.1093333333333 81.6 83.76 84.2826666666667 84.8373333333333 87.7866666666667C85.1946666666667 88.9653333333333 85.2266666666667 90.0373333333333 85.2266666666667 101.3333333333333C85.2266666666667 113.392 85.2213333333333 113.6266666666667 84.7573333333333 115.0933333333333C83.712 118.4 81.232 120.9013333333333 77.8666666666667 122.032C76.528 122.4853333333333 76.128 122.5066666666667 66.4533333333333 122.5653333333333C60.9386666666667 122.5973333333334 55.1306666666667 122.5546666666667 53.5466666666667 122.464M74.6666666666667 101.3333333333333L74.6666666666667 90.6666666666667L64 90.6666666666667L53.3333333333333 90.6666666666667L53.3333333333333 101.3333333333333L53.3333333333333 112L64 112L74.6666666666667 112L74.6666666666667 101.3333333333333M37.3333333333333 26.6666666666667L37.3333333333333 16L26.6666666666667 16L16 16L16 26.6666666666667L16 37.3333333333333L26.6666666666667 37.3333333333333L37.3333333333333 37.3333333333333L37.3333333333333 26.6666666666667M112 26.6666666666667L112 16L101.3333333333333 16L90.6666666666667 16L90.6666666666667 26.6666666666667L90.6666666666667 37.3333333333333L101.3333333333333 37.3333333333333L112 37.3333333333333L112 26.6666666666667" />
-    <glyph glyph-name="pause"
+      horiz-adv-x="128" d="M110.9333333333333 122.4693333333334C110.5226666666667 122.384 109.8506666666667 122.144 109.44 121.936C109.0293333333333 121.728 97.8293333333333 110.704 84.5493333333333 97.44L60.4106666666667 73.3226666666667L59.1626666666667 74.1493333333334C55.0133333333333 76.9066666666667 49.8026666666667 78.8693333333334 44.8 79.5733333333333C42.4693333333333 79.8986666666667 37.5306666666667 79.8986666666667 35.2 79.5733333333333C19.9146666666667 77.4293333333334 7.904 65.4186666666667 5.76 50.1333333333333C5.2213333333333 46.2666666666667 5.4986666666667 40.832 6.432 37.0133333333334C9.1413333333333 25.9413333333333 17.424 16.7306666666667 28.16 12.8426666666667C32.0693333333333 11.424 35.5253333333333 10.8426666666667 40 10.8426666666667C45.968 10.8426666666667 50.736 11.984 55.8933333333333 14.6453333333333C65.7973333333333 19.7653333333333 72.6933333333333 29.488 74.24 40.5333333333333C74.7786666666667 44.4 74.5013333333333 49.8346666666667 73.568 53.6533333333333C72.6933333333333 57.2106666666667 70.8373333333333 61.4453333333333 68.816 64.5013333333333L67.9893333333333 65.744L75.3226666666667 73.0826666666667L82.656 80.416L89.0613333333333 74.048C92.5866666666667 70.5493333333333 95.8026666666667 67.504 96.2133333333333 67.2853333333333C97.2533333333333 66.7306666666667 100.0693333333333 66.7253333333333 101.12 67.28C102.3093333333333 67.9093333333333 121.4666666666667 87.1786666666667 122.0373333333333 88.32C122.6986666666667 89.648 122.6986666666667 91.6906666666667 122.032 93.0133333333333C121.712 93.648 119.424 96.112 115.2373333333333 100.32L108.928 106.6613333333333L112.5706666666667 110.3466666666667C116.7146666666667 114.5386666666667 117.184 115.248 117.184 117.3333333333333C117.184 120.6933333333333 114.2026666666667 123.1413333333333 110.9333333333333 122.4693333333334M105.6 94.8266666666667L109.7546666666667 90.6666666666667L104.2133333333333 85.12L98.672 79.5733333333333L94.4533333333333 83.7866666666667L90.24 87.9946666666667L95.7333333333333 93.4933333333333C98.752 96.512 101.2746666666667 98.9866666666667 101.3333333333333 98.9866666666667C101.392 98.9866666666667 103.312 97.1146666666667 105.6 94.8266666666667M45.6426666666667 68.7093333333333C52.9813333333333 66.8533333333333 59.136 61.6373333333334 62.0586666666667 54.7946666666667C63.536 51.3333333333333 63.888 49.52 63.888 45.3333333333333C63.888 42.272 63.8133333333333 41.408 63.4026666666667 39.7973333333333C61.52 32.3466666666667 56.3466666666667 26.2133333333333 49.4613333333333 23.2746666666667C46 21.7973333333333 44.1866666666667 21.4453333333333 40 21.4453333333333C36.9386666666667 21.4453333333333 36.0746666666667 21.52 34.464 21.9306666666667C27.0133333333333 23.8133333333333 20.88 28.9866666666667 17.9413333333333 35.872C16.464 39.3333333333333 16.112 41.1466666666667 16.112 45.3333333333333C16.112 48.3946666666667 16.1866666666667 49.2586666666667 16.5973333333333 50.8693333333333C17.7066666666667 55.248 19.9093333333333 59.1466666666667 23.0453333333333 62.288C26.7306666666667 65.9733333333333 30.8746666666667 68.0693333333333 36.6933333333333 69.1946666666667C36.9866666666667 69.2533333333333 38.7146666666667 69.2693333333333 40.5333333333333 69.232C43.0346666666667 69.184 44.2826666666667 69.056 45.6426666666667 68.7093333333333" />
+    <glyph glyph-name="key-1"
+      unicode="&#x6B;&#x65;&#x79;"
+      horiz-adv-x="128" d="M110.9333333333333 122.4693333333334C110.5226666666667 122.384 109.8506666666667 122.144 109.44 121.936C109.0293333333333 121.728 97.8293333333333 110.704 84.5493333333333 97.44L60.4106666666667 73.3226666666667L59.1626666666667 74.1493333333334C55.0133333333333 76.9066666666667 49.8026666666667 78.8693333333334 44.8 79.5733333333333C42.4693333333333 79.8986666666667 37.5306666666667 79.8986666666667 35.2 79.5733333333333C19.9146666666667 77.4293333333334 7.904 65.4186666666667 5.76 50.1333333333333C5.2213333333333 46.2666666666667 5.4986666666667 40.832 6.432 37.0133333333334C9.1413333333333 25.9413333333333 17.424 16.7306666666667 28.16 12.8426666666667C32.0693333333333 11.424 35.5253333333333 10.8426666666667 40 10.8426666666667C45.968 10.8426666666667 50.736 11.984 55.8933333333333 14.6453333333333C65.7973333333333 19.7653333333333 72.6933333333333 29.488 74.24 40.5333333333333C74.7786666666667 44.4 74.5013333333333 49.8346666666667 73.568 53.6533333333333C72.6933333333333 57.2106666666667 70.8373333333333 61.4453333333333 68.816 64.5013333333333L67.9893333333333 65.744L75.3226666666667 73.0826666666667L82.656 80.416L89.0613333333333 74.048C92.5866666666667 70.5493333333333 95.8026666666667 67.504 96.2133333333333 67.2853333333333C97.2533333333333 66.7306666666667 100.0693333333333 66.7253333333333 101.12 67.28C102.3093333333333 67.9093333333333 121.4666666666667 87.1786666666667 122.0373333333333 88.32C122.6986666666667 89.648 122.6986666666667 91.6906666666667 122.032 93.0133333333333C121.712 93.648 119.424 96.112 115.2373333333333 100.32L108.928 106.6613333333333L112.5706666666667 110.3466666666667C116.7146666666667 114.5386666666667 117.184 115.248 117.184 117.3333333333333C117.184 120.6933333333333 114.2026666666667 123.1413333333333 110.9333333333333 122.4693333333334M105.6 94.8266666666667L109.7546666666667 90.6666666666667L104.2133333333333 85.12L98.672 79.5733333333333L94.4533333333333 83.7866666666667L90.24 87.9946666666667L95.7333333333333 93.4933333333333C98.752 96.512 101.2746666666667 98.9866666666667 101.3333333333333 98.9866666666667C101.392 98.9866666666667 103.312 97.1146666666667 105.6 94.8266666666667M45.6426666666667 68.7093333333333C52.9813333333333 66.8533333333333 59.136 61.6373333333334 62.0586666666667 54.7946666666667C63.536 51.3333333333333 63.888 49.52 63.888 45.3333333333333C63.888 42.272 63.8133333333333 41.408 63.4026666666667 39.7973333333333C61.52 32.3466666666667 56.3466666666667 26.2133333333333 49.4613333333333 23.2746666666667C46 21.7973333333333 44.1866666666667 21.4453333333333 40 21.4453333333333C36.9386666666667 21.4453333333333 36.0746666666667 21.52 34.464 21.9306666666667C27.0133333333333 23.8133333333333 20.88 28.9866666666667 17.9413333333333 35.872C16.464 39.3333333333333 16.112 41.1466666666667 16.112 45.3333333333333C16.112 48.3946666666667 16.1866666666667 49.2586666666667 16.5973333333333 50.8693333333333C17.7066666666667 55.248 19.9093333333333 59.1466666666667 23.0453333333333 62.288C26.7306666666667 65.9733333333333 30.8746666666667 68.0693333333333 36.6933333333333 69.1946666666667C36.9866666666667 69.2533333333333 38.7146666666667 69.2693333333333 40.5333333333333 69.232C43.0346666666667 69.184 44.2826666666667 69.056 45.6426666666667 68.7093333333333" />
+    <glyph glyph-name="circle-stop"
       unicode="&#xF13A;"
-      horiz-adv-x="128" d="M36.6933333333333 111.7973333333333C33.536 111.5306666666667 31.84 110.752 29.8506666666667 108.6613333333333C28.432 107.1733333333333 27.6906666666667 105.9413333333333 27.1626666666667 104.2133333333333C26.7893333333333 102.992 26.7733333333333 101.1093333333333 26.7733333333333 64L26.7733333333333 25.0666666666667L27.2426666666667 23.5733333333334C28.3146666666667 20.1813333333333 30.848 17.648 34.24 16.576C35.6533333333333 16.1333333333333 36.1066666666667 16.1066666666667 42.6666666666667 16.1066666666667C49.2266666666667 16.1066666666667 49.68 16.1333333333333 51.0933333333333 16.576C54.4853333333333 17.648 57.0186666666667 20.1813333333333 58.0906666666667 23.5733333333334L58.56 25.0666666666667L58.56 64L58.56 102.9333333333333L58.0906666666667 104.4266666666667C57.0453333333333 107.7333333333333 54.5546666666667 110.24 51.2106666666667 111.36C49.9626666666667 111.776 49.2853333333333 111.8293333333333 44.2773333333333 111.8933333333333C41.2213333333333 111.936 37.808 111.888 36.6933333333333 111.7973333333333M79.36 111.7973333333333C76.2026666666667 111.5306666666667 74.5066666666667 110.752 72.5173333333333 108.6613333333333C71.0986666666667 107.1733333333333 70.3573333333333 105.9413333333333 69.8293333333333 104.2133333333333C69.456 102.992 69.44 101.1093333333333 69.44 64L69.44 25.0666666666667L69.9093333333333 23.5733333333334C70.9813333333333 20.1813333333333 73.5146666666667 17.648 76.9066666666667 16.576C78.32 16.1333333333333 78.7733333333333 16.1066666666667 85.3333333333333 16.1066666666667C91.9146666666667 16.1066666666667 92.3413333333333 16.1333333333333 93.76 16.5813333333333C95.6 17.168 96.5333333333333 17.728 97.952 19.0986666666667C99.392 20.4853333333333 100.176 21.7386666666667 100.7573333333333 23.5733333333334L101.2266666666667 25.0666666666667L101.2266666666667 64L101.2266666666667 102.9333333333333L100.7573333333333 104.4266666666667C99.712 107.7333333333333 97.2213333333333 110.24 93.8773333333333 111.36C92.6293333333333 111.776 91.952 111.8293333333333 86.944 111.8933333333333C83.888 111.936 80.4746666666667 111.888 79.36 111.7973333333333M48 64L48 26.6666666666667L42.6666666666667 26.6666666666667L37.3333333333333 26.6666666666667L37.3333333333333 64L37.3333333333333 101.3333333333333L42.6666666666667 101.3333333333333L48 101.3333333333333L48 64M90.6666666666667 64L90.6666666666667 26.6666666666667L85.3333333333333 26.6666666666667L80 26.6666666666667L80 64L80 101.3333333333333L85.3333333333333 101.3333333333333L90.6666666666667 101.3333333333333L90.6666666666667 64" />
-    <glyph glyph-name="pause-1"
-      unicode="&#x70;&#x61;&#x75;&#x73;&#x65;"
-      horiz-adv-x="128" d="M36.6933333333333 111.7973333333333C33.536 111.5306666666667 31.84 110.752 29.8506666666667 108.6613333333333C28.432 107.1733333333333 27.6906666666667 105.9413333333333 27.1626666666667 104.2133333333333C26.7893333333333 102.992 26.7733333333333 101.1093333333333 26.7733333333333 64L26.7733333333333 25.0666666666667L27.2426666666667 23.5733333333334C28.3146666666667 20.1813333333333 30.848 17.648 34.24 16.576C35.6533333333333 16.1333333333333 36.1066666666667 16.1066666666667 42.6666666666667 16.1066666666667C49.2266666666667 16.1066666666667 49.68 16.1333333333333 51.0933333333333 16.576C54.4853333333333 17.648 57.0186666666667 20.1813333333333 58.0906666666667 23.5733333333334L58.56 25.0666666666667L58.56 64L58.56 102.9333333333333L58.0906666666667 104.4266666666667C57.0453333333333 107.7333333333333 54.5546666666667 110.24 51.2106666666667 111.36C49.9626666666667 111.776 49.2853333333333 111.8293333333333 44.2773333333333 111.8933333333333C41.2213333333333 111.936 37.808 111.888 36.6933333333333 111.7973333333333M79.36 111.7973333333333C76.2026666666667 111.5306666666667 74.5066666666667 110.752 72.5173333333333 108.6613333333333C71.0986666666667 107.1733333333333 70.3573333333333 105.9413333333333 69.8293333333333 104.2133333333333C69.456 102.992 69.44 101.1093333333333 69.44 64L69.44 25.0666666666667L69.9093333333333 23.5733333333334C70.9813333333333 20.1813333333333 73.5146666666667 17.648 76.9066666666667 16.576C78.32 16.1333333333333 78.7733333333333 16.1066666666667 85.3333333333333 16.1066666666667C91.9146666666667 16.1066666666667 92.3413333333333 16.1333333333333 93.76 16.5813333333333C95.6 17.168 96.5333333333333 17.728 97.952 19.0986666666667C99.392 20.4853333333333 100.176 21.7386666666667 100.7573333333333 23.5733333333334L101.2266666666667 25.0666666666667L101.2266666666667 64L101.2266666666667 102.9333333333333L100.7573333333333 104.4266666666667C99.712 107.7333333333333 97.2213333333333 110.24 93.8773333333333 111.36C92.6293333333333 111.776 91.952 111.8293333333333 86.944 111.8933333333333C83.888 111.936 80.4746666666667 111.888 79.36 111.7973333333333M48 64L48 26.6666666666667L42.6666666666667 26.6666666666667L37.3333333333333 26.6666666666667L37.3333333333333 64L37.3333333333333 101.3333333333333L42.6666666666667 101.3333333333333L48 101.3333333333333L48 64M90.6666666666667 64L90.6666666666667 26.6666666666667L85.3333333333333 26.6666666666667L80 26.6666666666667L80 64L80 101.3333333333333L85.3333333333333 101.3333333333333L90.6666666666667 101.3333333333333L90.6666666666667 64" />
-    <glyph glyph-name="copy-plus"
+      horiz-adv-x="128" d="M60.16 122.4373333333333C52.3573333333333 121.952 45.3546666666667 120.064 38.08 116.48C31.904 113.44 27.4186666666667 110.2293333333333 22.5973333333333 105.4026666666667C17.7706666666667 100.5813333333333 14.56 96.096 11.52 89.92C7.824 82.4213333333333 6.0533333333333 75.7013333333333 5.5466666666667 67.2693333333333C4.9333333333333 57.1413333333333 6.928 47.392 11.52 38.08C14.56 31.904 17.7706666666667 27.4186666666667 22.5973333333333 22.5973333333333C27.4133333333333 17.7813333333333 31.888 14.576 38.08 11.5093333333333C46.4693333333333 7.36 54.464 5.5093333333333 64 5.5093333333333C73.536 5.5093333333333 81.5306666666667 7.36 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M46.9333333333333 85.136C45.3653333333333 84.816 44.064 83.792 43.232 82.2453333333333C42.7733333333333 81.3866666666667 42.7733333333333 81.3813333333334 42.7733333333333 64C42.7733333333333 46.6186666666667 42.7733333333333 46.6133333333333 43.232 45.7546666666667C43.8133333333333 44.6666666666667 44.6666666666667 43.8133333333333 45.7546666666667 43.232C46.6133333333333 42.7733333333333 46.6186666666667 42.7733333333333 64 42.7733333333333C81.3813333333333 42.7733333333333 81.3866666666667 42.7733333333333 82.2453333333333 43.232C83.3333333333333 43.8133333333333 84.1866666666667 44.6666666666667 84.768 45.7546666666667C85.2266666666667 46.6133333333333 85.2266666666667 46.6186666666667 85.2266666666667 64C85.2266666666667 81.3813333333334 85.2266666666667 81.3866666666667 84.768 82.2453333333333C84.1866666666667 83.3333333333333 83.3333333333333 84.1866666666667 82.2453333333333 84.768C81.3866666666667 85.2266666666667 81.3386666666667 85.2266666666667 64.5333333333333 85.2586666666667C55.264 85.2746666666667 47.344 85.2213333333333 46.9333333333333 85.136M74.6666666666667 64L74.6666666666667 53.3333333333333L64 53.3333333333333L53.3333333333333 53.3333333333333L53.3333333333333 64L53.3333333333333 74.6666666666667L64 74.6666666666667L74.6666666666667 74.6666666666667L74.6666666666667 64" />
+    <glyph glyph-name="circle-stop-1"
+      unicode="&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x73;&#x74;&#x6F;&#x70;"
+      horiz-adv-x="128" d="M60.16 122.4373333333333C52.3573333333333 121.952 45.3546666666667 120.064 38.08 116.48C31.904 113.44 27.4186666666667 110.2293333333333 22.5973333333333 105.4026666666667C17.7706666666667 100.5813333333333 14.56 96.096 11.52 89.92C7.824 82.4213333333333 6.0533333333333 75.7013333333333 5.5466666666667 67.2693333333333C4.9333333333333 57.1413333333333 6.928 47.392 11.52 38.08C14.56 31.904 17.7706666666667 27.4186666666667 22.5973333333333 22.5973333333333C27.4133333333333 17.7813333333333 31.888 14.576 38.08 11.5093333333333C46.4693333333333 7.36 54.464 5.5093333333333 64 5.5093333333333C73.536 5.5093333333333 81.5306666666667 7.36 89.92 11.5093333333333C96.112 14.576 100.5866666666667 17.7813333333333 105.4026666666667 22.5973333333333C110.2186666666667 27.4133333333333 113.424 31.888 116.4906666666667 38.08C120.64 46.4693333333333 122.4906666666667 54.464 122.4906666666667 64C122.4906666666667 73.536 120.64 81.5306666666667 116.4906666666667 89.92C113.424 96.112 110.2186666666667 100.5866666666667 105.4026666666667 105.4026666666667C100.5813333333333 110.2293333333333 96.096 113.44 89.92 116.48C82.448 120.1653333333333 75.728 121.9413333333333 67.3173333333333 122.4586666666667C63.8026666666667 122.672 63.9786666666667 122.6773333333333 60.16 122.4373333333333M69.2906666666667 111.7706666666667C87.872 109.7226666666667 103.808 96.7626666666667 109.6586666666667 78.9333333333333C113.3706666666667 67.6213333333333 112.6986666666667 55.1893333333333 107.776 44.2133333333333C103.856 35.4666666666667 96.848 27.648 88.4266666666667 22.6346666666667C76.7253333333333 15.664 62.0906666666667 14.064 49.0666666666667 18.3413333333333C34.5706666666667 23.0986666666667 23.0986666666667 34.576 18.336 49.072C16.7306666666667 53.9626666666667 16 58.6293333333333 16 64C16 67.8133333333333 16.2613333333333 70.4426666666667 16.992 73.9146666666667C19.7386666666667 86.9866666666667 27.9893333333333 98.464 39.616 105.392C45.0613333333333 108.6346666666667 52.2133333333333 111.056 58.4533333333333 111.7653333333333C60.8 112.032 66.9013333333333 112.032 69.2906666666667 111.7706666666667M46.9333333333333 85.136C45.3653333333333 84.816 44.064 83.792 43.232 82.2453333333333C42.7733333333333 81.3866666666667 42.7733333333333 81.3813333333334 42.7733333333333 64C42.7733333333333 46.6186666666667 42.7733333333333 46.6133333333333 43.232 45.7546666666667C43.8133333333333 44.6666666666667 44.6666666666667 43.8133333333333 45.7546666666667 43.232C46.6133333333333 42.7733333333333 46.6186666666667 42.7733333333333 64 42.7733333333333C81.3813333333333 42.7733333333333 81.3866666666667 42.7733333333333 82.2453333333333 43.232C83.3333333333333 43.8133333333333 84.1866666666667 44.6666666666667 84.768 45.7546666666667C85.2266666666667 46.6133333333333 85.2266666666667 46.6186666666667 85.2266666666667 64C85.2266666666667 81.3813333333334 85.2266666666667 81.3866666666667 84.768 82.2453333333333C84.1866666666667 83.3333333333333 83.3333333333333 84.1866666666667 82.2453333333333 84.768C81.3866666666667 85.2266666666667 81.3386666666667 85.2266666666667 64.5333333333333 85.2586666666667C55.264 85.2746666666667 47.344 85.2213333333333 46.9333333333333 85.136M74.6666666666667 64L74.6666666666667 53.3333333333333L64 53.3333333333333L53.3333333333333 53.3333333333333L53.3333333333333 64L53.3333333333333 74.6666666666667L64 74.6666666666667L74.6666666666667 74.6666666666667L74.6666666666667 64" />
+    <glyph glyph-name="file-down"
       unicode="&#xF13B;"
-      horiz-adv-x="128" d="M19.3066666666667 122.448C13.0933333333333 121.7386666666667 7.744 117.0933333333333 5.936 110.8266666666667L5.44 109.12L5.44 80L5.44 50.88L5.936 49.1733333333333C6.7626666666667 46.3093333333333 7.952 44.3146666666667 10.1333333333333 42.1333333333333C13.2213333333333 39.0453333333333 16.64 37.552 20.7466666666667 37.4933333333333C22.3626666666667 37.472 22.8746666666667 37.552 23.5786666666667 37.9146666666667C25.5146666666667 38.9173333333333 26.5173333333333 40.5386666666667 26.5173333333333 42.6666666666667C26.5173333333333 45.584 24.624 47.5733333333333 21.5306666666667 47.904C18.9813333333333 48.176 17.4186666666667 49.168 16.5066666666667 51.0933333333333L16.0053333333333 52.16L16.0053333333333 80C16.0106666666667 107.5466666666667 16.016 107.8506666666667 16.4426666666667 108.8C17.0293333333333 110.0906666666667 17.8133333333333 110.8853333333333 19.0933333333333 111.4933333333333L20.16 111.9946666666667L48 111.9946666666667L75.84 111.9946666666667L76.9066666666667 111.4933333333333C78.832 110.5813333333333 79.824 109.0186666666667 80.096 106.4693333333333C80.4266666666667 103.376 82.416 101.4826666666667 85.3333333333333 101.4826666666667C87.4613333333333 101.4826666666667 89.0826666666667 102.4853333333333 90.0853333333333 104.4213333333333C90.448 105.12 90.5226666666667 105.632 90.5013333333333 107.2C90.4373333333333 111.3706666666667 88.9546666666667 114.7786666666667 85.8666666666667 117.8666666666667C83.728 120.0053333333334 81.7546666666667 121.2 78.9333333333333 122.0586666666667L77.3333333333333 122.5493333333333L49.0666666666667 122.5813333333333C33.52 122.6026666666667 20.128 122.5386666666667 19.3066666666667 122.448M51.4133333333333 90.464C47.8133333333333 90.0693333333333 44.864 88.6133333333334 42.1226666666667 85.8773333333333C39.9466666666667 83.696 38.7733333333333 81.7226666666667 37.9306666666667 78.816L37.44 77.12L37.44 48L37.44 18.88L37.9306666666667 17.184C38.7733333333333 14.2773333333333 39.9466666666667 12.304 42.1226666666667 10.1226666666667C44.304 7.9466666666667 46.2773333333333 6.7733333333333 49.184 5.9306666666667L50.88 5.44L80 5.44L109.12 5.44L110.816 5.9306666666667C113.7226666666667 6.7733333333333 115.696 7.9466666666667 117.8773333333333 10.1226666666667C120.0533333333334 12.304 121.2266666666667 14.2773333333333 122.0693333333333 17.184L122.56 18.88L122.56 48L122.56 77.12L122.0693333333333 78.816C121.2266666666667 81.7226666666667 120.0533333333334 83.696 117.8773333333333 85.8773333333333C115.7386666666667 88.0106666666667 113.7973333333333 89.184 110.928 90.0586666666667L109.3333333333333 90.5493333333333L81.0666666666667 90.5813333333333C65.52 90.5973333333333 52.176 90.544 51.4133333333333 90.464M108.9066666666667 79.4933333333333C110.1866666666667 78.8853333333333 110.9706666666667 78.0906666666667 111.5573333333333 76.8C111.984 75.8506666666667 111.9893333333333 75.5466666666667 111.9946666666667 48L111.9946666666667 20.16L111.4933333333333 19.0933333333333C110.8853333333333 17.8133333333333 110.0906666666667 17.0293333333333 108.8 16.4426666666667C107.8506666666667 16.016 107.552 16.0106666666667 80 16.0106666666667C52.448 16.0106666666667 52.1493333333333 16.016 51.2 16.4426666666667C49.9093333333333 17.0293333333333 49.1146666666667 17.8133333333333 48.5066666666667 19.0933333333333L48.0053333333333 20.16L48.0053333333333 48C48.0106666666667 75.5466666666667 48.016 75.8506666666667 48.4426666666667 76.8C49.0293333333333 78.0906666666667 49.8133333333333 78.8853333333333 51.0933333333333 79.4933333333333L52.16 79.9946666666667L80 79.9946666666667L107.84 79.9946666666667L108.9066666666667 79.4933333333333M78.9333333333333 69.136C77.3706666666667 68.816 76.0586666666667 67.792 75.232 66.2453333333333C74.8 65.4346666666667 74.7733333333333 65.04 74.704 59.376L74.6346666666667 53.3653333333333L68.624 53.296C62.96 53.2266666666667 62.5653333333333 53.2 61.7546666666667 52.768C59.8026666666667 51.7226666666667 58.816 50.1226666666667 58.816 48C58.816 45.8773333333333 59.8026666666667 44.2773333333333 61.7546666666667 43.232C62.5653333333333 42.8 62.96 42.7733333333333 68.624 42.704L74.6346666666667 42.6346666666667L74.704 36.624C74.7733333333333 30.96 74.8 30.5653333333333 75.232 29.7546666666667C76.2773333333333 27.8026666666667 77.8773333333333 26.816 80 26.816C82.1226666666667 26.816 83.7226666666667 27.8026666666667 84.768 29.7546666666667C85.2 30.5653333333333 85.2266666666667 30.96 85.296 36.624L85.3653333333333 42.6346666666667L91.376 42.704C97.04 42.7733333333333 97.4346666666667 42.8 98.2453333333333 43.232C100.1973333333333 44.2773333333333 101.184 45.8773333333333 101.184 48C101.184 50.1226666666667 100.1973333333333 51.7226666666667 98.2453333333333 52.768C97.4346666666667 53.2 97.04 53.2266666666667 91.376 53.296L85.3653333333333 53.3653333333333L85.296 59.376C85.2266666666667 65.04 85.2 65.4346666666667 84.768 66.2453333333333C83.5893333333333 68.4533333333334 81.248 69.6106666666667 78.9333333333333 69.136" />
-    <glyph glyph-name="copy-plus-1"
-      unicode="&#x63;&#x6F;&#x70;&#x79;&#x2D;&#x70;&#x6C;&#x75;&#x73;"
-      horiz-adv-x="128" d="M19.3066666666667 122.448C13.0933333333333 121.7386666666667 7.744 117.0933333333333 5.936 110.8266666666667L5.44 109.12L5.44 80L5.44 50.88L5.936 49.1733333333333C6.7626666666667 46.3093333333333 7.952 44.3146666666667 10.1333333333333 42.1333333333333C13.2213333333333 39.0453333333333 16.64 37.552 20.7466666666667 37.4933333333333C22.3626666666667 37.472 22.8746666666667 37.552 23.5786666666667 37.9146666666667C25.5146666666667 38.9173333333333 26.5173333333333 40.5386666666667 26.5173333333333 42.6666666666667C26.5173333333333 45.584 24.624 47.5733333333333 21.5306666666667 47.904C18.9813333333333 48.176 17.4186666666667 49.168 16.5066666666667 51.0933333333333L16.0053333333333 52.16L16.0053333333333 80C16.0106666666667 107.5466666666667 16.016 107.8506666666667 16.4426666666667 108.8C17.0293333333333 110.0906666666667 17.8133333333333 110.8853333333333 19.0933333333333 111.4933333333333L20.16 111.9946666666667L48 111.9946666666667L75.84 111.9946666666667L76.9066666666667 111.4933333333333C78.832 110.5813333333333 79.824 109.0186666666667 80.096 106.4693333333333C80.4266666666667 103.376 82.416 101.4826666666667 85.3333333333333 101.4826666666667C87.4613333333333 101.4826666666667 89.0826666666667 102.4853333333333 90.0853333333333 104.4213333333333C90.448 105.12 90.5226666666667 105.632 90.5013333333333 107.2C90.4373333333333 111.3706666666667 88.9546666666667 114.7786666666667 85.8666666666667 117.8666666666667C83.728 120.0053333333334 81.7546666666667 121.2 78.9333333333333 122.0586666666667L77.3333333333333 122.5493333333333L49.0666666666667 122.5813333333333C33.52 122.6026666666667 20.128 122.5386666666667 19.3066666666667 122.448M51.4133333333333 90.464C47.8133333333333 90.0693333333333 44.864 88.6133333333334 42.1226666666667 85.8773333333333C39.9466666666667 83.696 38.7733333333333 81.7226666666667 37.9306666666667 78.816L37.44 77.12L37.44 48L37.44 18.88L37.9306666666667 17.184C38.7733333333333 14.2773333333333 39.9466666666667 12.304 42.1226666666667 10.1226666666667C44.304 7.9466666666667 46.2773333333333 6.7733333333333 49.184 5.9306666666667L50.88 5.44L80 5.44L109.12 5.44L110.816 5.9306666666667C113.7226666666667 6.7733333333333 115.696 7.9466666666667 117.8773333333333 10.1226666666667C120.0533333333334 12.304 121.2266666666667 14.2773333333333 122.0693333333333 17.184L122.56 18.88L122.56 48L122.56 77.12L122.0693333333333 78.816C121.2266666666667 81.7226666666667 120.0533333333334 83.696 117.8773333333333 85.8773333333333C115.7386666666667 88.0106666666667 113.7973333333333 89.184 110.928 90.0586666666667L109.3333333333333 90.5493333333333L81.0666666666667 90.5813333333333C65.52 90.5973333333333 52.176 90.544 51.4133333333333 90.464M108.9066666666667 79.4933333333333C110.1866666666667 78.8853333333333 110.9706666666667 78.0906666666667 111.5573333333333 76.8C111.984 75.8506666666667 111.9893333333333 75.5466666666667 111.9946666666667 48L111.9946666666667 20.16L111.4933333333333 19.0933333333333C110.8853333333333 17.8133333333333 110.0906666666667 17.0293333333333 108.8 16.4426666666667C107.8506666666667 16.016 107.552 16.0106666666667 80 16.0106666666667C52.448 16.0106666666667 52.1493333333333 16.016 51.2 16.4426666666667C49.9093333333333 17.0293333333333 49.1146666666667 17.8133333333333 48.5066666666667 19.0933333333333L48.0053333333333 20.16L48.0053333333333 48C48.0106666666667 75.5466666666667 48.016 75.8506666666667 48.4426666666667 76.8C49.0293333333333 78.0906666666667 49.8133333333333 78.8853333333333 51.0933333333333 79.4933333333333L52.16 79.9946666666667L80 79.9946666666667L107.84 79.9946666666667L108.9066666666667 79.4933333333333M78.9333333333333 69.136C77.3706666666667 68.816 76.0586666666667 67.792 75.232 66.2453333333333C74.8 65.4346666666667 74.7733333333333 65.04 74.704 59.376L74.6346666666667 53.3653333333333L68.624 53.296C62.96 53.2266666666667 62.5653333333333 53.2 61.7546666666667 52.768C59.8026666666667 51.7226666666667 58.816 50.1226666666667 58.816 48C58.816 45.8773333333333 59.8026666666667 44.2773333333333 61.7546666666667 43.232C62.5653333333333 42.8 62.96 42.7733333333333 68.624 42.704L74.6346666666667 42.6346666666667L74.704 36.624C74.7733333333333 30.96 74.8 30.5653333333333 75.232 29.7546666666667C76.2773333333333 27.8026666666667 77.8773333333333 26.816 80 26.816C82.1226666666667 26.816 83.7226666666667 27.8026666666667 84.768 29.7546666666667C85.2 30.5653333333333 85.2266666666667 30.96 85.296 36.624L85.3653333333333 42.6346666666667L91.376 42.704C97.04 42.7733333333333 97.4346666666667 42.8 98.2453333333333 43.232C100.1973333333333 44.2773333333333 101.184 45.8773333333333 101.184 48C101.184 50.1226666666667 100.1973333333333 51.7226666666667 98.2453333333333 52.768C97.4346666666667 53.2 97.04 53.2266666666667 91.376 53.296L85.3653333333333 53.3653333333333L85.296 59.376C85.2266666666667 65.04 85.2 65.4346666666667 84.768 66.2453333333333C83.5893333333333 68.4533333333334 81.248 69.6106666666667 78.9333333333333 69.136" />
-    <glyph glyph-name="book-marked"
+      horiz-adv-x="128" d="M30.08 122.4586666666667C26.4853333333333 122.0746666666667 23.5306666666667 120.6133333333333 20.7893333333333 117.8773333333334C18.6133333333333 115.696 17.44 113.7226666666667 16.5973333333333 110.816L16.1066666666667 109.12L16.1066666666667 64L16.1066666666667 18.88L16.5973333333333 17.184C17.44 14.2773333333333 18.6133333333333 12.304 20.7893333333333 10.1226666666667C22.9706666666667 7.9466666666667 24.944 6.7733333333333 27.8506666666667 5.9306666666667L29.5466666666667 5.44L64 5.44L98.4533333333333 5.44L100.1493333333333 5.9306666666667C103.056 6.7733333333333 105.0293333333333 7.9466666666667 107.2106666666667 10.1226666666667C109.3866666666667 12.304 110.56 14.2773333333333 111.4026666666667 17.184L111.8933333333333 18.88L111.8933333333333 55.36L111.8933333333333 91.84L111.4026666666667 92.9066666666667C111.008 93.776 108.3413333333333 96.544 97.1093333333333 107.776C85.8773333333333 119.008 83.1093333333333 121.6746666666667 82.24 122.0693333333333L81.1733333333333 122.56L56.32 122.5866666666667C42.6506666666667 122.5973333333334 30.8426666666667 122.544 30.08 122.4586666666667M69.3866666666667 102.6666666666667C69.4933333333333 92.112 69.5253333333333 91.8986666666667 71.312 88.432C72.5493333333333 86.0373333333333 75.3706666666667 83.216 77.7653333333333 81.9786666666667C81.232 80.192 81.4453333333333 80.16 92 80.0533333333333L101.3333333333333 79.9573333333333L101.3333333333333 50.0586666666667L101.328 20.16L100.8266666666667 19.0933333333333C100.2186666666667 17.8133333333333 99.424 17.0293333333333 98.1333333333333 16.4426666666667C97.1786666666667 16.0106666666667 96.9173333333333 16.0106666666667 64 16.0106666666667C31.0826666666667 16.0106666666667 30.8213333333333 16.0106666666667 29.8666666666667 16.4426666666667C28.576 17.0293333333333 27.7813333333333 17.8133333333333 27.1733333333333 19.0933333333333L26.672 20.16L26.672 64C26.6773333333333 107.648 26.6773333333333 107.8453333333333 27.1093333333333 108.8C27.696 110.0906666666667 28.48 110.8853333333333 29.76 111.4933333333333L30.8266666666667 111.9946666666667L50.0586666666667 112L69.2906666666667 112L69.3866666666667 102.6666666666667M91.68 90.7146666666667C85.312 90.6613333333333 84.256 90.6986666666667 83.4453333333333 91.008C82.16 91.4933333333333 81.088 92.496 80.5013333333333 93.76C80.0106666666667 94.8106666666667 80.0053333333333 94.9226666666667 80 102.2933333333333L80 109.76L89.4933333333333 100.2666666666667L98.9866666666667 90.7733333333333L91.68 90.7146666666667M62.9333333333333 69.136C61.3706666666667 68.816 60.064 67.792 59.232 66.2453333333333C58.784 65.408 58.7733333333333 65.152 58.7093333333333 55.1733333333333L58.6453333333333 44.9546666666667L54.976 48.5813333333333C50.7946666666667 52.7146666666667 50.0853333333333 53.184 48 53.184C45.872 53.184 44.24 52.1706666666667 43.2533333333333 50.2453333333333C42.6346666666667 49.0293333333333 42.656 46.9386666666667 43.296 45.6533333333333C43.968 44.3093333333333 60.3093333333333 27.968 61.6533333333333 27.296C62.352 26.9493333333333 62.9866666666667 26.816 64 26.816C65.0133333333333 26.816 65.648 26.9493333333333 66.3466666666667 27.296C67.6906666666667 27.968 84.032 44.3093333333333 84.704 45.6533333333333C85.344 46.9386666666667 85.3653333333333 49.0293333333333 84.7466666666667 50.2453333333333C83.76 52.1706666666667 82.128 53.184 80 53.184C77.9146666666667 53.184 77.2053333333333 52.7146666666667 73.024 48.5813333333333L69.3546666666667 44.9546666666667L69.2906666666667 55.1733333333333C69.2266666666667 65.152 69.216 65.408 68.768 66.2453333333333C67.584 68.4533333333334 65.248 69.6106666666667 62.9333333333333 69.136" />
+    <glyph glyph-name="file-down-1"
+      unicode="&#x66;&#x69;&#x6C;&#x65;&#x2D;&#x64;&#x6F;&#x77;&#x6E;"
+      horiz-adv-x="128" d="M30.08 122.4586666666667C26.4853333333333 122.0746666666667 23.5306666666667 120.6133333333333 20.7893333333333 117.8773333333334C18.6133333333333 115.696 17.44 113.7226666666667 16.5973333333333 110.816L16.1066666666667 109.12L16.1066666666667 64L16.1066666666667 18.88L16.5973333333333 17.184C17.44 14.2773333333333 18.6133333333333 12.304 20.7893333333333 10.1226666666667C22.9706666666667 7.9466666666667 24.944 6.7733333333333 27.8506666666667 5.9306666666667L29.5466666666667 5.44L64 5.44L98.4533333333333 5.44L100.1493333333333 5.9306666666667C103.056 6.7733333333333 105.0293333333333 7.9466666666667 107.2106666666667 10.1226666666667C109.3866666666667 12.304 110.56 14.2773333333333 111.4026666666667 17.184L111.8933333333333 18.88L111.8933333333333 55.36L111.8933333333333 91.84L111.4026666666667 92.9066666666667C111.008 93.776 108.3413333333333 96.544 97.1093333333333 107.776C85.8773333333333 119.008 83.1093333333333 121.6746666666667 82.24 122.0693333333333L81.1733333333333 122.56L56.32 122.5866666666667C42.6506666666667 122.5973333333334 30.8426666666667 122.544 30.08 122.4586666666667M69.3866666666667 102.6666666666667C69.4933333333333 92.112 69.5253333333333 91.8986666666667 71.312 88.432C72.5493333333333 86.0373333333333 75.3706666666667 83.216 77.7653333333333 81.9786666666667C81.232 80.192 81.4453333333333 80.16 92 80.0533333333333L101.3333333333333 79.9573333333333L101.3333333333333 50.0586666666667L101.328 20.16L100.8266666666667 19.0933333333333C100.2186666666667 17.8133333333333 99.424 17.0293333333333 98.1333333333333 16.4426666666667C97.1786666666667 16.0106666666667 96.9173333333333 16.0106666666667 64 16.0106666666667C31.0826666666667 16.0106666666667 30.8213333333333 16.0106666666667 29.8666666666667 16.4426666666667C28.576 17.0293333333333 27.7813333333333 17.8133333333333 27.1733333333333 19.0933333333333L26.672 20.16L26.672 64C26.6773333333333 107.648 26.6773333333333 107.8453333333333 27.1093333333333 108.8C27.696 110.0906666666667 28.48 110.8853333333333 29.76 111.4933333333333L30.8266666666667 111.9946666666667L50.0586666666667 112L69.2906666666667 112L69.3866666666667 102.6666666666667M91.68 90.7146666666667C85.312 90.6613333333333 84.256 90.6986666666667 83.4453333333333 91.008C82.16 91.4933333333333 81.088 92.496 80.5013333333333 93.76C80.0106666666667 94.8106666666667 80.0053333333333 94.9226666666667 80 102.2933333333333L80 109.76L89.4933333333333 100.2666666666667L98.9866666666667 90.7733333333333L91.68 90.7146666666667M62.9333333333333 69.136C61.3706666666667 68.816 60.064 67.792 59.232 66.2453333333333C58.784 65.408 58.7733333333333 65.152 58.7093333333333 55.1733333333333L58.6453333333333 44.9546666666667L54.976 48.5813333333333C50.7946666666667 52.7146666666667 50.0853333333333 53.184 48 53.184C45.872 53.184 44.24 52.1706666666667 43.2533333333333 50.2453333333333C42.6346666666667 49.0293333333333 42.656 46.9386666666667 43.296 45.6533333333333C43.968 44.3093333333333 60.3093333333333 27.968 61.6533333333333 27.296C62.352 26.9493333333333 62.9866666666667 26.816 64 26.816C65.0133333333333 26.816 65.648 26.9493333333333 66.3466666666667 27.296C67.6906666666667 27.968 84.032 44.3093333333333 84.704 45.6533333333333C85.344 46.9386666666667 85.3653333333333 49.0293333333333 84.7466666666667 50.2453333333333C83.76 52.1706666666667 82.128 53.184 80 53.184C77.9146666666667 53.184 77.2053333333333 52.7146666666667 73.024 48.5813333333333L69.3546666666667 44.9546666666667L69.2906666666667 55.1733333333333C69.2266666666667 65.152 69.216 65.408 68.768 66.2453333333333C67.584 68.4533333333334 65.248 69.6106666666667 62.9333333333333 69.136" />
+    <glyph glyph-name="layout-panel-top"
       unicode="&#xF13C;"
-      horiz-adv-x="128" d="M44.9066666666667 122.4426666666667C32.4213333333333 122.336 30.912 122.288 29.76 121.9413333333333C22.992 119.9253333333333 17.9573333333333 114.5333333333333 16.496 107.7333333333333C16.128 106.0106666666667 16.1066666666667 103.808 16.1066666666667 64.1066666666667C16.1066666666667 19.0613333333334 16.0533333333333 21.2213333333333 17.2053333333333 17.8346666666667C19.232 11.8506666666667 24.272 7.3813333333333 30.7306666666667 5.84C32.2133333333333 5.488 34.8 5.4613333333333 70.016 5.392L107.7173333333333 5.3173333333333L108.736 5.84C109.952 6.4586666666667 110.9333333333333 7.4506666666667 111.552 8.6826666666667L112 9.584L112 64L112 118.416L111.4826666666667 119.44C110.944 120.496 109.872 121.584 108.848 122.1013333333333C108.368 122.3466666666667 104.064 122.4106666666667 83.52 122.48C69.9093333333333 122.5226666666667 52.5333333333333 122.5066666666667 44.9066666666667 122.4426666666667M48.0373333333333 92.64L48.1066666666667 73.28L48.5706666666667 72.4106666666667C49.168 71.296 50.5013333333333 70.096 51.5093333333333 69.7653333333333C51.952 69.616 52.9386666666667 69.536 53.728 69.584C54.9173333333333 69.648 55.3173333333333 69.7813333333333 56.2133333333333 70.3946666666667C56.8 70.7946666666667 59.9893333333333 73.808 63.3013333333333 77.088L69.3226666666667 83.0506666666667L75.472 76.992C78.8533333333333 73.6586666666667 82.0373333333333 70.6453333333333 82.544 70.2986666666667C83.3013333333333 69.7813333333333 83.7386666666667 69.648 84.944 69.5786666666667C86.8213333333333 69.4773333333333 88.0213333333333 69.9093333333333 89.072 71.0773333333333C90.6453333333333 72.816 90.5386666666667 71.344 90.624 92.7466666666667L90.704 112L96.016 112L101.3333333333333 112L101.3333333333333 77.3706666666667L101.3333333333333 42.736L67.5733333333333 42.592C49.008 42.512 32.9013333333333 42.3573333333333 31.7866666666667 42.2453333333333C30.3626666666667 42.1066666666667 29.2906666666667 41.856 28.1813333333333 41.3973333333333L26.6026666666667 40.7413333333333L26.72 73.568C26.8373333333333 106.2666666666667 26.8373333333333 106.3893333333333 27.28 107.2586666666667C27.8986666666667 108.464 29.9786666666667 110.6613333333333 31.0026666666667 111.184C32.24 111.8133333333333 33.904 111.9413333333333 41.3173333333333 111.9733333333333L47.9626666666667 112L48.0373333333333 92.64M80 99.808L80 87.6106666666667L76.64 90.9066666666667C74.7893333333333 92.7253333333333 72.8 94.5386666666667 72.2133333333333 94.944C71.2 95.6426666666667 71.0506666666667 95.68 69.3333333333333 95.68C67.616 95.68 67.4666666666667 95.6426666666667 66.4533333333333 94.944C65.8666666666667 94.5386666666667 63.8773333333333 92.7253333333333 62.0266666666667 90.9066666666667L58.6666666666667 87.6106666666667L58.6666666666667 99.808L58.6666666666667 112L69.3333333333333 112L80 112L80 99.808M101.3333333333333 24L101.3333333333333 16L67.04 16L32.7466666666667 16.0053333333333L31.616 16.528C30.1546666666667 17.2106666666667 28.1066666666667 19.1733333333333 27.4186666666667 20.5493333333334C26.9386666666667 21.5093333333333 26.88 21.888 26.8853333333333 23.9893333333334C26.8906666666667 26.8373333333333 27.1306666666667 27.488 28.912 29.408C30.832 31.4826666666667 31.232 31.6266666666667 35.52 31.792C37.5146666666667 31.8666666666667 53.136 31.9413333333334 70.24 31.9626666666667L101.3333333333333 32L101.3333333333333 24" />
-    <glyph glyph-name="book-marked-1"
-      unicode="&#x62;&#x6F;&#x6F;&#x6B;&#x2D;&#x6D;&#x61;&#x72;&#x6B;&#x65;&#x64;"
-      horiz-adv-x="128" d="M44.9066666666667 122.4426666666667C32.4213333333333 122.336 30.912 122.288 29.76 121.9413333333333C22.992 119.9253333333333 17.9573333333333 114.5333333333333 16.496 107.7333333333333C16.128 106.0106666666667 16.1066666666667 103.808 16.1066666666667 64.1066666666667C16.1066666666667 19.0613333333334 16.0533333333333 21.2213333333333 17.2053333333333 17.8346666666667C19.232 11.8506666666667 24.272 7.3813333333333 30.7306666666667 5.84C32.2133333333333 5.488 34.8 5.4613333333333 70.016 5.392L107.7173333333333 5.3173333333333L108.736 5.84C109.952 6.4586666666667 110.9333333333333 7.4506666666667 111.552 8.6826666666667L112 9.584L112 64L112 118.416L111.4826666666667 119.44C110.944 120.496 109.872 121.584 108.848 122.1013333333333C108.368 122.3466666666667 104.064 122.4106666666667 83.52 122.48C69.9093333333333 122.5226666666667 52.5333333333333 122.5066666666667 44.9066666666667 122.4426666666667M48.0373333333333 92.64L48.1066666666667 73.28L48.5706666666667 72.4106666666667C49.168 71.296 50.5013333333333 70.096 51.5093333333333 69.7653333333333C51.952 69.616 52.9386666666667 69.536 53.728 69.584C54.9173333333333 69.648 55.3173333333333 69.7813333333333 56.2133333333333 70.3946666666667C56.8 70.7946666666667 59.9893333333333 73.808 63.3013333333333 77.088L69.3226666666667 83.0506666666667L75.472 76.992C78.8533333333333 73.6586666666667 82.0373333333333 70.6453333333333 82.544 70.2986666666667C83.3013333333333 69.7813333333333 83.7386666666667 69.648 84.944 69.5786666666667C86.8213333333333 69.4773333333333 88.0213333333333 69.9093333333333 89.072 71.0773333333333C90.6453333333333 72.816 90.5386666666667 71.344 90.624 92.7466666666667L90.704 112L96.016 112L101.3333333333333 112L101.3333333333333 77.3706666666667L101.3333333333333 42.736L67.5733333333333 42.592C49.008 42.512 32.9013333333333 42.3573333333333 31.7866666666667 42.2453333333333C30.3626666666667 42.1066666666667 29.2906666666667 41.856 28.1813333333333 41.3973333333333L26.6026666666667 40.7413333333333L26.72 73.568C26.8373333333333 106.2666666666667 26.8373333333333 106.3893333333333 27.28 107.2586666666667C27.8986666666667 108.464 29.9786666666667 110.6613333333333 31.0026666666667 111.184C32.24 111.8133333333333 33.904 111.9413333333333 41.3173333333333 111.9733333333333L47.9626666666667 112L48.0373333333333 92.64M80 99.808L80 87.6106666666667L76.64 90.9066666666667C74.7893333333333 92.7253333333333 72.8 94.5386666666667 72.2133333333333 94.944C71.2 95.6426666666667 71.0506666666667 95.68 69.3333333333333 95.68C67.616 95.68 67.4666666666667 95.6426666666667 66.4533333333333 94.944C65.8666666666667 94.5386666666667 63.8773333333333 92.7253333333333 62.0266666666667 90.9066666666667L58.6666666666667 87.6106666666667L58.6666666666667 99.808L58.6666666666667 112L69.3333333333333 112L80 112L80 99.808M101.3333333333333 24L101.3333333333333 16L67.04 16L32.7466666666667 16.0053333333333L31.616 16.528C30.1546666666667 17.2106666666667 28.1066666666667 19.1733333333333 27.4186666666667 20.5493333333334C26.9386666666667 21.5093333333333 26.88 21.888 26.8853333333333 23.9893333333334C26.8906666666667 26.8373333333333 27.1306666666667 27.488 28.912 29.408C30.832 31.4826666666667 31.232 31.6266666666667 35.52 31.792C37.5146666666667 31.8666666666667 53.136 31.9413333333334 70.24 31.9626666666667L101.3333333333333 32L101.3333333333333 24" />
-    <glyph glyph-name="dot"
+      horiz-adv-x="128" d="M19.5253333333333 117.0933333333333C15.232 116.4693333333334 11.52 112.6773333333333 10.8906666666667 108.2666666666667C10.608 106.288 10.608 80.3786666666667 10.8906666666667 78.4C11.536 73.888 15.2213333333333 70.2026666666667 19.7333333333333 69.5573333333333C21.776 69.264 106.224 69.264 108.2666666666667 69.5573333333333C112.7786666666667 70.2026666666667 116.464 73.888 117.1093333333333 78.4C117.2373333333333 79.2693333333333 117.3226666666667 85.504 117.3226666666667 93.3333333333333C117.3226666666667 101.1626666666667 117.2373333333333 107.3973333333333 117.1093333333333 108.2666666666667C116.464 112.7786666666667 112.7786666666667 116.464 108.2666666666667 117.1093333333334C106.4 117.376 21.3653333333333 117.3653333333334 19.5253333333333 117.0933333333333M106.6666666666667 93.3333333333333L106.6666666666667 80L64 80L21.3333333333333 80L21.3333333333333 93.3333333333333L21.3333333333333 106.6666666666667L64 106.6666666666667L106.6666666666667 106.6666666666667L106.6666666666667 93.3333333333333M19.5253333333333 58.4266666666667C15.232 57.8026666666667 11.52 54.0106666666667 10.8906666666667 49.6C10.608 47.6213333333333 10.608 21.712 10.8906666666667 19.7333333333333C11.536 15.2213333333333 15.2213333333333 11.536 19.7333333333333 10.8906666666667C20.6026666666667 10.7626666666667 26.8373333333333 10.6773333333333 34.6666666666667 10.6773333333333C42.496 10.6773333333333 48.7306666666667 10.7626666666667 49.6 10.8906666666667C54.112 11.536 57.7973333333333 15.2213333333333 58.4426666666667 19.7333333333333C58.7253333333333 21.712 58.7253333333333 47.6213333333333 58.4426666666667 49.6C57.7973333333333 54.112 54.112 57.7973333333333 49.6 58.4426666666667C47.7653333333333 58.7093333333333 21.3386666666667 58.6933333333333 19.5253333333333 58.4266666666667M78.192 58.4266666666667C73.8986666666667 57.8026666666667 70.1866666666667 54.0106666666667 69.5573333333333 49.6C69.2746666666667 47.6213333333333 69.2746666666667 21.712 69.5573333333333 19.7333333333333C70.2026666666667 15.2213333333333 73.888 11.536 78.4 10.8906666666667C79.2693333333333 10.7626666666667 85.504 10.6773333333333 93.3333333333333 10.6773333333333C101.1626666666667 10.6773333333333 107.3973333333333 10.7626666666667 108.2666666666667 10.8906666666667C112.7786666666667 11.536 116.464 15.2213333333333 117.1093333333333 19.7333333333333C117.392 21.712 117.392 47.6213333333333 117.1093333333333 49.6C116.464 54.112 112.7786666666667 57.7973333333333 108.2666666666667 58.4426666666667C106.432 58.7093333333333 80.0053333333333 58.6933333333333 78.192 58.4266666666667M48 34.6666666666667L48 21.3333333333333L34.6666666666667 21.3333333333333L21.3333333333333 21.3333333333333L21.3333333333333 34.6666666666667L21.3333333333333 48L34.6666666666667 48L48 48L48 34.6666666666667M106.6666666666667 34.6666666666667L106.6666666666667 21.3333333333333L93.3333333333333 21.3333333333333L80 21.3333333333333L80 34.6666666666667L80 48L93.3333333333333 48L106.6666666666667 48L106.6666666666667 34.6666666666667" />
+    <glyph glyph-name="layout-panel-top-1"
+      unicode="&#x6C;&#x61;&#x79;&#x6F;&#x75;&#x74;&#x2D;&#x70;&#x61;&#x6E;&#x65;&#x6C;&#x2D;&#x74;&#x6F;&#x70;"
+      horiz-adv-x="128" d="M19.5253333333333 117.0933333333333C15.232 116.4693333333334 11.52 112.6773333333333 10.8906666666667 108.2666666666667C10.608 106.288 10.608 80.3786666666667 10.8906666666667 78.4C11.536 73.888 15.2213333333333 70.2026666666667 19.7333333333333 69.5573333333333C21.776 69.264 106.224 69.264 108.2666666666667 69.5573333333333C112.7786666666667 70.2026666666667 116.464 73.888 117.1093333333333 78.4C117.2373333333333 79.2693333333333 117.3226666666667 85.504 117.3226666666667 93.3333333333333C117.3226666666667 101.1626666666667 117.2373333333333 107.3973333333333 117.1093333333333 108.2666666666667C116.464 112.7786666666667 112.7786666666667 116.464 108.2666666666667 117.1093333333334C106.4 117.376 21.3653333333333 117.3653333333334 19.5253333333333 117.0933333333333M106.6666666666667 93.3333333333333L106.6666666666667 80L64 80L21.3333333333333 80L21.3333333333333 93.3333333333333L21.3333333333333 106.6666666666667L64 106.6666666666667L106.6666666666667 106.6666666666667L106.6666666666667 93.3333333333333M19.5253333333333 58.4266666666667C15.232 57.8026666666667 11.52 54.0106666666667 10.8906666666667 49.6C10.608 47.6213333333333 10.608 21.712 10.8906666666667 19.7333333333333C11.536 15.2213333333333 15.2213333333333 11.536 19.7333333333333 10.8906666666667C20.6026666666667 10.7626666666667 26.8373333333333 10.6773333333333 34.6666666666667 10.6773333333333C42.496 10.6773333333333 48.7306666666667 10.7626666666667 49.6 10.8906666666667C54.112 11.536 57.7973333333333 15.2213333333333 58.4426666666667 19.7333333333333C58.7253333333333 21.712 58.7253333333333 47.6213333333333 58.4426666666667 49.6C57.7973333333333 54.112 54.112 57.7973333333333 49.6 58.4426666666667C47.7653333333333 58.7093333333333 21.3386666666667 58.6933333333333 19.5253333333333 58.4266666666667M78.192 58.4266666666667C73.8986666666667 57.8026666666667 70.1866666666667 54.0106666666667 69.5573333333333 49.6C69.2746666666667 47.6213333333333 69.2746666666667 21.712 69.5573333333333 19.7333333333333C70.2026666666667 15.2213333333333 73.888 11.536 78.4 10.8906666666667C79.2693333333333 10.7626666666667 85.504 10.6773333333333 93.3333333333333 10.6773333333333C101.1626666666667 10.6773333333333 107.3973333333333 10.7626666666667 108.2666666666667 10.8906666666667C112.7786666666667 11.536 116.464 15.2213333333333 117.1093333333333 19.7333333333333C117.392 21.712 117.392 47.6213333333333 117.1093333333333 49.6C116.464 54.112 112.7786666666667 57.7973333333333 108.2666666666667 58.4426666666667C106.432 58.7093333333333 80.0053333333333 58.6933333333333 78.192 58.4266666666667M48 34.6666666666667L48 21.3333333333333L34.6666666666667 21.3333333333333L21.3333333333333 21.3333333333333L21.3333333333333 34.6666666666667L21.3333333333333 48L34.6666666666667 48L48 48L48 34.6666666666667M106.6666666666667 34.6666666666667L106.6666666666667 21.3333333333333L93.3333333333333 21.3333333333333L80 21.3333333333333L80 34.6666666666667L80 48L93.3333333333333 48L106.6666666666667 48L106.6666666666667 34.6666666666667" />
+    <glyph glyph-name="save"
       unicode="&#xF13D;"
-      horiz-adv-x="128" d="M62.3733333333333 73.824C60.9706666666667 73.6053333333333 58.5493333333333 72.3306666666667 57.3386666666667 71.1733333333334C55.2586666666667 69.1733333333334 54.1973333333333 66.9813333333333 54.0373333333333 64.32C53.8986666666667 62.1013333333333 54.3786666666667 59.824 55.3013333333333 58.288C56.2186666666667 56.7626666666667 58.528 54.6026666666667 60.016 53.8773333333333C62.432 52.6933333333333 66.6293333333333 52.6986666666667 69.072 53.8826666666667C70.6986666666667 54.6666666666667 73.3333333333333 57.3013333333333 74.1173333333333 58.928C75.3013333333333 61.36 75.3066666666667 65.5733333333333 74.1333333333333 67.968C73.472 69.312 71.6106666666667 71.4133333333333 70.24 72.3573333333333C69.7226666666667 72.7146666666667 68.8 73.1786666666667 68.1973333333333 73.3866666666667C66.896 73.84 63.9146666666667 74.064 62.3733333333333 73.824" />
-    <glyph glyph-name="dot-1"
-      unicode="&#x64;&#x6F;&#x74;"
-      horiz-adv-x="128" d="M62.3733333333333 73.824C60.9706666666667 73.6053333333333 58.5493333333333 72.3306666666667 57.3386666666667 71.1733333333334C55.2586666666667 69.1733333333334 54.1973333333333 66.9813333333333 54.0373333333333 64.32C53.8986666666667 62.1013333333333 54.3786666666667 59.824 55.3013333333333 58.288C56.2186666666667 56.7626666666667 58.528 54.6026666666667 60.016 53.8773333333333C62.432 52.6933333333333 66.6293333333333 52.6986666666667 69.072 53.8826666666667C70.6986666666667 54.6666666666667 73.3333333333333 57.3013333333333 74.1173333333333 58.928C75.3013333333333 61.36 75.3066666666667 65.5733333333333 74.1333333333333 67.968C73.472 69.312 71.6106666666667 71.4133333333333 70.24 72.3573333333333C69.7226666666667 72.7146666666667 68.8 73.1786666666667 68.1973333333333 73.3866666666667C66.896 73.84 63.9146666666667 74.064 62.3733333333333 73.824" />
-    <glyph glyph-name="circle-user"
+      horiz-adv-x="128" d="M34.9866666666667 117.1413333333333C23.296 117.0133333333333 23.1306666666667 117.008 21.76 116.5173333333334C18.9066666666667 115.4986666666667 16.3626666666667 113.7013333333334 14.288 111.248C12.96 109.6746666666667 12.128 108.0906666666667 11.3173333333333 105.6L10.6666666666667 103.5893333333333L10.6666666666667 64L10.6666666666667 24.4106666666667L11.3173333333333 22.4C12.448 18.9066666666667 13.9253333333333 16.6933333333333 16.6666666666667 14.3626666666667C18.3146666666667 12.9653333333333 19.872 12.1386666666667 22.4 11.3173333333333L24.4106666666667 10.6666666666667L64 10.6666666666667L103.5893333333333 10.6666666666667L105.6 11.3173333333333C108.128 12.1386666666667 109.6213333333333 12.9333333333333 111.28 14.352C114.096 16.7573333333333 115.5573333333333 18.928 116.6826666666667 22.4L117.3333333333333 24.4106666666667L117.328 55.3493333333333C117.3226666666667 85.2266666666667 117.312 86.3253333333333 116.9226666666667 87.1786666666667C116.6826666666667 87.7013333333333 115.0773333333334 89.5893333333333 113.008 91.7653333333333C107.4613333333333 97.616 89.168 115.664 88.016 116.4266666666667L86.9653333333333 117.12L74.0426666666667 117.12C66.9333333333333 117.12 57.904 117.1573333333333 53.9733333333333 117.1946666666667C50.0426666666667 117.2373333333334 41.4986666666667 117.216 34.9866666666667 117.1413333333333M32.0373333333333 95.3066666666667C32.112 84.1653333333333 32.1226666666667 83.9306666666667 32.5706666666667 83.0933333333333C33.1466666666667 82.0213333333333 34.1866666666667 81.0346666666667 35.3493333333333 80.448C36.2453333333333 80 36.2933333333333 80 58.6666666666667 80L81.0826666666667 80L82.0853333333333 80.512C84.144 81.568 85.1253333333333 83.136 85.1146666666667 85.3813333333334C85.1093333333333 87.0293333333333 84.624 88.176 83.5146666666667 89.1466666666667C81.904 90.5653333333333 83.104 90.4853333333333 61.9306666666667 90.6133333333334L42.6666666666667 90.7306666666667L42.6666666666667 98.6986666666667L42.6666666666667 106.6666666666667L62.88 106.6666666666667L83.0933333333333 106.6666666666667L94.8906666666667 94.8693333333334L106.688 83.072L106.624 54.176L106.56 25.28L106.0586666666667 24.2666666666667C105.7866666666667 23.7066666666667 105.216 22.9653333333333 104.7946666666667 22.6186666666667C103.52 21.568 102.4693333333333 21.3333333333333 99.072 21.3333333333333L96.0373333333333 21.3333333333333L95.9626666666667 40.6933333333333C95.8933333333333 60.0373333333333 95.8933333333333 60.0533333333333 95.4293333333333 60.9066666666667C94.912 61.872 94.1066666666667 62.6826666666667 93.0133333333333 63.3386666666667L92.2666666666667 63.7866666666667L64 63.7866666666667L35.7333333333333 63.7866666666667L34.9866666666667 63.3386666666667C33.8933333333333 62.6826666666667 33.088 61.872 32.5706666666667 60.9066666666667C32.1066666666667 60.0533333333333 32.1066666666667 60.0373333333333 32.0373333333333 40.6933333333333L31.9626666666667 21.3333333333333L28.944 21.3333333333333C27.28 21.3333333333333 25.5626666666667 21.4346666666667 25.1253333333333 21.5573333333333C23.904 21.8986666666667 22.5973333333333 23.0186666666667 21.92 24.3146666666667L21.312 25.472L21.376 64.096L21.44 102.72L21.9413333333333 103.7333333333333C22.2133333333333 104.2933333333333 22.7893333333333 105.04 23.2213333333333 105.392C24.4213333333333 106.3893333333333 25.536 106.6346666666667 28.9386666666667 106.6506666666667L31.9626666666667 106.6666666666667L32.0373333333333 95.3066666666667M85.3333333333333 37.3333333333333L85.3333333333333 21.3333333333333L64 21.3333333333333L42.6666666666667 21.3333333333333L42.6666666666667 37.3333333333333L42.6666666666667 53.3333333333333L64 53.3333333333333L85.3333333333333 53.3333333333333L85.3333333333333 37.3333333333333" />
+    <glyph glyph-name="save-1"
+      unicode="&#x73;&#x61;&#x76;&#x65;"
+      horiz-adv-x="128" d="M34.9866666666667 117.1413333333333C23.296 117.0133333333333 23.1306666666667 117.008 21.76 116.5173333333334C18.9066666666667 115.4986666666667 16.3626666666667 113.7013333333334 14.288 111.248C12.96 109.6746666666667 12.128 108.0906666666667 11.3173333333333 105.6L10.6666666666667 103.5893333333333L10.6666666666667 64L10.6666666666667 24.4106666666667L11.3173333333333 22.4C12.448 18.9066666666667 13.9253333333333 16.6933333333333 16.6666666666667 14.3626666666667C18.3146666666667 12.9653333333333 19.872 12.1386666666667 22.4 11.3173333333333L24.4106666666667 10.6666666666667L64 10.6666666666667L103.5893333333333 10.6666666666667L105.6 11.3173333333333C108.128 12.1386666666667 109.6213333333333 12.9333333333333 111.28 14.352C114.096 16.7573333333333 115.5573333333333 18.928 116.6826666666667 22.4L117.3333333333333 24.4106666666667L117.328 55.3493333333333C117.3226666666667 85.2266666666667 117.312 86.3253333333333 116.9226666666667 87.1786666666667C116.6826666666667 87.7013333333333 115.0773333333334 89.5893333333333 113.008 91.7653333333333C107.4613333333333 97.616 89.168 115.664 88.016 116.4266666666667L86.9653333333333 117.12L74.0426666666667 117.12C66.9333333333333 117.12 57.904 117.1573333333333 53.9733333333333 117.1946666666667C50.0426666666667 117.2373333333334 41.4986666666667 117.216 34.9866666666667 117.1413333333333M32.0373333333333 95.3066666666667C32.112 84.1653333333333 32.1226666666667 83.9306666666667 32.5706666666667 83.0933333333333C33.1466666666667 82.0213333333333 34.1866666666667 81.0346666666667 35.3493333333333 80.448C36.2453333333333 80 36.2933333333333 80 58.6666666666667 80L81.0826666666667 80L82.0853333333333 80.512C84.144 81.568 85.1253333333333 83.136 85.1146666666667 85.3813333333334C85.1093333333333 87.0293333333333 84.624 88.176 83.5146666666667 89.1466666666667C81.904 90.5653333333333 83.104 90.4853333333333 61.9306666666667 90.6133333333334L42.6666666666667 90.7306666666667L42.6666666666667 98.6986666666667L42.6666666666667 106.6666666666667L62.88 106.6666666666667L83.0933333333333 106.6666666666667L94.8906666666667 94.8693333333334L106.688 83.072L106.624 54.176L106.56 25.28L106.0586666666667 24.2666666666667C105.7866666666667 23.7066666666667 105.216 22.9653333333333 104.7946666666667 22.6186666666667C103.52 21.568 102.4693333333333 21.3333333333333 99.072 21.3333333333333L96.0373333333333 21.3333333333333L95.9626666666667 40.6933333333333C95.8933333333333 60.0373333333333 95.8933333333333 60.0533333333333 95.4293333333333 60.9066666666667C94.912 61.872 94.1066666666667 62.6826666666667 93.0133333333333 63.3386666666667L92.2666666666667 63.7866666666667L64 63.7866666666667L35.7333333333333 63.7866666666667L34.9866666666667 63.3386666666667C33.8933333333333 62.6826666666667 33.088 61.872 32.5706666666667 60.9066666666667C32.1066666666667 60.0533333333333 32.1066666666667 60.0373333333333 32.0373333333333 40.6933333333333L31.9626666666667 21.3333333333333L28.944 21.3333333333333C27.28 21.3333333333333 25.5626666666667 21.4346666666667 25.1253333333333 21.5573333333333C23.904 21.8986666666667 22.5973333333333 23.0186666666667 21.92 24.3146666666667L21.312 25.472L21.376 64.096L21.44 102.72L21.9413333333333 103.7333333333333C22.2133333333333 104.2933333333333 22.7893333333333 105.04 23.2213333333333 105.392C24.4213333333333 106.3893333333333 25.536 106.6346666666667 28.9386666666667 106.6506666666667L31.9626666666667 106.6666666666667L32.0373333333333 95.3066666666667M85.3333333333333 37.3333333333333L85.3333333333333 21.3333333333333L64 21.3333333333333L42.6666666666667 21.3333333333333L42.6666666666667 37.3333333333333L42.6666666666667 53.3333333333333L64 53.3333333333333L85.3333333333333 53.3333333333333L85.3333333333333 37.3333333333333" />
+    <glyph glyph-name="database"
       unicode="&#xF13E;"
-      horiz-adv-x="128" d="M61.44 122.5173333333334C45.3653333333333 121.5733333333334 31.232 114.9386666666667 20.656 103.3706666666667C16.944 99.312 14.0853333333333 95.0933333333333 11.536 89.92C6.9813333333333 80.672 4.992 70.9706666666667 5.5626666666667 60.7786666666667C5.7973333333333 56.544 6.256 53.504 7.2533333333333 49.5893333333333C9.3173333333333 41.472 13.3973333333333 33.3386666666667 18.6453333333333 26.88C20.8213333333333 24.208 25.712 19.5093333333333 28.4853333333333 17.4293333333333C37.1786666666667 10.9226666666667 46.8 7.072 57.7066666666667 5.744C60.4106666666667 5.4133333333333 67.2586666666667 5.4186666666667 70.1866666666667 5.7493333333333C80.9333333333333 6.96 91.5146666666667 11.2373333333333 99.9626666666667 17.7866666666667C103.0933333333333 20.208 107.792 24.9066666666667 110.2133333333333 28.0373333333334C115.424 34.7573333333333 119.376 43.1146666666667 121.168 51.2C121.968 54.8106666666667 122.272 57.536 122.3893333333333 62.2186666666667C122.6133333333333 71.072 121.5146666666667 77.728 118.6133333333333 85.104C115.5413333333334 92.896 111.3226666666667 99.3813333333334 105.536 105.1946666666667C100.6133333333333 110.144 96.5493333333333 113.0773333333333 90.24 116.24C82.4693333333333 120.128 76.2293333333333 121.808 67.2 122.4426666666667C65.4986666666667 122.5653333333333 63.7706666666667 122.6453333333333 63.36 122.624C62.9493333333333 122.6026666666667 62.0853333333333 122.5546666666667 61.44 122.5173333333334M68.5493333333333 111.7866666666667C79.328 110.8906666666667 90.1173333333333 105.776 98.0266666666667 97.8133333333333C105.232 90.56 109.9573333333333 81.168 111.4933333333333 71.04C111.9573333333333 68.0053333333333 112.016 60.7893333333333 111.6053333333333 57.8133333333333C110.1066666666667 46.9813333333333 105.776 38.24 97.7333333333333 29.8133333333333C96.8693333333333 28.9066666666667 96.0746666666667 28.16 95.9733333333333 28.16C95.872 28.16 95.7866666666667 28.4693333333333 95.7866666666667 28.8533333333333C95.7813333333333 29.7386666666667 94.5386666666667 33.3546666666667 93.8133333333333 34.592C92.9706666666667 36.032 91.6746666666667 37.52 90.08 38.8746666666667C88.352 40.3466666666667 86.8586666666667 41.1733333333333 84.608 41.904L82.9333333333333 42.4533333333334L64 42.4533333333334L45.0666666666667 42.4533333333334L43.4346666666667 41.92C41.1626666666667 41.1786666666667 39.9786666666667 40.5386666666667 38.1546666666667 39.072C36.432 37.6853333333333 35.1573333333333 36.2613333333333 34.272 34.7466666666667C33.5733333333333 33.5466666666667 32.5333333333333 30.736 32.3253333333333 29.4933333333333C32.2453333333333 28.9973333333333 32.0906666666667 28.5386666666667 31.9893333333333 28.4693333333333C31.4613333333333 28.144 26.6133333333333 33.6106666666667 24.128 37.3333333333333C14.576 51.6266666666667 13.3546666666667 69.872 20.928 85.0986666666667C25.7813333333333 94.864 33.1893333333333 102.2826666666667 42.7733333333333 106.992C51.0933333333333 111.072 59.12 112.5653333333333 68.5493333333333 111.7866666666667M60.2986666666667 95.5733333333333C58.56 95.264 56.3146666666667 94.5066666666667 54.5173333333333 93.632C49.584 91.2266666666667 45.7013333333333 86.7253333333333 43.8186666666667 81.2373333333333L42.992 78.8266666666667L42.992 74.6666666666667L42.992 70.5066666666667L43.8186666666667 68.096C45.024 64.576 46.3733333333333 62.4266666666667 49.0666666666667 59.7333333333333C51.76 57.04 53.9093333333333 55.6906666666667 57.4293333333333 54.4853333333333L59.84 53.6586666666667L64 53.6586666666667L68.16 53.6586666666667L70.5706666666667 54.4853333333333C73.9306666666667 55.6373333333333 76.224 57.0506666666667 78.7413333333333 59.52C82.928 63.6266666666667 84.8266666666667 67.84 85.0613333333333 73.5306666666667C85.328 80.064 83.5893333333333 84.7946666666667 79.264 89.3493333333333C76.7253333333333 92.0213333333333 73.008 94.224 69.44 95.1733333333333C67.536 95.6746666666667 62.1813333333333 95.9146666666667 60.2986666666667 95.5733333333333M66.256 85.104C68.048 84.7733333333333 69.856 83.744 71.4666666666667 82.1333333333333C74.0693333333333 79.5306666666667 75.0346666666667 76.6026666666667 74.5013333333333 72.9493333333333C74.0213333333333 69.6426666666667 71.664 66.5653333333333 68.368 64.9386666666667L66.688 64.1066666666667L64 64.1066666666667L61.312 64.1066666666667L59.632 64.9386666666667C56.6666666666667 66.4 54.1653333333333 69.4293333333334 53.568 72.2773333333333C52.784 76.032 53.7973333333333 79.3973333333333 56.5333333333333 82.1333333333333C59.2693333333333 84.8693333333334 62.3626666666667 85.8133333333333 66.256 85.104M81.8613333333333 31.6746666666667C83.056 31.1733333333333 83.984 30.3786666666667 84.5973333333333 29.3333333333333C85.0506666666667 28.56 85.1733333333333 28.016 85.2746666666667 26.3946666666667C85.3386666666667 25.3013333333333 85.3226666666667 23.5786666666667 85.2373333333333 22.5706666666667L85.0826666666667 20.7306666666667L83.024 19.8826666666667C70.32 14.6613333333333 57.68 14.6613333333333 44.976 19.8826666666667L42.912 20.7306666666667L42.7626666666667 22.352C42.6773333333333 23.2426666666667 42.6613333333333 24.96 42.72 26.1653333333333C42.816 28.032 42.9173333333333 28.5066666666667 43.3973333333333 29.3226666666667C44 30.3573333333333 44.9226666666667 31.1573333333333 46.0906666666667 31.664C47.2106666666667 32.1493333333333 80.6986666666667 32.16 81.8613333333333 31.6746666666667" />
-    <glyph glyph-name="circle-user-1"
-      unicode="&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x75;&#x73;&#x65;&#x72;"
-      horiz-adv-x="128" d="M61.44 122.5173333333334C45.3653333333333 121.5733333333334 31.232 114.9386666666667 20.656 103.3706666666667C16.944 99.312 14.0853333333333 95.0933333333333 11.536 89.92C6.9813333333333 80.672 4.992 70.9706666666667 5.5626666666667 60.7786666666667C5.7973333333333 56.544 6.256 53.504 7.2533333333333 49.5893333333333C9.3173333333333 41.472 13.3973333333333 33.3386666666667 18.6453333333333 26.88C20.8213333333333 24.208 25.712 19.5093333333333 28.4853333333333 17.4293333333333C37.1786666666667 10.9226666666667 46.8 7.072 57.7066666666667 5.744C60.4106666666667 5.4133333333333 67.2586666666667 5.4186666666667 70.1866666666667 5.7493333333333C80.9333333333333 6.96 91.5146666666667 11.2373333333333 99.9626666666667 17.7866666666667C103.0933333333333 20.208 107.792 24.9066666666667 110.2133333333333 28.0373333333334C115.424 34.7573333333333 119.376 43.1146666666667 121.168 51.2C121.968 54.8106666666667 122.272 57.536 122.3893333333333 62.2186666666667C122.6133333333333 71.072 121.5146666666667 77.728 118.6133333333333 85.104C115.5413333333334 92.896 111.3226666666667 99.3813333333334 105.536 105.1946666666667C100.6133333333333 110.144 96.5493333333333 113.0773333333333 90.24 116.24C82.4693333333333 120.128 76.2293333333333 121.808 67.2 122.4426666666667C65.4986666666667 122.5653333333333 63.7706666666667 122.6453333333333 63.36 122.624C62.9493333333333 122.6026666666667 62.0853333333333 122.5546666666667 61.44 122.5173333333334M68.5493333333333 111.7866666666667C79.328 110.8906666666667 90.1173333333333 105.776 98.0266666666667 97.8133333333333C105.232 90.56 109.9573333333333 81.168 111.4933333333333 71.04C111.9573333333333 68.0053333333333 112.016 60.7893333333333 111.6053333333333 57.8133333333333C110.1066666666667 46.9813333333333 105.776 38.24 97.7333333333333 29.8133333333333C96.8693333333333 28.9066666666667 96.0746666666667 28.16 95.9733333333333 28.16C95.872 28.16 95.7866666666667 28.4693333333333 95.7866666666667 28.8533333333333C95.7813333333333 29.7386666666667 94.5386666666667 33.3546666666667 93.8133333333333 34.592C92.9706666666667 36.032 91.6746666666667 37.52 90.08 38.8746666666667C88.352 40.3466666666667 86.8586666666667 41.1733333333333 84.608 41.904L82.9333333333333 42.4533333333334L64 42.4533333333334L45.0666666666667 42.4533333333334L43.4346666666667 41.92C41.1626666666667 41.1786666666667 39.9786666666667 40.5386666666667 38.1546666666667 39.072C36.432 37.6853333333333 35.1573333333333 36.2613333333333 34.272 34.7466666666667C33.5733333333333 33.5466666666667 32.5333333333333 30.736 32.3253333333333 29.4933333333333C32.2453333333333 28.9973333333333 32.0906666666667 28.5386666666667 31.9893333333333 28.4693333333333C31.4613333333333 28.144 26.6133333333333 33.6106666666667 24.128 37.3333333333333C14.576 51.6266666666667 13.3546666666667 69.872 20.928 85.0986666666667C25.7813333333333 94.864 33.1893333333333 102.2826666666667 42.7733333333333 106.992C51.0933333333333 111.072 59.12 112.5653333333333 68.5493333333333 111.7866666666667M60.2986666666667 95.5733333333333C58.56 95.264 56.3146666666667 94.5066666666667 54.5173333333333 93.632C49.584 91.2266666666667 45.7013333333333 86.7253333333333 43.8186666666667 81.2373333333333L42.992 78.8266666666667L42.992 74.6666666666667L42.992 70.5066666666667L43.8186666666667 68.096C45.024 64.576 46.3733333333333 62.4266666666667 49.0666666666667 59.7333333333333C51.76 57.04 53.9093333333333 55.6906666666667 57.4293333333333 54.4853333333333L59.84 53.6586666666667L64 53.6586666666667L68.16 53.6586666666667L70.5706666666667 54.4853333333333C73.9306666666667 55.6373333333333 76.224 57.0506666666667 78.7413333333333 59.52C82.928 63.6266666666667 84.8266666666667 67.84 85.0613333333333 73.5306666666667C85.328 80.064 83.5893333333333 84.7946666666667 79.264 89.3493333333333C76.7253333333333 92.0213333333333 73.008 94.224 69.44 95.1733333333333C67.536 95.6746666666667 62.1813333333333 95.9146666666667 60.2986666666667 95.5733333333333M66.256 85.104C68.048 84.7733333333333 69.856 83.744 71.4666666666667 82.1333333333333C74.0693333333333 79.5306666666667 75.0346666666667 76.6026666666667 74.5013333333333 72.9493333333333C74.0213333333333 69.6426666666667 71.664 66.5653333333333 68.368 64.9386666666667L66.688 64.1066666666667L64 64.1066666666667L61.312 64.1066666666667L59.632 64.9386666666667C56.6666666666667 66.4 54.1653333333333 69.4293333333334 53.568 72.2773333333333C52.784 76.032 53.7973333333333 79.3973333333333 56.5333333333333 82.1333333333333C59.2693333333333 84.8693333333334 62.3626666666667 85.8133333333333 66.256 85.104M81.8613333333333 31.6746666666667C83.056 31.1733333333333 83.984 30.3786666666667 84.5973333333333 29.3333333333333C85.0506666666667 28.56 85.1733333333333 28.016 85.2746666666667 26.3946666666667C85.3386666666667 25.3013333333333 85.3226666666667 23.5786666666667 85.2373333333333 22.5706666666667L85.0826666666667 20.7306666666667L83.024 19.8826666666667C70.32 14.6613333333333 57.68 14.6613333333333 44.976 19.8826666666667L42.912 20.7306666666667L42.7626666666667 22.352C42.6773333333333 23.2426666666667 42.6613333333333 24.96 42.72 26.1653333333333C42.816 28.032 42.9173333333333 28.5066666666667 43.3973333333333 29.3226666666667C44 30.3573333333333 44.9226666666667 31.1573333333333 46.0906666666667 31.664C47.2106666666667 32.1493333333333 80.6986666666667 32.16 81.8613333333333 31.6746666666667" />
-    <glyph glyph-name="circle-alert"
+      horiz-adv-x="128" d="M59.9466666666667 122.528C48.1813333333333 122.1973333333333 38.064 120.6826666666667 29.344 117.9413333333333C19.2906666666667 114.784 13.0986666666667 110.2453333333333 11.2853333333333 104.7093333333333L10.7733333333333 103.1466666666667L10.7733333333333 63.8933333333334L10.7733333333333 24.64L11.2746666666667 23.2533333333333C12.944 18.6026666666667 17.1573333333333 14.9333333333333 24.3306666666667 11.8826666666667C31.6746666666667 8.7573333333333 42.2186666666667 6.56 53.76 5.7493333333333C58.288 5.4293333333333 69.712 5.4293333333333 74.24 5.7493333333333C88.1386666666667 6.7253333333333 100.4106666666667 9.7013333333333 107.7813333333333 13.8826666666667C113.6 17.1733333333333 116.5813333333333 20.864 117.136 25.4453333333333C117.2693333333333 26.5653333333333 117.328 40.9493333333333 117.2853333333333 65.28L117.2266666666667 103.36L116.6506666666667 104.9333333333333C114.9973333333333 109.472 110.784 113.0986666666667 103.6693333333333 116.1173333333333C96.2666666666667 119.264 85.1413333333333 121.568 74.24 122.224C70.128 122.4693333333334 63.1413333333333 122.6186666666667 59.9466666666667 122.528M73.2106666666667 111.7813333333333C88.5333333333333 110.752 102.304 106.752 106.1813333333333 102.208C106.848 101.424 106.784 101.0773333333333 105.8026666666667 100.0906666666667C102.8426666666667 97.1306666666667 96.2133333333333 94.5013333333333 87.1466666666667 92.6933333333333C80 91.264 73.1626666666667 90.6666666666667 64 90.6666666666667C60.8853333333333 90.6666666666667 56.8053333333333 90.7626666666667 54.928 90.8853333333333C39.6533333333333 91.8613333333333 25.712 95.8933333333334 21.8186666666667 100.4586666666667C21.2266666666667 101.1573333333333 21.2266666666667 101.5093333333333 21.8186666666667 102.208C25.6266666666667 106.6666666666667 39.488 110.7466666666667 54.2933333333333 111.7653333333333C58.0746666666667 112.0213333333333 69.4506666666667 112.032 73.2106666666667 111.7813333333333M29.3333333333333 84.7253333333333C36.48 82.4853333333333 44.528 81.0666666666667 53.76 80.416C58.288 80.096 69.712 80.096 74.24 80.416C86.0533333333333 81.248 96.4853333333333 83.456 104.0533333333333 86.7253333333333L106.6666666666667 87.8506666666667L106.6613333333333 75.7653333333333C106.6506666666667 62.096 106.8533333333333 63.568 104.7466666666667 61.856C99.744 57.8026666666667 87.1733333333333 54.5386666666667 72.7466666666667 53.5466666666667C68.768 53.2746666666667 59.232 53.2746666666667 55.2533333333333 53.5466666666667C40.8266666666667 54.5386666666667 28.256 57.8026666666667 23.2533333333333 61.856C21.1466666666667 63.568 21.3493333333333 62.096 21.3386666666667 75.7653333333333L21.3333333333333 87.8506666666667L23.9466666666667 86.7253333333333C25.3866666666667 86.1013333333333 27.808 85.2053333333333 29.3333333333333 84.7253333333333M29.3333333333333 47.392C36.48 45.152 44.528 43.7333333333333 53.76 43.0826666666667C58.288 42.7626666666667 69.712 42.7626666666667 74.24 43.0826666666667C86.0533333333333 43.9146666666667 96.4853333333333 46.1226666666667 104.0533333333333 49.392L106.6666666666667 50.5173333333333L106.6666666666667 38.416L106.6666666666667 26.3093333333333L105.8666666666667 25.504C101.2906666666667 20.896 88.432 17.2906666666667 72.7466666666667 16.2133333333333C68.768 15.9413333333333 59.232 15.9413333333333 55.2533333333333 16.2133333333333C39.2693333333333 17.312 25.8186666666667 21.1626666666667 21.8186666666667 25.7973333333333L21.3493333333333 26.3466666666667L21.3386666666667 38.432L21.3333333333333 50.5173333333333L23.9466666666667 49.392C25.3866666666667 48.768 27.808 47.872 29.3333333333333 47.392" />
+    <glyph glyph-name="database-1"
+      unicode="&#x64;&#x61;&#x74;&#x61;&#x62;&#x61;&#x73;&#x65;"
+      horiz-adv-x="128" d="M59.9466666666667 122.528C48.1813333333333 122.1973333333333 38.064 120.6826666666667 29.344 117.9413333333333C19.2906666666667 114.784 13.0986666666667 110.2453333333333 11.2853333333333 104.7093333333333L10.7733333333333 103.1466666666667L10.7733333333333 63.8933333333334L10.7733333333333 24.64L11.2746666666667 23.2533333333333C12.944 18.6026666666667 17.1573333333333 14.9333333333333 24.3306666666667 11.8826666666667C31.6746666666667 8.7573333333333 42.2186666666667 6.56 53.76 5.7493333333333C58.288 5.4293333333333 69.712 5.4293333333333 74.24 5.7493333333333C88.1386666666667 6.7253333333333 100.4106666666667 9.7013333333333 107.7813333333333 13.8826666666667C113.6 17.1733333333333 116.5813333333333 20.864 117.136 25.4453333333333C117.2693333333333 26.5653333333333 117.328 40.9493333333333 117.2853333333333 65.28L117.2266666666667 103.36L116.6506666666667 104.9333333333333C114.9973333333333 109.472 110.784 113.0986666666667 103.6693333333333 116.1173333333333C96.2666666666667 119.264 85.1413333333333 121.568 74.24 122.224C70.128 122.4693333333334 63.1413333333333 122.6186666666667 59.9466666666667 122.528M73.2106666666667 111.7813333333333C88.5333333333333 110.752 102.304 106.752 106.1813333333333 102.208C106.848 101.424 106.784 101.0773333333333 105.8026666666667 100.0906666666667C102.8426666666667 97.1306666666667 96.2133333333333 94.5013333333333 87.1466666666667 92.6933333333333C80 91.264 73.1626666666667 90.6666666666667 64 90.6666666666667C60.8853333333333 90.6666666666667 56.8053333333333 90.7626666666667 54.928 90.8853333333333C39.6533333333333 91.8613333333333 25.712 95.8933333333334 21.8186666666667 100.4586666666667C21.2266666666667 101.1573333333333 21.2266666666667 101.5093333333333 21.8186666666667 102.208C25.6266666666667 106.6666666666667 39.488 110.7466666666667 54.2933333333333 111.7653333333333C58.0746666666667 112.0213333333333 69.4506666666667 112.032 73.2106666666667 111.7813333333333M29.3333333333333 84.7253333333333C36.48 82.4853333333333 44.528 81.0666666666667 53.76 80.416C58.288 80.096 69.712 80.096 74.24 80.416C86.0533333333333 81.248 96.4853333333333 83.456 104.0533333333333 86.7253333333333L106.6666666666667 87.8506666666667L106.6613333333333 75.7653333333333C106.6506666666667 62.096 106.8533333333333 63.568 104.7466666666667 61.856C99.744 57.8026666666667 87.1733333333333 54.5386666666667 72.7466666666667 53.5466666666667C68.768 53.2746666666667 59.232 53.2746666666667 55.2533333333333 53.5466666666667C40.8266666666667 54.5386666666667 28.256 57.8026666666667 23.2533333333333 61.856C21.1466666666667 63.568 21.3493333333333 62.096 21.3386666666667 75.7653333333333L21.3333333333333 87.8506666666667L23.9466666666667 86.7253333333333C25.3866666666667 86.1013333333333 27.808 85.2053333333333 29.3333333333333 84.7253333333333M29.3333333333333 47.392C36.48 45.152 44.528 43.7333333333333 53.76 43.0826666666667C58.288 42.7626666666667 69.712 42.7626666666667 74.24 43.0826666666667C86.0533333333333 43.9146666666667 96.4853333333333 46.1226666666667 104.0533333333333 49.392L106.6666666666667 50.5173333333333L106.6666666666667 38.416L106.6666666666667 26.3093333333333L105.8666666666667 25.504C101.2906666666667 20.896 88.432 17.2906666666667 72.7466666666667 16.2133333333333C68.768 15.9413333333333 59.232 15.9413333333333 55.2533333333333 16.2133333333333C39.2693333333333 17.312 25.8186666666667 21.1626666666667 21.8186666666667 25.7973333333333L21.3493333333333 26.3466666666667L21.3386666666667 38.432L21.3333333333333 50.5173333333333L23.9466666666667 49.392C25.3866666666667 48.768 27.808 47.872 29.3333333333333 47.392" />
+    <glyph glyph-name="sliders-horizontal"
       unicode="&#xF13F;"
+      horiz-adv-x="128" d="M72.624 122.1493333333333C71.6533333333333 121.728 70.4373333333333 120.5866666666667 69.9093333333333 119.5946666666667C69.44 118.7253333333334 69.44 118.6613333333333 69.44 106.6666666666667C69.44 94.7146666666667 69.4453333333333 94.608 69.8986666666667 93.76C70.9333333333333 91.8453333333333 72.5386666666667 90.88 74.6666666666667 90.88C76.192 90.88 77.28 91.2853333333333 78.2613333333333 92.224C79.6426666666667 93.5466666666667 79.8453333333333 94.2453333333333 79.9573333333333 97.9573333333333L80.0533333333333 101.296L96.72 101.3706666666667C113.312 101.4453333333333 113.392 101.4453333333333 114.24 101.904C116.1706666666667 102.944 117.1253333333333 104.5386666666667 117.1146666666667 106.7146666666667C117.1093333333333 108.3626666666667 116.624 109.5093333333333 115.5146666666667 110.48C113.9146666666667 111.888 114.8266666666667 111.8133333333333 96.624 111.9466666666667L80.0533333333333 112.064L79.9573333333333 115.392C79.872 118.2186666666667 79.792 118.848 79.4133333333333 119.5733333333334C78.8853333333333 120.5973333333334 78.0586666666667 121.3973333333333 76.912 122.0053333333334C75.9093333333333 122.5333333333333 73.6746666666667 122.608 72.624 122.1493333333333M19.6266666666667 111.808C13.52 111.664 13.4453333333333 111.648 12.0746666666667 110.048C11.1893333333333 109.0133333333333 10.8853333333333 108.096 10.88 106.5013333333333C10.88 104.4693333333333 11.9306666666667 102.864 13.9146666666667 101.8453333333333L14.9173333333333 101.3333333333333L34.6666666666667 101.3333333333333L54.416 101.3333333333333L55.4186666666667 101.8453333333333C57.4613333333333 102.8906666666667 58.4533333333333 104.464 58.4533333333333 106.6666666666667C58.4533333333333 108.7733333333333 57.632 110.1866666666667 55.7866666666667 111.248L54.9333333333333 111.744L40 111.84C31.7866666666667 111.888 22.6186666666667 111.8773333333333 19.6266666666667 111.808M40.624 79.4826666666667C39.6373333333333 79.056 38.432 77.9093333333333 37.9253333333333 76.928C37.5413333333333 76.1813333333333 37.4613333333333 75.568 37.376 72.7253333333333L37.28 69.3973333333333L26.0426666666667 69.28C13.7173333333333 69.152 14.048 69.1893333333333 12.4853333333333 67.8133333333333C11.376 66.8426666666667 10.8906666666667 65.696 10.8853333333333 64.048C10.8746666666667 61.872 11.8346666666667 60.272 13.76 59.2373333333333C14.5973333333333 58.7893333333333 14.832 58.7786666666667 25.9466666666667 58.704L37.28 58.6293333333333L37.376 55.2853333333333C37.488 51.5786666666667 37.6906666666667 50.88 39.072 49.5573333333333C40.0533333333333 48.6186666666667 41.1413333333333 48.2133333333333 42.6666666666667 48.2133333333333C44.7946666666667 48.2133333333333 46.4 49.1786666666667 47.4346666666667 51.0933333333333C47.888 51.9413333333334 47.8933333333333 52.048 47.8933333333333 64C47.8933333333333 75.9413333333334 47.888 76.0586666666667 47.4346666666667 76.9066666666667C46.8746666666667 77.9413333333334 46.048 78.736 44.912 79.3386666666667C43.9093333333333 79.8666666666667 41.6746666666667 79.9413333333334 40.624 79.4826666666667M69.0133333333333 69.136C61.36 68.9973333333333 61.4826666666667 69.024 60.0746666666667 67.3813333333334C59.1893333333333 66.3466666666667 58.8853333333333 65.4293333333334 58.88 63.8346666666667C58.88 61.8026666666667 59.9306666666667 60.1973333333334 61.9146666666667 59.1786666666667L62.9173333333333 58.6666666666667L88 58.6666666666667L113.0826666666667 58.6666666666667L114.0853333333333 59.1786666666667C116.128 60.224 117.12 61.7973333333333 117.12 64C117.12 66.1066666666667 116.2986666666667 67.52 114.4533333333333 68.5813333333333L113.6 69.0773333333333L94.72 69.168C84.336 69.2213333333333 72.768 69.2053333333333 69.0133333333333 69.136M83.2906666666667 36.816C82.32 36.3946666666667 81.104 35.2533333333333 80.576 34.2613333333333C80.1066666666667 33.392 80.1066666666667 33.328 80.1066666666667 21.3333333333333C80.1066666666667 9.3813333333333 80.112 9.2746666666667 80.5653333333333 8.4266666666667C81.6 6.512 83.2053333333333 5.5466666666667 85.3333333333333 5.5466666666667C86.8586666666667 5.5466666666667 87.9466666666667 5.952 88.928 6.8906666666667C90.3093333333333 8.2133333333333 90.512 8.912 90.624 12.6186666666667L90.72 15.9626666666667L102.0533333333333 16.0373333333334C113.168 16.112 113.4026666666667 16.1226666666667 114.24 16.5706666666667C116.1653333333333 17.6053333333333 117.1253333333333 19.2053333333333 117.1146666666667 21.3813333333333C117.1093333333333 23.0293333333333 116.624 24.176 115.5146666666667 25.1466666666667C113.952 26.5226666666667 114.2826666666667 26.4853333333333 101.9573333333333 26.6133333333333L90.72 26.7306666666667L90.624 30.0586666666667C90.5386666666667 32.8853333333333 90.4586666666667 33.5146666666667 90.08 34.24C89.552 35.264 88.7253333333333 36.064 87.5786666666667 36.672C86.576 37.2 84.3413333333333 37.2746666666667 83.2906666666667 36.816M21.0133333333333 26.4693333333333C13.36 26.3306666666667 13.4826666666667 26.3573333333333 12.0746666666667 24.7146666666667C11.1893333333333 23.68 10.8853333333333 22.7626666666667 10.88 21.168C10.88 19.136 11.9306666666667 17.5306666666667 13.9146666666667 16.512L14.9173333333333 16L40 16L65.0826666666667 16L66.0853333333333 16.512C68.128 17.5573333333333 69.12 19.1306666666667 69.12 21.3333333333333C69.12 23.44 68.2986666666667 24.8533333333333 66.4533333333333 25.9146666666667L65.6 26.4106666666667L46.72 26.5013333333334C36.336 26.5546666666667 24.768 26.5386666666667 21.0133333333333 26.4693333333333" />
+    <glyph glyph-name="sliders-horizontal-1"
+      unicode="&#x73;&#x6C;&#x69;&#x64;&#x65;&#x72;&#x73;&#x2D;&#x68;&#x6F;&#x72;&#x69;&#x7A;&#x6F;&#x6E;&#x74;&#x61;&#x6C;"
+      horiz-adv-x="128" d="M72.624 122.1493333333333C71.6533333333333 121.728 70.4373333333333 120.5866666666667 69.9093333333333 119.5946666666667C69.44 118.7253333333334 69.44 118.6613333333333 69.44 106.6666666666667C69.44 94.7146666666667 69.4453333333333 94.608 69.8986666666667 93.76C70.9333333333333 91.8453333333333 72.5386666666667 90.88 74.6666666666667 90.88C76.192 90.88 77.28 91.2853333333333 78.2613333333333 92.224C79.6426666666667 93.5466666666667 79.8453333333333 94.2453333333333 79.9573333333333 97.9573333333333L80.0533333333333 101.296L96.72 101.3706666666667C113.312 101.4453333333333 113.392 101.4453333333333 114.24 101.904C116.1706666666667 102.944 117.1253333333333 104.5386666666667 117.1146666666667 106.7146666666667C117.1093333333333 108.3626666666667 116.624 109.5093333333333 115.5146666666667 110.48C113.9146666666667 111.888 114.8266666666667 111.8133333333333 96.624 111.9466666666667L80.0533333333333 112.064L79.9573333333333 115.392C79.872 118.2186666666667 79.792 118.848 79.4133333333333 119.5733333333334C78.8853333333333 120.5973333333334 78.0586666666667 121.3973333333333 76.912 122.0053333333334C75.9093333333333 122.5333333333333 73.6746666666667 122.608 72.624 122.1493333333333M19.6266666666667 111.808C13.52 111.664 13.4453333333333 111.648 12.0746666666667 110.048C11.1893333333333 109.0133333333333 10.8853333333333 108.096 10.88 106.5013333333333C10.88 104.4693333333333 11.9306666666667 102.864 13.9146666666667 101.8453333333333L14.9173333333333 101.3333333333333L34.6666666666667 101.3333333333333L54.416 101.3333333333333L55.4186666666667 101.8453333333333C57.4613333333333 102.8906666666667 58.4533333333333 104.464 58.4533333333333 106.6666666666667C58.4533333333333 108.7733333333333 57.632 110.1866666666667 55.7866666666667 111.248L54.9333333333333 111.744L40 111.84C31.7866666666667 111.888 22.6186666666667 111.8773333333333 19.6266666666667 111.808M40.624 79.4826666666667C39.6373333333333 79.056 38.432 77.9093333333333 37.9253333333333 76.928C37.5413333333333 76.1813333333333 37.4613333333333 75.568 37.376 72.7253333333333L37.28 69.3973333333333L26.0426666666667 69.28C13.7173333333333 69.152 14.048 69.1893333333333 12.4853333333333 67.8133333333333C11.376 66.8426666666667 10.8906666666667 65.696 10.8853333333333 64.048C10.8746666666667 61.872 11.8346666666667 60.272 13.76 59.2373333333333C14.5973333333333 58.7893333333333 14.832 58.7786666666667 25.9466666666667 58.704L37.28 58.6293333333333L37.376 55.2853333333333C37.488 51.5786666666667 37.6906666666667 50.88 39.072 49.5573333333333C40.0533333333333 48.6186666666667 41.1413333333333 48.2133333333333 42.6666666666667 48.2133333333333C44.7946666666667 48.2133333333333 46.4 49.1786666666667 47.4346666666667 51.0933333333333C47.888 51.9413333333334 47.8933333333333 52.048 47.8933333333333 64C47.8933333333333 75.9413333333334 47.888 76.0586666666667 47.4346666666667 76.9066666666667C46.8746666666667 77.9413333333334 46.048 78.736 44.912 79.3386666666667C43.9093333333333 79.8666666666667 41.6746666666667 79.9413333333334 40.624 79.4826666666667M69.0133333333333 69.136C61.36 68.9973333333333 61.4826666666667 69.024 60.0746666666667 67.3813333333334C59.1893333333333 66.3466666666667 58.8853333333333 65.4293333333334 58.88 63.8346666666667C58.88 61.8026666666667 59.9306666666667 60.1973333333334 61.9146666666667 59.1786666666667L62.9173333333333 58.6666666666667L88 58.6666666666667L113.0826666666667 58.6666666666667L114.0853333333333 59.1786666666667C116.128 60.224 117.12 61.7973333333333 117.12 64C117.12 66.1066666666667 116.2986666666667 67.52 114.4533333333333 68.5813333333333L113.6 69.0773333333333L94.72 69.168C84.336 69.2213333333333 72.768 69.2053333333333 69.0133333333333 69.136M83.2906666666667 36.816C82.32 36.3946666666667 81.104 35.2533333333333 80.576 34.2613333333333C80.1066666666667 33.392 80.1066666666667 33.328 80.1066666666667 21.3333333333333C80.1066666666667 9.3813333333333 80.112 9.2746666666667 80.5653333333333 8.4266666666667C81.6 6.512 83.2053333333333 5.5466666666667 85.3333333333333 5.5466666666667C86.8586666666667 5.5466666666667 87.9466666666667 5.952 88.928 6.8906666666667C90.3093333333333 8.2133333333333 90.512 8.912 90.624 12.6186666666667L90.72 15.9626666666667L102.0533333333333 16.0373333333334C113.168 16.112 113.4026666666667 16.1226666666667 114.24 16.5706666666667C116.1653333333333 17.6053333333333 117.1253333333333 19.2053333333333 117.1146666666667 21.3813333333333C117.1093333333333 23.0293333333333 116.624 24.176 115.5146666666667 25.1466666666667C113.952 26.5226666666667 114.2826666666667 26.4853333333333 101.9573333333333 26.6133333333333L90.72 26.7306666666667L90.624 30.0586666666667C90.5386666666667 32.8853333333333 90.4586666666667 33.5146666666667 90.08 34.24C89.552 35.264 88.7253333333333 36.064 87.5786666666667 36.672C86.576 37.2 84.3413333333333 37.2746666666667 83.2906666666667 36.816M21.0133333333333 26.4693333333333C13.36 26.3306666666667 13.4826666666667 26.3573333333333 12.0746666666667 24.7146666666667C11.1893333333333 23.68 10.8853333333333 22.7626666666667 10.88 21.168C10.88 19.136 11.9306666666667 17.5306666666667 13.9146666666667 16.512L14.9173333333333 16L40 16L65.0826666666667 16L66.0853333333333 16.512C68.128 17.5573333333333 69.12 19.1306666666667 69.12 21.3333333333333C69.12 23.44 68.2986666666667 24.8533333333333 66.4533333333333 25.9146666666667L65.6 26.4106666666667L46.72 26.5013333333334C36.336 26.5546666666667 24.768 26.5386666666667 21.0133333333333 26.4693333333333" />
+    <glyph glyph-name="circle-alert"
+      unicode="&#xF140;"
       horiz-adv-x="128" d="M61.44 122.5173333333334C45.3653333333333 121.5733333333334 31.232 114.9386666666667 20.656 103.3706666666667C16.944 99.312 14.0853333333333 95.0933333333333 11.536 89.92C6.9813333333333 80.672 4.992 70.9706666666667 5.5626666666667 60.7786666666667C5.7973333333333 56.544 6.256 53.504 7.2533333333333 49.5893333333333C9.3173333333333 41.472 13.3973333333333 33.3386666666667 18.6453333333333 26.88C20.8213333333333 24.208 25.712 19.5093333333333 28.4853333333333 17.4293333333333C37.1786666666667 10.9226666666667 46.8 7.072 57.7066666666667 5.744C60.4106666666667 5.4133333333333 67.2586666666667 5.4186666666667 70.1866666666667 5.7493333333333C80.9333333333333 6.96 91.5146666666667 11.2373333333333 99.9626666666667 17.7866666666667C103.0933333333333 20.208 107.792 24.9066666666667 110.2133333333333 28.0373333333334C115.424 34.7573333333333 119.376 43.1146666666667 121.168 51.2C121.968 54.8106666666667 122.272 57.536 122.3893333333333 62.2186666666667C122.6133333333333 71.072 121.5146666666667 77.728 118.6133333333333 85.104C115.5413333333334 92.896 111.3226666666667 99.3813333333334 105.536 105.1946666666667C100.6133333333333 110.144 96.5493333333333 113.0773333333333 90.24 116.24C82.4693333333333 120.128 76.2293333333333 121.808 67.2 122.4426666666667C65.4986666666667 122.5653333333333 63.7706666666667 122.6453333333333 63.36 122.624C62.9493333333333 122.6026666666667 62.0853333333333 122.5546666666667 61.44 122.5173333333334M68.5493333333333 111.7866666666667C79.328 110.8906666666667 90.1173333333333 105.776 98.0266666666667 97.8133333333333C116.7093333333333 79.0026666666667 116.6026666666667 48.656 97.7866666666667 29.9626666666667C89.8346666666667 22.0586666666667 79.8453333333333 17.3653333333333 68.496 16.192C65.488 15.8826666666667 59.3386666666667 16.0533333333333 56.5333333333333 16.528C48.2346666666667 17.936 40.2453333333333 21.504 33.8293333333333 26.6773333333333C24.64 34.0906666666667 18.24 45.248 16.5386666666667 56.8426666666667C15.1146666666667 66.5173333333333 16.672 76.544 20.928 85.0986666666667C25.7813333333333 94.864 33.1893333333333 102.2826666666667 42.7733333333333 106.992C51.0933333333333 111.072 59.12 112.5653333333333 68.5493333333333 111.7866666666667M61.9573333333333 90.1493333333333C60.9866666666667 89.728 59.7706666666667 88.5866666666667 59.2426666666667 87.5946666666667C58.7733333333333 86.7253333333333 58.7733333333333 86.6613333333333 58.7733333333333 74.6666666666667C58.7733333333333 62.7146666666667 58.7786666666667 62.608 59.232 61.76C60.2666666666667 59.8453333333333 61.872 58.88 64 58.88C66.128 58.88 67.7333333333333 59.8453333333333 68.768 61.76C69.2213333333333 62.608 69.2266666666667 62.7146666666667 69.2266666666667 74.6666666666667C69.2266666666667 86.608 69.2213333333333 86.7253333333333 68.768 87.5733333333333C68.208 88.608 67.3813333333333 89.4026666666667 66.2453333333333 90.0053333333333C65.2426666666667 90.5333333333333 63.008 90.608 61.9573333333333 90.1493333333333M61.712 47.3386666666667C59.9253333333333 46.4586666666667 58.8373333333333 44.6933333333333 58.832 42.672C58.8213333333333 41.0986666666667 59.3706666666667 39.8453333333333 60.5013333333333 38.8533333333333C62.672 36.9386666666667 65.8506666666667 37.04 67.7653333333333 39.072C68.8533333333333 40.2346666666667 69.2106666666667 41.1253333333333 69.2106666666667 42.6666666666667C69.2106666666667 44.7893333333333 67.9893333333333 46.6613333333333 66.0853333333333 47.456C64.9226666666667 47.9413333333334 62.8106666666667 47.8826666666667 61.712 47.3386666666667" />
     <glyph glyph-name="circle-alert-1"
       unicode="&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x61;&#x6C;&#x65;&#x72;&#x74;"
       horiz-adv-x="128" d="M61.44 122.5173333333334C45.3653333333333 121.5733333333334 31.232 114.9386666666667 20.656 103.3706666666667C16.944 99.312 14.0853333333333 95.0933333333333 11.536 89.92C6.9813333333333 80.672 4.992 70.9706666666667 5.5626666666667 60.7786666666667C5.7973333333333 56.544 6.256 53.504 7.2533333333333 49.5893333333333C9.3173333333333 41.472 13.3973333333333 33.3386666666667 18.6453333333333 26.88C20.8213333333333 24.208 25.712 19.5093333333333 28.4853333333333 17.4293333333333C37.1786666666667 10.9226666666667 46.8 7.072 57.7066666666667 5.744C60.4106666666667 5.4133333333333 67.2586666666667 5.4186666666667 70.1866666666667 5.7493333333333C80.9333333333333 6.96 91.5146666666667 11.2373333333333 99.9626666666667 17.7866666666667C103.0933333333333 20.208 107.792 24.9066666666667 110.2133333333333 28.0373333333334C115.424 34.7573333333333 119.376 43.1146666666667 121.168 51.2C121.968 54.8106666666667 122.272 57.536 122.3893333333333 62.2186666666667C122.6133333333333 71.072 121.5146666666667 77.728 118.6133333333333 85.104C115.5413333333334 92.896 111.3226666666667 99.3813333333334 105.536 105.1946666666667C100.6133333333333 110.144 96.5493333333333 113.0773333333333 90.24 116.24C82.4693333333333 120.128 76.2293333333333 121.808 67.2 122.4426666666667C65.4986666666667 122.5653333333333 63.7706666666667 122.6453333333333 63.36 122.624C62.9493333333333 122.6026666666667 62.0853333333333 122.5546666666667 61.44 122.5173333333334M68.5493333333333 111.7866666666667C79.328 110.8906666666667 90.1173333333333 105.776 98.0266666666667 97.8133333333333C116.7093333333333 79.0026666666667 116.6026666666667 48.656 97.7866666666667 29.9626666666667C89.8346666666667 22.0586666666667 79.8453333333333 17.3653333333333 68.496 16.192C65.488 15.8826666666667 59.3386666666667 16.0533333333333 56.5333333333333 16.528C48.2346666666667 17.936 40.2453333333333 21.504 33.8293333333333 26.6773333333333C24.64 34.0906666666667 18.24 45.248 16.5386666666667 56.8426666666667C15.1146666666667 66.5173333333333 16.672 76.544 20.928 85.0986666666667C25.7813333333333 94.864 33.1893333333333 102.2826666666667 42.7733333333333 106.992C51.0933333333333 111.072 59.12 112.5653333333333 68.5493333333333 111.7866666666667M61.9573333333333 90.1493333333333C60.9866666666667 89.728 59.7706666666667 88.5866666666667 59.2426666666667 87.5946666666667C58.7733333333333 86.7253333333333 58.7733333333333 86.6613333333333 58.7733333333333 74.6666666666667C58.7733333333333 62.7146666666667 58.7786666666667 62.608 59.232 61.76C60.2666666666667 59.8453333333333 61.872 58.88 64 58.88C66.128 58.88 67.7333333333333 59.8453333333333 68.768 61.76C69.2213333333333 62.608 69.2266666666667 62.7146666666667 69.2266666666667 74.6666666666667C69.2266666666667 86.608 69.2213333333333 86.7253333333333 68.768 87.5733333333333C68.208 88.608 67.3813333333333 89.4026666666667 66.2453333333333 90.0053333333333C65.2426666666667 90.5333333333333 63.008 90.608 61.9573333333333 90.1493333333333M61.712 47.3386666666667C59.9253333333333 46.4586666666667 58.8373333333333 44.6933333333333 58.832 42.672C58.8213333333333 41.0986666666667 59.3706666666667 39.8453333333333 60.5013333333333 38.8533333333333C62.672 36.9386666666667 65.8506666666667 37.04 67.7653333333333 39.072C68.8533333333333 40.2346666666667 69.2106666666667 41.1253333333333 69.2106666666667 42.6666666666667C69.2106666666667 44.7893333333333 67.9893333333333 46.6613333333333 66.0853333333333 47.456C64.9226666666667 47.9413333333334 62.8106666666667 47.8826666666667 61.712 47.3386666666667" />
-    <glyph glyph-name="message-circle-question"
-      unicode="&#xF140;"
-      horiz-adv-x="128" d="M58.24 116.9706666666667C57.8293333333333 116.928 56.192 116.6613333333333 54.6026666666667 116.3733333333333C43.7546666666667 114.4266666666667 33.9306666666667 109.2693333333333 26.1333333333333 101.44C18.4533333333333 93.7226666666667 13.152 83.232 11.4773333333333 72.4373333333333C11.0986666666667 69.984 11.0133333333333 68.5066666666667 11.008 64.32C11.0026666666667 56.0373333333333 11.8293333333333 51.456 14.6346666666667 44.16L15.5786666666667 41.7066666666667L10.5653333333333 26.7946666666667C5.0933333333333 10.528 5.056 10.3786666666667 5.9466666666667 8.4266666666667C6.432 7.36 7.7973333333333 6.1066666666667 8.8586666666667 5.76C10.592 5.184 11.632 5.4666666666667 27.056 10.6506666666667L41.7546666666667 15.5946666666667L43.8613333333333 14.7573333333333C47.9466666666667 13.1306666666667 52.5226666666667 11.888 56.6453333333333 11.2746666666667C57.6426666666667 11.1306666666667 60.816 11.024 64.32 11.0293333333333C69.8773333333333 11.0293333333333 70.496 11.072 73.1893333333333 11.5893333333333C85.4133333333333 13.9466666666667 95.2053333333333 19.344 103.4613333333333 28.2666666666667C111.36 36.8053333333333 116.5066666666667 48.9866666666667 117.1146666666667 60.5546666666667C117.6426666666667 70.7146666666667 115.792 79.8026666666667 111.4506666666667 88.32C106.6986666666667 97.648 98.1813333333333 106.2346666666667 88.72 111.232C83.1733333333333 114.1653333333333 76.2826666666667 116.2506666666667 70.0053333333333 116.896C67.968 117.104 59.9786666666667 117.1573333333333 58.24 116.9706666666667M70.8266666666667 106.144C75.4293333333333 105.3653333333333 79.2 104.112 83.392 101.9786666666667C87.6 99.8293333333333 90.7466666666667 97.5626666666667 94.08 94.2613333333333C106.96 81.536 110.3466666666667 61.6 102.3786666666667 45.408C100.2133333333333 41.0186666666667 98.048 37.9253333333333 94.7253333333333 34.48C87.0186666666667 26.5013333333334 77.0293333333333 21.968 65.92 21.4133333333333C59.3653333333333 21.088 52.64 22.416 46.1066666666667 25.3333333333333C44 26.2773333333333 43.7226666666667 26.3466666666667 42.1333333333333 26.336C40.5066666666667 26.32 39.936 26.1546666666667 30.032 22.8266666666667C24.3146666666667 20.9066666666667 19.5626666666667 19.4026666666667 19.4773333333333 19.4933333333333C19.392 19.5786666666667 20.7786666666667 23.9893333333334 22.5546666666667 29.2906666666667C24.336 34.592 25.952 39.5573333333333 26.144 40.32C26.656 42.336 26.48 43.4346666666667 25.12 46.6346666666667C22.8746666666667 51.9306666666667 21.9573333333333 55.6 21.5306666666667 61.0026666666667C20.9866666666667 67.9786666666667 22.4 75.7386666666667 25.3706666666667 82.0266666666667C27.5626666666667 86.6773333333333 30.1866666666667 90.384 33.8986666666667 94.096C40.8853333333333 101.0773333333333 49.4506666666667 105.2746666666667 59.0933333333333 106.448C61.424 106.7306666666667 68.4373333333333 106.5493333333333 70.8266666666667 106.144M58.5493333333333 95.28C51.7546666666667 93.4773333333333 46.624 89.1946666666667 44.16 83.2746666666667C42.9813333333333 80.4426666666667 43.0666666666667 78.4746666666667 44.448 76.7146666666667C45.952 74.7946666666667 49.152 74.2933333333333 51.312 75.632C52.1813333333333 76.1706666666667 52.5173333333333 76.592 53.4986666666667 78.4C54.9173333333333 81.0133333333333 55.808 82.128 57.4293333333333 83.3226666666667C60.5333333333333 85.6053333333333 64.72 85.9626666666667 68.2346666666667 84.24C70.8586666666667 82.9546666666667 73.2106666666667 80.0586666666667 73.9413333333333 77.2106666666667C74.7306666666667 74.1333333333333 73.968 71.8453333333333 71.296 69.296C69.3866666666667 67.4666666666667 67.1786666666667 66.0746666666667 63.136 64.1493333333334C60.1546666666667 62.7253333333333 59.344 62.0906666666667 58.784 60.752C58.3306666666667 59.664 58.3626666666667 57.4933333333333 58.8533333333333 56.416C59.44 55.1306666666667 60.7893333333333 54.08 62.432 53.6373333333333C63.8026666666667 53.264 63.84 53.264 65.3493333333333 53.744C69.0186666666667 54.9013333333333 74.5333333333333 58.0586666666667 77.9466666666667 60.944C81.0133333333333 63.5413333333333 83.3813333333333 67.232 84.2933333333333 70.8266666666667C84.688 72.4 84.736 73.0186666666667 84.6346666666667 75.728C84.5066666666667 79.1626666666667 84.1226666666667 80.8746666666667 82.8906666666667 83.5466666666667C80.352 89.04 75.1893333333333 93.4506666666667 69.296 95.1626666666667C68.0533333333333 95.5253333333333 66.9866666666667 95.6373333333334 64.1066666666667 95.7066666666667C60.7946666666667 95.7866666666667 60.3146666666667 95.7493333333333 58.5493333333333 95.28M61.712 42.0053333333333C59.9253333333333 41.1253333333333 58.8373333333333 39.36 58.832 37.3386666666667C58.8213333333333 35.7653333333333 59.3706666666667 34.512 60.5013333333333 33.52C62.672 31.6053333333333 65.8506666666667 31.7066666666667 67.7653333333333 33.7386666666667C68.8533333333333 34.9013333333333 69.2106666666667 35.792 69.2106666666667 37.3333333333333C69.2106666666667 39.456 67.9893333333333 41.328 66.0853333333333 42.1226666666667C64.9226666666667 42.608 62.8106666666667 42.5493333333334 61.712 42.0053333333333" />
-    <glyph glyph-name="message-circle-question-1"
-      unicode="&#x6D;&#x65;&#x73;&#x73;&#x61;&#x67;&#x65;&#x2D;&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x71;&#x75;&#x65;&#x73;&#x74;&#x69;&#x6F;&#x6E;"
-      horiz-adv-x="128" d="M58.24 116.9706666666667C57.8293333333333 116.928 56.192 116.6613333333333 54.6026666666667 116.3733333333333C43.7546666666667 114.4266666666667 33.9306666666667 109.2693333333333 26.1333333333333 101.44C18.4533333333333 93.7226666666667 13.152 83.232 11.4773333333333 72.4373333333333C11.0986666666667 69.984 11.0133333333333 68.5066666666667 11.008 64.32C11.0026666666667 56.0373333333333 11.8293333333333 51.456 14.6346666666667 44.16L15.5786666666667 41.7066666666667L10.5653333333333 26.7946666666667C5.0933333333333 10.528 5.056 10.3786666666667 5.9466666666667 8.4266666666667C6.432 7.36 7.7973333333333 6.1066666666667 8.8586666666667 5.76C10.592 5.184 11.632 5.4666666666667 27.056 10.6506666666667L41.7546666666667 15.5946666666667L43.8613333333333 14.7573333333333C47.9466666666667 13.1306666666667 52.5226666666667 11.888 56.6453333333333 11.2746666666667C57.6426666666667 11.1306666666667 60.816 11.024 64.32 11.0293333333333C69.8773333333333 11.0293333333333 70.496 11.072 73.1893333333333 11.5893333333333C85.4133333333333 13.9466666666667 95.2053333333333 19.344 103.4613333333333 28.2666666666667C111.36 36.8053333333333 116.5066666666667 48.9866666666667 117.1146666666667 60.5546666666667C117.6426666666667 70.7146666666667 115.792 79.8026666666667 111.4506666666667 88.32C106.6986666666667 97.648 98.1813333333333 106.2346666666667 88.72 111.232C83.1733333333333 114.1653333333333 76.2826666666667 116.2506666666667 70.0053333333333 116.896C67.968 117.104 59.9786666666667 117.1573333333333 58.24 116.9706666666667M70.8266666666667 106.144C75.4293333333333 105.3653333333333 79.2 104.112 83.392 101.9786666666667C87.6 99.8293333333333 90.7466666666667 97.5626666666667 94.08 94.2613333333333C106.96 81.536 110.3466666666667 61.6 102.3786666666667 45.408C100.2133333333333 41.0186666666667 98.048 37.9253333333333 94.7253333333333 34.48C87.0186666666667 26.5013333333334 77.0293333333333 21.968 65.92 21.4133333333333C59.3653333333333 21.088 52.64 22.416 46.1066666666667 25.3333333333333C44 26.2773333333333 43.7226666666667 26.3466666666667 42.1333333333333 26.336C40.5066666666667 26.32 39.936 26.1546666666667 30.032 22.8266666666667C24.3146666666667 20.9066666666667 19.5626666666667 19.4026666666667 19.4773333333333 19.4933333333333C19.392 19.5786666666667 20.7786666666667 23.9893333333334 22.5546666666667 29.2906666666667C24.336 34.592 25.952 39.5573333333333 26.144 40.32C26.656 42.336 26.48 43.4346666666667 25.12 46.6346666666667C22.8746666666667 51.9306666666667 21.9573333333333 55.6 21.5306666666667 61.0026666666667C20.9866666666667 67.9786666666667 22.4 75.7386666666667 25.3706666666667 82.0266666666667C27.5626666666667 86.6773333333333 30.1866666666667 90.384 33.8986666666667 94.096C40.8853333333333 101.0773333333333 49.4506666666667 105.2746666666667 59.0933333333333 106.448C61.424 106.7306666666667 68.4373333333333 106.5493333333333 70.8266666666667 106.144M58.5493333333333 95.28C51.7546666666667 93.4773333333333 46.624 89.1946666666667 44.16 83.2746666666667C42.9813333333333 80.4426666666667 43.0666666666667 78.4746666666667 44.448 76.7146666666667C45.952 74.7946666666667 49.152 74.2933333333333 51.312 75.632C52.1813333333333 76.1706666666667 52.5173333333333 76.592 53.4986666666667 78.4C54.9173333333333 81.0133333333333 55.808 82.128 57.4293333333333 83.3226666666667C60.5333333333333 85.6053333333333 64.72 85.9626666666667 68.2346666666667 84.24C70.8586666666667 82.9546666666667 73.2106666666667 80.0586666666667 73.9413333333333 77.2106666666667C74.7306666666667 74.1333333333333 73.968 71.8453333333333 71.296 69.296C69.3866666666667 67.4666666666667 67.1786666666667 66.0746666666667 63.136 64.1493333333334C60.1546666666667 62.7253333333333 59.344 62.0906666666667 58.784 60.752C58.3306666666667 59.664 58.3626666666667 57.4933333333333 58.8533333333333 56.416C59.44 55.1306666666667 60.7893333333333 54.08 62.432 53.6373333333333C63.8026666666667 53.264 63.84 53.264 65.3493333333333 53.744C69.0186666666667 54.9013333333333 74.5333333333333 58.0586666666667 77.9466666666667 60.944C81.0133333333333 63.5413333333333 83.3813333333333 67.232 84.2933333333333 70.8266666666667C84.688 72.4 84.736 73.0186666666667 84.6346666666667 75.728C84.5066666666667 79.1626666666667 84.1226666666667 80.8746666666667 82.8906666666667 83.5466666666667C80.352 89.04 75.1893333333333 93.4506666666667 69.296 95.1626666666667C68.0533333333333 95.5253333333333 66.9866666666667 95.6373333333334 64.1066666666667 95.7066666666667C60.7946666666667 95.7866666666667 60.3146666666667 95.7493333333333 58.5493333333333 95.28M61.712 42.0053333333333C59.9253333333333 41.1253333333333 58.8373333333333 39.36 58.832 37.3386666666667C58.8213333333333 35.7653333333333 59.3706666666667 34.512 60.5013333333333 33.52C62.672 31.6053333333333 65.8506666666667 31.7066666666667 67.7653333333333 33.7386666666667C68.8533333333333 34.9013333333333 69.2106666666667 35.792 69.2106666666667 37.3333333333333C69.2106666666667 39.456 67.9893333333333 41.328 66.0853333333333 42.1226666666667C64.9226666666667 42.608 62.8106666666667 42.5493333333334 61.712 42.0053333333333" />
-    <glyph glyph-name="receipt-text"
+    <glyph glyph-name="pencil-line"
       unicode="&#xF141;"
-      horiz-adv-x="128" d="M20.16 122.4746666666667C18.5653333333333 122.0693333333333 17.3973333333333 121.1253333333333 16.5653333333333 119.5733333333334L16.1066666666667 118.72L16.1066666666667 64L16.1066666666667 9.28L16.5653333333333 8.4213333333333C17.5893333333333 6.512 19.1786666666667 5.5093333333333 21.2586666666667 5.4666666666667C22.5546666666667 5.44 22.7413333333333 5.5093333333333 27.296 7.7813333333333L31.9893333333333 10.1226666666667L36.6506666666667 7.8133333333333C42.944 4.6933333333333 42.3893333333333 4.6933333333333 48.6773333333333 7.808L53.3333333333333 10.1173333333333L57.9893333333333 7.808C64.2773333333333 4.6933333333333 63.7226666666667 4.6933333333333 70.0106666666667 7.808L74.6666666666667 10.1173333333333L79.3226666666667 7.808C85.6106666666667 4.6933333333333 85.056 4.6933333333333 91.344 7.808L96 10.1173333333333L100.6933333333333 7.792C105.1626666666667 5.5786666666667 105.4506666666667 5.4666666666667 106.72 5.472C108.8213333333333 5.4773333333333 110.3733333333333 6.448 111.4346666666667 8.4266666666667L111.8933333333333 9.28L111.8933333333333 64L111.8933333333333 118.72L111.4346666666667 119.5786666666667C110.4106666666667 121.488 108.8213333333333 122.4906666666667 106.7413333333333 122.5333333333333C105.4453333333333 122.56 105.2586666666667 122.4906666666667 100.704 120.2186666666667L96.0106666666667 117.8773333333334L91.3493333333333 120.1866666666667C85.056 123.3066666666667 85.6106666666667 123.3066666666667 79.3226666666667 120.192L74.6666666666667 117.8826666666667L70.0106666666667 120.192C63.7226666666667 123.3066666666667 64.2773333333333 123.3066666666667 57.9893333333333 120.192L53.3333333333333 117.8826666666667L48.6773333333333 120.192C42.3893333333333 123.3066666666667 42.944 123.3066666666667 36.656 120.192L32 117.8826666666667L27.36 120.1653333333333C22.6346666666667 122.4853333333333 21.552 122.832 20.16 122.4746666666667M47.4133333333333 109.0986666666667C53.5893333333333 106.0373333333333 53.0666666666667 106.032 59.344 109.1413333333333L64 111.4506666666667L68.656 109.1413333333333C74.944 106.0266666666667 74.3893333333333 106.0266666666667 80.6773333333333 109.1413333333333L85.3333333333333 111.4506666666667L89.9893333333333 109.1413333333333C94.4106666666667 106.9546666666667 94.7093333333333 106.8373333333333 95.9786666666667 106.8373333333333C97.1253333333333 106.8373333333333 97.5946666666667 106.976 99.3226666666667 107.808L101.3333333333333 108.784L101.3333333333333 64L101.3333333333333 19.216L99.3226666666667 20.192C97.5946666666667 21.024 97.1253333333333 21.1626666666667 95.9786666666667 21.1626666666667C94.7093333333333 21.1626666666667 94.4106666666667 21.0453333333333 89.9893333333333 18.8586666666667L85.3333333333333 16.5493333333334L80.6773333333333 18.8586666666667C74.3893333333333 21.9733333333333 74.944 21.9733333333333 68.656 18.8586666666667L64 16.5493333333334L59.344 18.8586666666667C53.056 21.9733333333333 53.6106666666667 21.9733333333333 47.3226666666667 18.8586666666667L42.6666666666667 16.5493333333334L38.0106666666667 18.8586666666667C33.5893333333333 21.0453333333333 33.2906666666667 21.1626666666667 32.0213333333333 21.1626666666667C30.8746666666667 21.1626666666667 30.4053333333333 21.024 28.6773333333333 20.192L26.6666666666667 19.216L26.6666666666667 64L26.6666666666667 108.784L28.6773333333333 107.808C30.4053333333333 106.9706666666667 30.8746666666667 106.8373333333333 32.0266666666667 106.8373333333333C33.296 106.8373333333333 33.584 106.9493333333333 37.856 109.0826666666667C40.3253333333333 110.32 42.464 111.3386666666667 42.6026666666667 111.344C42.7466666666667 111.3546666666667 44.912 110.3413333333333 47.4133333333333 109.0986666666667M41.6 90.4693333333333C39.1306666666667 89.9573333333333 37.4826666666667 87.9093333333333 37.4826666666667 85.3333333333333C37.4826666666667 83.2106666666667 38.4693333333333 81.6106666666667 40.4213333333333 80.5653333333333C41.28 80.1066666666667 41.2853333333333 80.1066666666667 58.6666666666667 80.1066666666667C76.048 80.1066666666667 76.0533333333333 80.1066666666667 76.912 80.5653333333333C78.864 81.6106666666667 79.8506666666667 83.2106666666667 79.8506666666667 85.3333333333333C79.8506666666667 87.456 78.864 89.056 76.912 90.1013333333333C76.0533333333333 90.56 76.0053333333333 90.56 59.2 90.592C49.9306666666667 90.608 42.0106666666667 90.5546666666667 41.6 90.4693333333333M41.6 69.136C39.1306666666667 68.6293333333333 37.4826666666667 66.576 37.4826666666667 64C37.4826666666667 61.8773333333333 38.4693333333333 60.2773333333333 40.4213333333333 59.232L41.28 58.7733333333333L64 58.7733333333333L86.72 58.7733333333333L87.5786666666667 59.232C89.5306666666667 60.2773333333333 90.5173333333333 61.8773333333333 90.5173333333333 64C90.5173333333333 66.1226666666667 89.5306666666667 67.7226666666667 87.5786666666667 68.768L86.72 69.2266666666667L64.5333333333333 69.2586666666667C52.3306666666667 69.2746666666667 42.0106666666667 69.2213333333333 41.6 69.136M41.6 47.8026666666667C39.1253333333333 47.2906666666667 37.4826666666667 45.2373333333333 37.4826666666667 42.6666666666667C37.4826666666667 40.544 38.4693333333333 38.944 40.4213333333333 37.8986666666667C41.2746666666667 37.44 41.344 37.44 56 37.44C70.656 37.44 70.7253333333333 37.44 71.5786666666667 37.8986666666667C73.5306666666667 38.944 74.5173333333333 40.544 74.5173333333333 42.6666666666667C74.5173333333333 44.7893333333333 73.5306666666667 46.3893333333333 71.5786666666667 47.4346666666667C70.7253333333333 47.888 70.608 47.8933333333333 56.5333333333333 47.9253333333333C48.7306666666667 47.9466666666667 42.0106666666667 47.888 41.6 47.8026666666667" />
-    <glyph glyph-name="receipt-text-1"
-      unicode="&#x72;&#x65;&#x63;&#x65;&#x69;&#x70;&#x74;&#x2D;&#x74;&#x65;&#x78;&#x74;"
-      horiz-adv-x="128" d="M20.16 122.4746666666667C18.5653333333333 122.0693333333333 17.3973333333333 121.1253333333333 16.5653333333333 119.5733333333334L16.1066666666667 118.72L16.1066666666667 64L16.1066666666667 9.28L16.5653333333333 8.4213333333333C17.5893333333333 6.512 19.1786666666667 5.5093333333333 21.2586666666667 5.4666666666667C22.5546666666667 5.44 22.7413333333333 5.5093333333333 27.296 7.7813333333333L31.9893333333333 10.1226666666667L36.6506666666667 7.8133333333333C42.944 4.6933333333333 42.3893333333333 4.6933333333333 48.6773333333333 7.808L53.3333333333333 10.1173333333333L57.9893333333333 7.808C64.2773333333333 4.6933333333333 63.7226666666667 4.6933333333333 70.0106666666667 7.808L74.6666666666667 10.1173333333333L79.3226666666667 7.808C85.6106666666667 4.6933333333333 85.056 4.6933333333333 91.344 7.808L96 10.1173333333333L100.6933333333333 7.792C105.1626666666667 5.5786666666667 105.4506666666667 5.4666666666667 106.72 5.472C108.8213333333333 5.4773333333333 110.3733333333333 6.448 111.4346666666667 8.4266666666667L111.8933333333333 9.28L111.8933333333333 64L111.8933333333333 118.72L111.4346666666667 119.5786666666667C110.4106666666667 121.488 108.8213333333333 122.4906666666667 106.7413333333333 122.5333333333333C105.4453333333333 122.56 105.2586666666667 122.4906666666667 100.704 120.2186666666667L96.0106666666667 117.8773333333334L91.3493333333333 120.1866666666667C85.056 123.3066666666667 85.6106666666667 123.3066666666667 79.3226666666667 120.192L74.6666666666667 117.8826666666667L70.0106666666667 120.192C63.7226666666667 123.3066666666667 64.2773333333333 123.3066666666667 57.9893333333333 120.192L53.3333333333333 117.8826666666667L48.6773333333333 120.192C42.3893333333333 123.3066666666667 42.944 123.3066666666667 36.656 120.192L32 117.8826666666667L27.36 120.1653333333333C22.6346666666667 122.4853333333333 21.552 122.832 20.16 122.4746666666667M47.4133333333333 109.0986666666667C53.5893333333333 106.0373333333333 53.0666666666667 106.032 59.344 109.1413333333333L64 111.4506666666667L68.656 109.1413333333333C74.944 106.0266666666667 74.3893333333333 106.0266666666667 80.6773333333333 109.1413333333333L85.3333333333333 111.4506666666667L89.9893333333333 109.1413333333333C94.4106666666667 106.9546666666667 94.7093333333333 106.8373333333333 95.9786666666667 106.8373333333333C97.1253333333333 106.8373333333333 97.5946666666667 106.976 99.3226666666667 107.808L101.3333333333333 108.784L101.3333333333333 64L101.3333333333333 19.216L99.3226666666667 20.192C97.5946666666667 21.024 97.1253333333333 21.1626666666667 95.9786666666667 21.1626666666667C94.7093333333333 21.1626666666667 94.4106666666667 21.0453333333333 89.9893333333333 18.8586666666667L85.3333333333333 16.5493333333334L80.6773333333333 18.8586666666667C74.3893333333333 21.9733333333333 74.944 21.9733333333333 68.656 18.8586666666667L64 16.5493333333334L59.344 18.8586666666667C53.056 21.9733333333333 53.6106666666667 21.9733333333333 47.3226666666667 18.8586666666667L42.6666666666667 16.5493333333334L38.0106666666667 18.8586666666667C33.5893333333333 21.0453333333333 33.2906666666667 21.1626666666667 32.0213333333333 21.1626666666667C30.8746666666667 21.1626666666667 30.4053333333333 21.024 28.6773333333333 20.192L26.6666666666667 19.216L26.6666666666667 64L26.6666666666667 108.784L28.6773333333333 107.808C30.4053333333333 106.9706666666667 30.8746666666667 106.8373333333333 32.0266666666667 106.8373333333333C33.296 106.8373333333333 33.584 106.9493333333333 37.856 109.0826666666667C40.3253333333333 110.32 42.464 111.3386666666667 42.6026666666667 111.344C42.7466666666667 111.3546666666667 44.912 110.3413333333333 47.4133333333333 109.0986666666667M41.6 90.4693333333333C39.1306666666667 89.9573333333333 37.4826666666667 87.9093333333333 37.4826666666667 85.3333333333333C37.4826666666667 83.2106666666667 38.4693333333333 81.6106666666667 40.4213333333333 80.5653333333333C41.28 80.1066666666667 41.2853333333333 80.1066666666667 58.6666666666667 80.1066666666667C76.048 80.1066666666667 76.0533333333333 80.1066666666667 76.912 80.5653333333333C78.864 81.6106666666667 79.8506666666667 83.2106666666667 79.8506666666667 85.3333333333333C79.8506666666667 87.456 78.864 89.056 76.912 90.1013333333333C76.0533333333333 90.56 76.0053333333333 90.56 59.2 90.592C49.9306666666667 90.608 42.0106666666667 90.5546666666667 41.6 90.4693333333333M41.6 69.136C39.1306666666667 68.6293333333333 37.4826666666667 66.576 37.4826666666667 64C37.4826666666667 61.8773333333333 38.4693333333333 60.2773333333333 40.4213333333333 59.232L41.28 58.7733333333333L64 58.7733333333333L86.72 58.7733333333333L87.5786666666667 59.232C89.5306666666667 60.2773333333333 90.5173333333333 61.8773333333333 90.5173333333333 64C90.5173333333333 66.1226666666667 89.5306666666667 67.7226666666667 87.5786666666667 68.768L86.72 69.2266666666667L64.5333333333333 69.2586666666667C52.3306666666667 69.2746666666667 42.0106666666667 69.2213333333333 41.6 69.136M41.6 47.8026666666667C39.1253333333333 47.2906666666667 37.4826666666667 45.2373333333333 37.4826666666667 42.6666666666667C37.4826666666667 40.544 38.4693333333333 38.944 40.4213333333333 37.8986666666667C41.2746666666667 37.44 41.344 37.44 56 37.44C70.656 37.44 70.7253333333333 37.44 71.5786666666667 37.8986666666667C73.5306666666667 38.944 74.5173333333333 40.544 74.5173333333333 42.6666666666667C74.5173333333333 44.7893333333333 73.5306666666667 46.3893333333333 71.5786666666667 47.4346666666667C70.7253333333333 47.888 70.608 47.8933333333333 56.5333333333333 47.9253333333333C48.7306666666667 47.9466666666667 42.0106666666667 47.888 41.6 47.8026666666667" />
-    <glyph glyph-name="eraser"
+      horiz-adv-x="128" d="M91.7813333333333 117.328C89.7173333333333 116.7893333333333 87.8826666666667 115.888 86.0746666666667 114.5333333333333C84.4373333333333 113.3066666666667 45.7866666666667 74.8586666666667 27.9306666666667 56.6933333333333L16.656 45.2213333333333L16.2133333333333 43.744C14.6026666666667 38.3306666666667 10.88 22.4693333333333 10.88 21.0186666666667C10.88 18.9546666666667 12.4373333333333 16.9546666666667 14.5226666666667 16.336C15.5573333333333 16.0266666666667 15.7813333333333 16.032 17.792 16.4373333333333C20.5866666666667 17.0026666666667 38.5173333333333 21.5093333333333 39.376 21.8666666666667C39.744 22.016 45.3546666666667 27.3653333333333 51.9626666666667 33.872C69.3226666666667 50.944 107.9146666666667 89.7066666666667 109.0506666666667 91.2C110.416 93.0026666666667 111.248 94.5706666666667 111.824 96.4266666666667C112.2613333333333 97.8346666666667 112.32 98.4533333333333 112.3146666666667 101.5466666666667C112.3093333333333 104.8106666666667 112.272 105.1786666666667 111.744 106.624C110.8533333333333 109.0826666666667 109.5626666666667 111.0666666666667 107.5413333333333 113.0773333333333C105.984 114.624 105.3653333333333 115.0666666666667 103.4666666666667 116.0053333333334C102.144 116.6613333333333 100.5866666666667 117.2426666666667 99.664 117.4346666666667C97.4666666666667 117.8933333333333 93.7333333333333 117.84 91.7813333333333 117.328M97.8346666666667 106.992C100.048 106.336 101.7226666666667 104.1386666666667 101.92 101.632C102.0853333333333 99.5786666666667 101.4506666666667 98.4373333333333 98.464 95.3973333333333L96.016 92.9066666666667L91.792 97.1253333333334L87.5733333333333 101.3493333333333L90.064 103.7973333333333C93.536 107.2106666666667 95.0293333333333 107.824 97.8346666666667 106.992M84.2666666666667 89.4933333333333L88.4266666666667 85.3333333333333L61.456 58.3626666666667L34.4853333333333 31.3866666666667L29.0933333333333 30.048C26.128 29.312 23.632 28.7786666666667 23.5413333333333 28.864C23.456 28.9546666666667 23.984 31.4453333333333 24.7093333333333 34.4053333333333L26.0373333333333 39.7866666666667L52.9653333333333 66.72C67.776 81.5306666666667 79.9413333333333 93.6533333333333 80 93.6533333333333C80.064 93.6533333333333 81.9786666666667 91.7813333333333 84.2666666666667 89.4933333333333M69.0133333333333 26.4693333333333C61.36 26.3306666666667 61.4826666666667 26.3573333333333 60.0746666666667 24.7146666666667C59.1893333333333 23.68 58.8853333333333 22.7626666666667 58.88 21.168C58.88 19.136 59.9306666666667 17.5306666666667 61.9146666666667 16.512L62.9173333333333 16L88 16L113.0826666666667 16L114.0853333333333 16.512C116.128 17.5573333333333 117.12 19.1306666666667 117.12 21.3333333333333C117.12 23.44 116.2986666666667 24.8533333333333 114.4533333333333 25.9146666666667L113.6 26.4106666666667L94.72 26.5013333333334C84.336 26.5546666666667 72.768 26.5386666666667 69.0133333333333 26.4693333333333" />
+    <glyph glyph-name="pencil-line-1"
+      unicode="&#x70;&#x65;&#x6E;&#x63;&#x69;&#x6C;&#x2D;&#x6C;&#x69;&#x6E;&#x65;"
+      horiz-adv-x="128" d="M91.7813333333333 117.328C89.7173333333333 116.7893333333333 87.8826666666667 115.888 86.0746666666667 114.5333333333333C84.4373333333333 113.3066666666667 45.7866666666667 74.8586666666667 27.9306666666667 56.6933333333333L16.656 45.2213333333333L16.2133333333333 43.744C14.6026666666667 38.3306666666667 10.88 22.4693333333333 10.88 21.0186666666667C10.88 18.9546666666667 12.4373333333333 16.9546666666667 14.5226666666667 16.336C15.5573333333333 16.0266666666667 15.7813333333333 16.032 17.792 16.4373333333333C20.5866666666667 17.0026666666667 38.5173333333333 21.5093333333333 39.376 21.8666666666667C39.744 22.016 45.3546666666667 27.3653333333333 51.9626666666667 33.872C69.3226666666667 50.944 107.9146666666667 89.7066666666667 109.0506666666667 91.2C110.416 93.0026666666667 111.248 94.5706666666667 111.824 96.4266666666667C112.2613333333333 97.8346666666667 112.32 98.4533333333333 112.3146666666667 101.5466666666667C112.3093333333333 104.8106666666667 112.272 105.1786666666667 111.744 106.624C110.8533333333333 109.0826666666667 109.5626666666667 111.0666666666667 107.5413333333333 113.0773333333333C105.984 114.624 105.3653333333333 115.0666666666667 103.4666666666667 116.0053333333334C102.144 116.6613333333333 100.5866666666667 117.2426666666667 99.664 117.4346666666667C97.4666666666667 117.8933333333333 93.7333333333333 117.84 91.7813333333333 117.328M97.8346666666667 106.992C100.048 106.336 101.7226666666667 104.1386666666667 101.92 101.632C102.0853333333333 99.5786666666667 101.4506666666667 98.4373333333333 98.464 95.3973333333333L96.016 92.9066666666667L91.792 97.1253333333334L87.5733333333333 101.3493333333333L90.064 103.7973333333333C93.536 107.2106666666667 95.0293333333333 107.824 97.8346666666667 106.992M84.2666666666667 89.4933333333333L88.4266666666667 85.3333333333333L61.456 58.3626666666667L34.4853333333333 31.3866666666667L29.0933333333333 30.048C26.128 29.312 23.632 28.7786666666667 23.5413333333333 28.864C23.456 28.9546666666667 23.984 31.4453333333333 24.7093333333333 34.4053333333333L26.0373333333333 39.7866666666667L52.9653333333333 66.72C67.776 81.5306666666667 79.9413333333333 93.6533333333333 80 93.6533333333333C80.064 93.6533333333333 81.9786666666667 91.7813333333333 84.2666666666667 89.4933333333333M69.0133333333333 26.4693333333333C61.36 26.3306666666667 61.4826666666667 26.3573333333333 60.0746666666667 24.7146666666667C59.1893333333333 23.68 58.8853333333333 22.7626666666667 58.88 21.168C58.88 19.136 59.9306666666667 17.5306666666667 61.9146666666667 16.512L62.9173333333333 16L88 16L113.0826666666667 16L114.0853333333333 16.512C116.128 17.5573333333333 117.12 19.1306666666667 117.12 21.3333333333333C117.12 23.44 116.2986666666667 24.8533333333333 114.4533333333333 25.9146666666667L113.6 26.4106666666667L94.72 26.5013333333334C84.336 26.5546666666667 72.768 26.5386666666667 69.0133333333333 26.4693333333333" />
+    <glyph glyph-name="play"
       unicode="&#xF142;"
-      horiz-adv-x="128" d="M72.1066666666667 117.3226666666667C68.6186666666667 116.8053333333333 65.4453333333333 115.2053333333333 62.2826666666667 112.3626666666667C61.1733333333333 111.3653333333333 48.688 98.9493333333333 34.5386666666667 84.768C6.384 56.56 7.4933333333333 57.7653333333333 6.1386666666667 53.84C4.4746666666667 49.0026666666667 4.9973333333333 43.5893333333333 7.5466666666667 39.2426666666667C8.912 36.9226666666667 10.8213333333333 34.8853333333333 23.1786666666667 22.5866666666667C32.8533333333333 12.96 34.3733333333333 11.5253333333334 35.3066666666667 11.1733333333333C36.336 10.784 37.7333333333333 10.7733333333333 77.5466666666667 10.7733333333333L118.72 10.7733333333333L119.5786666666667 11.232C121.4826666666667 12.2506666666667 122.496 13.9093333333333 122.496 16C122.496 18.0906666666667 121.4826666666667 19.7493333333333 119.5786666666667 20.768C118.72 21.2266666666667 118.6773333333333 21.2266666666667 100.4906666666667 21.2853333333333L82.2666666666667 21.3493333333333L100.7253333333333 39.8453333333333C120.912 60.0746666666667 120.5333333333333 59.6533333333333 121.8613333333333 63.4933333333333C122.736 66.032 123.024 68.5653333333333 122.7253333333333 71.0773333333333C122.2346666666667 75.2213333333333 120.7893333333333 78.272 117.696 81.7173333333333C116.6986666666667 82.8266666666667 109.0826666666667 90.512 100.768 98.7946666666667C84.288 115.2106666666667 84.2666666666667 115.232 80.576 116.5013333333333C77.6746666666667 117.4933333333334 75.0186666666667 117.7493333333334 72.1066666666667 117.3226666666667M77.4506666666667 106.416C78.2346666666667 106.0906666666667 81.5733333333333 102.8533333333333 94.8693333333333 89.536C110.704 73.6746666666667 111.328 73.0186666666667 111.7813333333333 71.7866666666667C112.4053333333333 70.0853333333333 112.4106666666667 68.0586666666667 111.7973333333333 66.6346666666667C111.4186666666667 65.7546666666667 108.384 62.624 93.008 47.248L74.6666666666667 28.9066666666667L54.4533333333333 49.12L34.24 69.3333333333333L52.3733333333333 87.472C71.632 106.7413333333333 71.3546666666667 106.4853333333333 73.7386666666667 106.8533333333333C75.0826666666667 107.0613333333333 76.2453333333333 106.928 77.4506666666667 106.416M46.9333333333333 41.4933333333333L67.0933333333333 21.3333333333333L53.328 21.3333333333333L39.5626666666667 21.3333333333333L28.128 32.8C17.216 43.744 16.672 44.3253333333333 16.2186666666667 45.5466666666667C15.5946666666667 47.2533333333333 15.5893333333333 49.296 16.2026666666667 50.6986666666667C16.5493333333333 51.4933333333333 17.8026666666667 52.8853333333333 21.6053333333333 56.6933333333333C24.3306666666667 59.424 26.608 61.6533333333333 26.6666666666667 61.6533333333333C26.7253333333333 61.6533333333333 35.8453333333333 52.5813333333333 46.9333333333333 41.4933333333333" />
-    <glyph glyph-name="eraser-1"
-      unicode="&#x65;&#x72;&#x61;&#x73;&#x65;&#x72;"
-      horiz-adv-x="128" d="M72.1066666666667 117.3226666666667C68.6186666666667 116.8053333333333 65.4453333333333 115.2053333333333 62.2826666666667 112.3626666666667C61.1733333333333 111.3653333333333 48.688 98.9493333333333 34.5386666666667 84.768C6.384 56.56 7.4933333333333 57.7653333333333 6.1386666666667 53.84C4.4746666666667 49.0026666666667 4.9973333333333 43.5893333333333 7.5466666666667 39.2426666666667C8.912 36.9226666666667 10.8213333333333 34.8853333333333 23.1786666666667 22.5866666666667C32.8533333333333 12.96 34.3733333333333 11.5253333333334 35.3066666666667 11.1733333333333C36.336 10.784 37.7333333333333 10.7733333333333 77.5466666666667 10.7733333333333L118.72 10.7733333333333L119.5786666666667 11.232C121.4826666666667 12.2506666666667 122.496 13.9093333333333 122.496 16C122.496 18.0906666666667 121.4826666666667 19.7493333333333 119.5786666666667 20.768C118.72 21.2266666666667 118.6773333333333 21.2266666666667 100.4906666666667 21.2853333333333L82.2666666666667 21.3493333333333L100.7253333333333 39.8453333333333C120.912 60.0746666666667 120.5333333333333 59.6533333333333 121.8613333333333 63.4933333333333C122.736 66.032 123.024 68.5653333333333 122.7253333333333 71.0773333333333C122.2346666666667 75.2213333333333 120.7893333333333 78.272 117.696 81.7173333333333C116.6986666666667 82.8266666666667 109.0826666666667 90.512 100.768 98.7946666666667C84.288 115.2106666666667 84.2666666666667 115.232 80.576 116.5013333333333C77.6746666666667 117.4933333333334 75.0186666666667 117.7493333333334 72.1066666666667 117.3226666666667M77.4506666666667 106.416C78.2346666666667 106.0906666666667 81.5733333333333 102.8533333333333 94.8693333333333 89.536C110.704 73.6746666666667 111.328 73.0186666666667 111.7813333333333 71.7866666666667C112.4053333333333 70.0853333333333 112.4106666666667 68.0586666666667 111.7973333333333 66.6346666666667C111.4186666666667 65.7546666666667 108.384 62.624 93.008 47.248L74.6666666666667 28.9066666666667L54.4533333333333 49.12L34.24 69.3333333333333L52.3733333333333 87.472C71.632 106.7413333333333 71.3546666666667 106.4853333333333 73.7386666666667 106.8533333333333C75.0826666666667 107.0613333333333 76.2453333333333 106.928 77.4506666666667 106.416M46.9333333333333 41.4933333333333L67.0933333333333 21.3333333333333L53.328 21.3333333333333L39.5626666666667 21.3333333333333L28.128 32.8C17.216 43.744 16.672 44.3253333333333 16.2186666666667 45.5466666666667C15.5946666666667 47.2533333333333 15.5893333333333 49.296 16.2026666666667 50.6986666666667C16.5493333333333 51.4933333333333 17.8026666666667 52.8853333333333 21.6053333333333 56.6933333333333C24.3306666666667 59.424 26.608 61.6533333333333 26.6666666666667 61.6533333333333C26.7253333333333 61.6533333333333 35.8453333333333 52.5813333333333 46.9333333333333 41.4933333333333" />
-    <glyph glyph-name="check"
+      horiz-adv-x="128" d="M29.9573333333333 116.816C28.9226666666667 116.368 27.7493333333333 115.2213333333333 27.184 114.1066666666667L26.6666666666667 113.0826666666667L26.6666666666667 64L26.6666666666667 14.9173333333333L27.1893333333333 13.8826666666667C27.792 12.6933333333333 29.168 11.4293333333333 30.2346666666667 11.0773333333333C30.64 10.944 31.6213333333333 10.8693333333333 32.416 10.9173333333333C34.08 11.008 32.4053333333333 10.0373333333334 47.5733333333333 19.7386666666667C73.5786666666667 36.384 109.7706666666667 59.7973333333333 110.48 60.4426666666667C111.3173333333333 61.2053333333333 111.776 62.464 111.776 64C111.776 65.536 111.3173333333333 66.8 110.48 67.5466666666667C109.936 68.0373333333333 107.088 69.8933333333334 88.5333333333333 81.8826666666667C55.0453333333333 103.5146666666667 34.5653333333333 116.624 33.7866666666667 116.9173333333333C33.0133333333333 117.2106666666667 30.72 117.152 29.9573333333333 116.816M40.1706666666667 100.4533333333333C59.7493333333333 87.9893333333333 96.2773333333333 64.336 96.3733333333333 64.0586666666667C96.4106666666667 63.9466666666667 95.744 63.3973333333333 94.896 62.832C89.1093333333333 58.9866666666667 38.3626666666667 26.2933333333333 37.8986666666667 26.1173333333333C37.4293333333333 25.936 37.3333333333333 32.3626666666667 37.3333333333333 64C37.3333333333333 90.1493333333333 37.4453333333333 101.9733333333333 37.696 101.9733333333333C37.7386666666667 101.9733333333333 38.8533333333333 101.2906666666667 40.1706666666667 100.4533333333333" />
+    <glyph glyph-name="play-1"
+      unicode="&#x70;&#x6C;&#x61;&#x79;"
+      horiz-adv-x="128" d="M29.9573333333333 116.816C28.9226666666667 116.368 27.7493333333333 115.2213333333333 27.184 114.1066666666667L26.6666666666667 113.0826666666667L26.6666666666667 64L26.6666666666667 14.9173333333333L27.1893333333333 13.8826666666667C27.792 12.6933333333333 29.168 11.4293333333333 30.2346666666667 11.0773333333333C30.64 10.944 31.6213333333333 10.8693333333333 32.416 10.9173333333333C34.08 11.008 32.4053333333333 10.0373333333334 47.5733333333333 19.7386666666667C73.5786666666667 36.384 109.7706666666667 59.7973333333333 110.48 60.4426666666667C111.3173333333333 61.2053333333333 111.776 62.464 111.776 64C111.776 65.536 111.3173333333333 66.8 110.48 67.5466666666667C109.936 68.0373333333333 107.088 69.8933333333334 88.5333333333333 81.8826666666667C55.0453333333333 103.5146666666667 34.5653333333333 116.624 33.7866666666667 116.9173333333333C33.0133333333333 117.2106666666667 30.72 117.152 29.9573333333333 116.816M40.1706666666667 100.4533333333333C59.7493333333333 87.9893333333333 96.2773333333333 64.336 96.3733333333333 64.0586666666667C96.4106666666667 63.9466666666667 95.744 63.3973333333333 94.896 62.832C89.1093333333333 58.9866666666667 38.3626666666667 26.2933333333333 37.8986666666667 26.1173333333333C37.4293333333333 25.936 37.3333333333333 32.3626666666667 37.3333333333333 64C37.3333333333333 90.1493333333333 37.4453333333333 101.9733333333333 37.696 101.9733333333333C37.7386666666667 101.9733333333333 38.8533333333333 101.2906666666667 40.1706666666667 100.4533333333333" />
+    <glyph glyph-name="lock-open"
       unicode="&#xF143;"
-      horiz-adv-x="128" d="M104.5653333333333 100.7946666666667C103.7066666666667 100.4213333333333 98.9706666666667 95.7706666666667 70.1333333333333 66.9973333333333L48 44.9066666666667L38.3466666666667 54.5226666666667C23.376 69.424 23.728 69.12 21.5253333333333 69.12C19.2533333333333 69.12 17.5306666666667 68.0906666666667 16.6453333333333 66.2026666666667C16.08 65.008 16.016 63.184 16.4906666666667 62.0426666666667C17.2213333333333 60.2933333333333 44.2506666666667 33.2373333333333 46 32.5066666666667C46.9013333333333 32.1333333333333 49.088 32.128 49.984 32.5013333333334C51.728 33.232 110.768 92.2613333333333 111.4933333333333 94.0053333333333C111.888 94.944 111.8666666666667 97.104 111.456 98.0853333333333C110.688 99.9253333333333 108.768 101.1253333333334 106.6186666666667 101.1093333333333C105.8826666666667 101.1093333333333 104.96 100.9653333333333 104.5653333333333 100.7946666666667" />
-    <glyph glyph-name="check-1"
-      unicode="&#x63;&#x68;&#x65;&#x63;&#x6B;"
-      horiz-adv-x="128" d="M104.5653333333333 100.7946666666667C103.7066666666667 100.4213333333333 98.9706666666667 95.7706666666667 70.1333333333333 66.9973333333333L48 44.9066666666667L38.3466666666667 54.5226666666667C23.376 69.424 23.728 69.12 21.5253333333333 69.12C19.2533333333333 69.12 17.5306666666667 68.0906666666667 16.6453333333333 66.2026666666667C16.08 65.008 16.016 63.184 16.4906666666667 62.0426666666667C17.2213333333333 60.2933333333333 44.2506666666667 33.2373333333333 46 32.5066666666667C46.9013333333333 32.1333333333333 49.088 32.128 49.984 32.5013333333334C51.728 33.232 110.768 92.2613333333333 111.4933333333333 94.0053333333333C111.888 94.944 111.8666666666667 97.104 111.456 98.0853333333333C110.688 99.9253333333333 108.768 101.1253333333334 106.6186666666667 101.1093333333333C105.8826666666667 101.1093333333333 104.96 100.9653333333333 104.5653333333333 100.7946666666667" />
+      horiz-adv-x="128" d="M59.52 122.3253333333333C59.2266666666667 122.272 58.0746666666667 122.032 56.96 121.7813333333333C46.32 119.424 37.216 111.1946666666667 33.744 100.784C32.304 96.4693333333333 32 93.2426666666667 32 82.3253333333333L32 74.7306666666667L28.3466666666667 74.5813333333333C26.336 74.5013333333333 23.968 74.2986666666667 23.088 74.128C19.968 73.5306666666667 16.816 71.568 14.4053333333333 68.72C12.9653333333333 67.0133333333333 12.144 65.4773333333333 11.3173333333333 62.9333333333333L10.6666666666667 60.9226666666667L10.6666666666667 40L10.6666666666667 19.0773333333333L11.3173333333333 17.0666666666667C12.1386666666667 14.5386666666667 12.9653333333333 12.9813333333333 14.3626666666667 11.3333333333333C16.6933333333333 8.592 18.9066666666667 7.1146666666667 22.4 5.984L24.4106666666667 5.3333333333333L64 5.3333333333333L103.5893333333333 5.3333333333333L105.6 5.984C109.072 7.1093333333333 111.2426666666667 8.5706666666667 113.648 11.3866666666667C115.0666666666667 13.0453333333333 115.8613333333333 14.5386666666667 116.6826666666667 17.0666666666667L117.3333333333333 19.0773333333333L117.3333333333333 40L117.3333333333333 60.9226666666667L116.6826666666667 62.9333333333333C115.5413333333334 66.4533333333334 114.1493333333333 68.528 111.28 70.9813333333333C109.7653333333333 72.2773333333333 108.2666666666667 73.1093333333333 106.0426666666667 73.904L104.4533333333333 74.4746666666667L73.5253333333333 74.6026666666667L42.5973333333333 74.736L42.7253333333333 84.8213333333333L42.8586666666667 94.9066666666667L43.52 96.896C45.12 101.6586666666667 48.2453333333333 105.808 52.32 108.5653333333333C53.7866666666667 109.5573333333333 56.144 110.6186666666667 58.3466666666667 111.28C60.1226666666667 111.8186666666667 60.5493333333333 111.8613333333333 64 111.856C67.1466666666667 111.856 68 111.7813333333333 69.44 111.3973333333333C73.344 110.3466666666667 77.6533333333333 107.5573333333333 80.3466666666667 104.3413333333333C82.2666666666667 102.048 83.3866666666667 99.936 84.5333333333333 96.448C85.0933333333333 94.7573333333333 85.776 93.072 86.0533333333333 92.7093333333333C86.6506666666667 91.9253333333333 88.304 90.992 89.4506666666667 90.7893333333333C91.0986666666667 90.496 93.376 91.552 94.4213333333333 93.0933333333333C95.6373333333333 94.88 95.6 96.752 94.2773333333333 100.72C92.6933333333333 105.456 89.664 110.2453333333333 86.0426666666667 113.744C83.3813333333333 116.3146666666667 78.688 119.2426666666667 74.9866666666667 120.6346666666667C71.472 121.9626666666667 69.5946666666667 122.272 64.64 122.352C62.1173333333333 122.3893333333333 59.8133333333333 122.3786666666667 59.52 122.3253333333333M103.1946666666667 63.6746666666667C104.4053333333333 63.168 105.3226666666667 62.3733333333333 105.968 61.2746666666667L106.56 60.2666666666667L106.6293333333333 42.4533333333334C106.672 32.656 106.6346666666667 23.4613333333333 106.5546666666667 22.016C106.416 19.5466666666667 106.368 19.3386666666667 105.7386666666667 18.3946666666667C105.3226666666667 17.776 104.6186666666667 17.1253333333333 103.904 16.6933333333333L102.7413333333333 16L64 16L25.2586666666667 16L24.096 16.6933333333333C23.3813333333333 17.1253333333333 22.6773333333333 17.776 22.2613333333333 18.3946666666667C21.632 19.3386666666667 21.584 19.5466666666667 21.4453333333333 22.016C21.3653333333333 23.4613333333333 21.328 32.656 21.3706666666667 42.4533333333334L21.44 60.2666666666667L22.032 61.2746666666667C22.6666666666667 62.352 23.5786666666667 63.152 24.7573333333333 63.664C25.4026666666667 63.9413333333334 30.2613333333333 63.984 63.952 63.9893333333333C98.016 64 102.5013333333333 63.9626666666667 103.1946666666667 63.6746666666667" />
+    <glyph glyph-name="lock-open-1"
+      unicode="&#x6C;&#x6F;&#x63;&#x6B;&#x2D;&#x6F;&#x70;&#x65;&#x6E;"
+      horiz-adv-x="128" d="M59.52 122.3253333333333C59.2266666666667 122.272 58.0746666666667 122.032 56.96 121.7813333333333C46.32 119.424 37.216 111.1946666666667 33.744 100.784C32.304 96.4693333333333 32 93.2426666666667 32 82.3253333333333L32 74.7306666666667L28.3466666666667 74.5813333333333C26.336 74.5013333333333 23.968 74.2986666666667 23.088 74.128C19.968 73.5306666666667 16.816 71.568 14.4053333333333 68.72C12.9653333333333 67.0133333333333 12.144 65.4773333333333 11.3173333333333 62.9333333333333L10.6666666666667 60.9226666666667L10.6666666666667 40L10.6666666666667 19.0773333333333L11.3173333333333 17.0666666666667C12.1386666666667 14.5386666666667 12.9653333333333 12.9813333333333 14.3626666666667 11.3333333333333C16.6933333333333 8.592 18.9066666666667 7.1146666666667 22.4 5.984L24.4106666666667 5.3333333333333L64 5.3333333333333L103.5893333333333 5.3333333333333L105.6 5.984C109.072 7.1093333333333 111.2426666666667 8.5706666666667 113.648 11.3866666666667C115.0666666666667 13.0453333333333 115.8613333333333 14.5386666666667 116.6826666666667 17.0666666666667L117.3333333333333 19.0773333333333L117.3333333333333 40L117.3333333333333 60.9226666666667L116.6826666666667 62.9333333333333C115.5413333333334 66.4533333333334 114.1493333333333 68.528 111.28 70.9813333333333C109.7653333333333 72.2773333333333 108.2666666666667 73.1093333333333 106.0426666666667 73.904L104.4533333333333 74.4746666666667L73.5253333333333 74.6026666666667L42.5973333333333 74.736L42.7253333333333 84.8213333333333L42.8586666666667 94.9066666666667L43.52 96.896C45.12 101.6586666666667 48.2453333333333 105.808 52.32 108.5653333333333C53.7866666666667 109.5573333333333 56.144 110.6186666666667 58.3466666666667 111.28C60.1226666666667 111.8186666666667 60.5493333333333 111.8613333333333 64 111.856C67.1466666666667 111.856 68 111.7813333333333 69.44 111.3973333333333C73.344 110.3466666666667 77.6533333333333 107.5573333333333 80.3466666666667 104.3413333333333C82.2666666666667 102.048 83.3866666666667 99.936 84.5333333333333 96.448C85.0933333333333 94.7573333333333 85.776 93.072 86.0533333333333 92.7093333333333C86.6506666666667 91.9253333333333 88.304 90.992 89.4506666666667 90.7893333333333C91.0986666666667 90.496 93.376 91.552 94.4213333333333 93.0933333333333C95.6373333333333 94.88 95.6 96.752 94.2773333333333 100.72C92.6933333333333 105.456 89.664 110.2453333333333 86.0426666666667 113.744C83.3813333333333 116.3146666666667 78.688 119.2426666666667 74.9866666666667 120.6346666666667C71.472 121.9626666666667 69.5946666666667 122.272 64.64 122.352C62.1173333333333 122.3893333333333 59.8133333333333 122.3786666666667 59.52 122.3253333333333M103.1946666666667 63.6746666666667C104.4053333333333 63.168 105.3226666666667 62.3733333333333 105.968 61.2746666666667L106.56 60.2666666666667L106.6293333333333 42.4533333333334C106.672 32.656 106.6346666666667 23.4613333333333 106.5546666666667 22.016C106.416 19.5466666666667 106.368 19.3386666666667 105.7386666666667 18.3946666666667C105.3226666666667 17.776 104.6186666666667 17.1253333333333 103.904 16.6933333333333L102.7413333333333 16L64 16L25.2586666666667 16L24.096 16.6933333333333C23.3813333333333 17.1253333333333 22.6773333333333 17.776 22.2613333333333 18.3946666666667C21.632 19.3386666666667 21.584 19.5466666666667 21.4453333333333 22.016C21.3653333333333 23.4613333333333 21.328 32.656 21.3706666666667 42.4533333333334L21.44 60.2666666666667L22.032 61.2746666666667C22.6666666666667 62.352 23.5786666666667 63.152 24.7573333333333 63.664C25.4026666666667 63.9413333333334 30.2613333333333 63.984 63.952 63.9893333333333C98.016 64 102.5013333333333 63.9626666666667 103.1946666666667 63.6746666666667" />
+    <glyph glyph-name="square"
+      unicode="&#xF144;"
+      horiz-adv-x="128" d="M22.848 116.7893333333333C19.0346666666667 115.9626666666667 14.5706666666667 112.4853333333333 12.6133333333333 108.8213333333333C12.2613333333333 108.1546666666667 11.6746666666667 106.704 11.3173333333333 105.6L10.6666666666667 103.5893333333333L10.6666666666667 64L10.6666666666667 24.4106666666667L11.3173333333333 22.4C12.448 18.9066666666667 13.9253333333333 16.6933333333333 16.6666666666667 14.3626666666667C18.3146666666667 12.9653333333333 19.872 12.1386666666667 22.4 11.3173333333333L24.4106666666667 10.6666666666667L64 10.6666666666667L103.5893333333333 10.6666666666667L105.6 11.3173333333333C108.128 12.1386666666667 109.6213333333333 12.9333333333333 111.28 14.352C114.096 16.7573333333333 115.5573333333333 18.928 116.6826666666667 22.4L117.3333333333333 24.4106666666667L117.3333333333333 64L117.3333333333333 103.5893333333333L116.6826666666667 105.6C115.5413333333334 109.12 114.1493333333333 111.1946666666667 111.28 113.648C109.7706666666667 114.9386666666667 108.2666666666667 115.776 106.0693333333333 116.5653333333333L104.5066666666667 117.12L64.3626666666667 117.104C30.9653333333333 117.088 23.984 117.0346666666667 22.848 116.7893333333333M103.36 106.2666666666667C104.6186666666667 105.696 105.504 104.864 106.064 103.728L106.56 102.72L106.6186666666667 66.7733333333333C106.656 47.0026666666667 106.6026666666667 29.4133333333333 106.5013333333333 27.68C106.3306666666667 24.672 106.2933333333333 24.496 105.6853333333333 23.6266666666667C105.3386666666667 23.1306666666667 104.528 22.4053333333333 103.8933333333333 22.0266666666667L102.7413333333333 21.3333333333333L65.0773333333333 21.3386666666667C44.3573333333333 21.344 26.752 21.4346666666667 25.9413333333333 21.536C24.1386666666667 21.7706666666667 23.0133333333333 22.4853333333333 22.0853333333333 23.9893333333334L21.44 25.0346666666667L21.44 63.8773333333333L21.44 102.72L21.936 103.728C22.496 104.864 23.3813333333333 105.696 24.64 106.2666666666667C25.456 106.64 27.1893333333333 106.656 64 106.656C100.8106666666667 106.656 102.544 106.64 103.36 106.2666666666667" />
+    <glyph glyph-name="square-1"
+      unicode="&#x73;&#x71;&#x75;&#x61;&#x72;&#x65;"
+      horiz-adv-x="128" d="M22.848 116.7893333333333C19.0346666666667 115.9626666666667 14.5706666666667 112.4853333333333 12.6133333333333 108.8213333333333C12.2613333333333 108.1546666666667 11.6746666666667 106.704 11.3173333333333 105.6L10.6666666666667 103.5893333333333L10.6666666666667 64L10.6666666666667 24.4106666666667L11.3173333333333 22.4C12.448 18.9066666666667 13.9253333333333 16.6933333333333 16.6666666666667 14.3626666666667C18.3146666666667 12.9653333333333 19.872 12.1386666666667 22.4 11.3173333333333L24.4106666666667 10.6666666666667L64 10.6666666666667L103.5893333333333 10.6666666666667L105.6 11.3173333333333C108.128 12.1386666666667 109.6213333333333 12.9333333333333 111.28 14.352C114.096 16.7573333333333 115.5573333333333 18.928 116.6826666666667 22.4L117.3333333333333 24.4106666666667L117.3333333333333 64L117.3333333333333 103.5893333333333L116.6826666666667 105.6C115.5413333333334 109.12 114.1493333333333 111.1946666666667 111.28 113.648C109.7706666666667 114.9386666666667 108.2666666666667 115.776 106.0693333333333 116.5653333333333L104.5066666666667 117.12L64.3626666666667 117.104C30.9653333333333 117.088 23.984 117.0346666666667 22.848 116.7893333333333M103.36 106.2666666666667C104.6186666666667 105.696 105.504 104.864 106.064 103.728L106.56 102.72L106.6186666666667 66.7733333333333C106.656 47.0026666666667 106.6026666666667 29.4133333333333 106.5013333333333 27.68C106.3306666666667 24.672 106.2933333333333 24.496 105.6853333333333 23.6266666666667C105.3386666666667 23.1306666666667 104.528 22.4053333333333 103.8933333333333 22.0266666666667L102.7413333333333 21.3333333333333L65.0773333333333 21.3386666666667C44.3573333333333 21.344 26.752 21.4346666666667 25.9413333333333 21.536C24.1386666666667 21.7706666666667 23.0133333333333 22.4853333333333 22.0853333333333 23.9893333333334L21.44 25.0346666666667L21.44 63.8773333333333L21.44 102.72L21.936 103.728C22.496 104.864 23.3813333333333 105.696 24.64 106.2666666666667C25.456 106.64 27.1893333333333 106.656 64 106.656C100.8106666666667 106.656 102.544 106.64 103.36 106.2666666666667" />
+    <glyph glyph-name="circle-x"
+      unicode="&#xF145;"
+      horiz-adv-x="128" d="M61.44 122.5173333333334C45.3653333333333 121.5733333333334 31.232 114.9386666666667 20.656 103.3706666666667C16.944 99.312 14.0853333333333 95.0933333333333 11.536 89.92C6.9813333333333 80.672 4.992 70.9706666666667 5.5626666666667 60.7786666666667C5.7973333333333 56.544 6.256 53.504 7.2533333333333 49.5893333333333C9.3173333333333 41.472 13.3973333333333 33.3386666666667 18.6453333333333 26.88C20.8213333333333 24.208 25.712 19.5093333333333 28.4853333333333 17.4293333333333C37.1786666666667 10.9226666666667 46.8 7.072 57.7066666666667 5.744C60.4106666666667 5.4133333333333 67.2586666666667 5.4186666666667 70.1866666666667 5.7493333333333C80.9333333333333 6.96 91.5146666666667 11.2373333333333 99.9626666666667 17.7866666666667C103.0933333333333 20.208 107.792 24.9066666666667 110.2133333333333 28.0373333333334C115.424 34.7573333333333 119.376 43.1146666666667 121.168 51.2C121.968 54.8106666666667 122.272 57.536 122.3893333333333 62.2186666666667C122.6133333333333 71.072 121.5146666666667 77.728 118.6133333333333 85.104C115.5413333333334 92.896 111.3226666666667 99.3813333333334 105.536 105.1946666666667C100.6133333333333 110.144 96.5493333333333 113.0773333333333 90.24 116.24C82.4693333333333 120.128 76.2293333333333 121.808 67.2 122.4426666666667C65.4986666666667 122.5653333333333 63.7706666666667 122.6453333333333 63.36 122.624C62.9493333333333 122.6026666666667 62.0853333333333 122.5546666666667 61.44 122.5173333333334M68.5493333333333 111.7866666666667C79.328 110.8906666666667 90.1173333333333 105.776 98.0266666666667 97.8133333333333C116.7093333333333 79.0026666666667 116.6026666666667 48.656 97.7866666666667 29.9626666666667C89.8346666666667 22.0586666666667 79.8453333333333 17.3653333333333 68.496 16.192C65.488 15.8826666666667 59.3386666666667 16.0533333333333 56.5333333333333 16.528C48.2346666666667 17.936 40.2453333333333 21.504 33.8293333333333 26.6773333333333C24.64 34.0906666666667 18.24 45.248 16.5386666666667 56.8426666666667C15.1146666666667 66.5173333333333 16.672 76.544 20.928 85.0986666666667C25.7813333333333 94.864 33.1893333333333 102.2826666666667 42.7733333333333 106.992C51.0933333333333 111.072 59.12 112.5653333333333 68.5493333333333 111.7866666666667M45.9413333333333 84.8266666666667C44.8533333333333 84.3306666666667 43.568 83.0293333333333 43.1893333333333 82.0266666666667C42.624 80.5493333333333 42.8266666666667 78.384 43.632 77.2106666666667C43.9786666666667 76.704 46.9973333333333 73.5146666666667 50.3306666666667 70.1333333333333L56.4 63.9733333333333L51.28 58.816C42.992 50.464 42.832 50.256 42.8426666666667 48.0106666666667C42.8533333333333 45.0613333333333 45.0613333333333 42.8373333333333 47.984 42.8373333333333C50.2666666666667 42.8373333333333 50.448 42.9813333333333 58.8266666666667 51.2906666666667L64 56.4213333333333L69.1733333333333 51.2906666666667C77.552 42.9813333333333 77.7333333333333 42.8373333333333 80.016 42.8373333333333C82.9493333333333 42.8373333333333 85.136 45.0453333333333 85.1466666666667 48.0213333333333C85.1573333333333 50.272 85.0133333333333 50.4533333333334 76.7093333333333 58.8266666666667L71.5786666666667 64L76.7093333333333 69.1733333333334C85.0346666666667 77.5626666666667 85.1573333333333 77.728 85.1466666666667 80.0106666666667C85.136 82.288 83.6533333333333 84.3306666666667 81.5946666666667 84.9066666666667C80.096 85.328 78.2826666666667 85.104 77.2 84.3626666666667C76.6986666666667 84.016 73.5253333333333 81.008 70.144 77.68L64 71.6266666666667L57.856 77.68C54.4746666666667 81.008 51.3013333333333 84.016 50.8053333333333 84.3573333333333C50.0373333333333 84.8853333333333 49.6533333333333 84.992 48.256 85.056C47.1413333333333 85.104 46.3946666666667 85.0293333333333 45.9413333333333 84.8266666666667" />
+    <glyph glyph-name="circle-x-1"
+      unicode="&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x78;"
+      horiz-adv-x="128" d="M61.44 122.5173333333334C45.3653333333333 121.5733333333334 31.232 114.9386666666667 20.656 103.3706666666667C16.944 99.312 14.0853333333333 95.0933333333333 11.536 89.92C6.9813333333333 80.672 4.992 70.9706666666667 5.5626666666667 60.7786666666667C5.7973333333333 56.544 6.256 53.504 7.2533333333333 49.5893333333333C9.3173333333333 41.472 13.3973333333333 33.3386666666667 18.6453333333333 26.88C20.8213333333333 24.208 25.712 19.5093333333333 28.4853333333333 17.4293333333333C37.1786666666667 10.9226666666667 46.8 7.072 57.7066666666667 5.744C60.4106666666667 5.4133333333333 67.2586666666667 5.4186666666667 70.1866666666667 5.7493333333333C80.9333333333333 6.96 91.5146666666667 11.2373333333333 99.9626666666667 17.7866666666667C103.0933333333333 20.208 107.792 24.9066666666667 110.2133333333333 28.0373333333334C115.424 34.7573333333333 119.376 43.1146666666667 121.168 51.2C121.968 54.8106666666667 122.272 57.536 122.3893333333333 62.2186666666667C122.6133333333333 71.072 121.5146666666667 77.728 118.6133333333333 85.104C115.5413333333334 92.896 111.3226666666667 99.3813333333334 105.536 105.1946666666667C100.6133333333333 110.144 96.5493333333333 113.0773333333333 90.24 116.24C82.4693333333333 120.128 76.2293333333333 121.808 67.2 122.4426666666667C65.4986666666667 122.5653333333333 63.7706666666667 122.6453333333333 63.36 122.624C62.9493333333333 122.6026666666667 62.0853333333333 122.5546666666667 61.44 122.5173333333334M68.5493333333333 111.7866666666667C79.328 110.8906666666667 90.1173333333333 105.776 98.0266666666667 97.8133333333333C116.7093333333333 79.0026666666667 116.6026666666667 48.656 97.7866666666667 29.9626666666667C89.8346666666667 22.0586666666667 79.8453333333333 17.3653333333333 68.496 16.192C65.488 15.8826666666667 59.3386666666667 16.0533333333333 56.5333333333333 16.528C48.2346666666667 17.936 40.2453333333333 21.504 33.8293333333333 26.6773333333333C24.64 34.0906666666667 18.24 45.248 16.5386666666667 56.8426666666667C15.1146666666667 66.5173333333333 16.672 76.544 20.928 85.0986666666667C25.7813333333333 94.864 33.1893333333333 102.2826666666667 42.7733333333333 106.992C51.0933333333333 111.072 59.12 112.5653333333333 68.5493333333333 111.7866666666667M45.9413333333333 84.8266666666667C44.8533333333333 84.3306666666667 43.568 83.0293333333333 43.1893333333333 82.0266666666667C42.624 80.5493333333333 42.8266666666667 78.384 43.632 77.2106666666667C43.9786666666667 76.704 46.9973333333333 73.5146666666667 50.3306666666667 70.1333333333333L56.4 63.9733333333333L51.28 58.816C42.992 50.464 42.832 50.256 42.8426666666667 48.0106666666667C42.8533333333333 45.0613333333333 45.0613333333333 42.8373333333333 47.984 42.8373333333333C50.2666666666667 42.8373333333333 50.448 42.9813333333333 58.8266666666667 51.2906666666667L64 56.4213333333333L69.1733333333333 51.2906666666667C77.552 42.9813333333333 77.7333333333333 42.8373333333333 80.016 42.8373333333333C82.9493333333333 42.8373333333333 85.136 45.0453333333333 85.1466666666667 48.0213333333333C85.1573333333333 50.272 85.0133333333333 50.4533333333334 76.7093333333333 58.8266666666667L71.5786666666667 64L76.7093333333333 69.1733333333334C85.0346666666667 77.5626666666667 85.1573333333333 77.728 85.1466666666667 80.0106666666667C85.136 82.288 83.6533333333333 84.3306666666667 81.5946666666667 84.9066666666667C80.096 85.328 78.2826666666667 85.104 77.2 84.3626666666667C76.6986666666667 84.016 73.5253333333333 81.008 70.144 77.68L64 71.6266666666667L57.856 77.68C54.4746666666667 81.008 51.3013333333333 84.016 50.8053333333333 84.3573333333333C50.0373333333333 84.8853333333333 49.6533333333333 84.992 48.256 85.056C47.1413333333333 85.104 46.3946666666667 85.0293333333333 45.9413333333333 84.8266666666667" />
+    <glyph glyph-name="sun"
+      unicode="&#xF146;"
+      horiz-adv-x="128" d="M61.9573333333333 122.1493333333333C60.9866666666667 121.728 59.7706666666667 120.5866666666667 59.2426666666667 119.5946666666667C58.7893333333333 118.7466666666667 58.7733333333333 118.5066666666667 58.7733333333333 112C58.7733333333333 105.5146666666667 58.7893333333333 105.248 59.232 104.4266666666667C60.2666666666667 102.512 61.872 101.5466666666667 64 101.5466666666667C66.128 101.5466666666667 67.7333333333333 102.512 68.768 104.4266666666667C69.2106666666667 105.248 69.2266666666667 105.5146666666667 69.2266666666667 112C69.2266666666667 118.48 69.2106666666667 118.752 68.768 119.5733333333334C68.208 120.608 67.3813333333333 121.4026666666667 66.2453333333333 122.0053333333334C65.2426666666667 122.5333333333333 63.008 122.608 61.9573333333333 122.1493333333333M24.48 106.576C23.3013333333333 106.1546666666667 22.2453333333333 105.2693333333333 21.712 104.256C21.0773333333333 103.0453333333333 21.04 100.544 21.6426666666667 99.3066666666667C22.1706666666667 98.2133333333333 30.3466666666667 90.0373333333333 31.4186666666667 89.5306666666667C33.568 88.512 35.7546666666667 88.8853333333333 37.424 90.5546666666667C39.008 92.1386666666667 39.3866666666667 93.696 38.7253333333333 95.9093333333333C38.4693333333333 96.7573333333333 37.968 97.4293333333333 36.112 99.3973333333333C34.848 100.7413333333333 32.6826666666667 102.864 31.3066666666667 104.1226666666667C29.328 105.9253333333333 28.6026666666667 106.4533333333333 27.8506666666667 106.64C26.6186666666667 106.9546666666667 25.472 106.928 24.48 106.576M99.9253333333333 106.6613333333333C99.1093333333333 106.4106666666667 94.976 102.672 91.888 99.3973333333333C90.032 97.4293333333333 89.5306666666667 96.7573333333333 89.2746666666667 95.9093333333333C88.608 93.68 88.992 92.1013333333333 90.576 90.544C92.2613333333333 88.8853333333333 94.4426666666667 88.5173333333333 96.5706666666667 89.5253333333333C97.0026666666667 89.7333333333333 99.2906666666667 91.824 101.6533333333333 94.176C106.6613333333333 99.1626666666667 106.9973333333333 99.6693333333333 106.8266666666667 101.9946666666667C106.624 104.848 104.8746666666667 106.6026666666667 102.0586666666667 106.7786666666667C101.248 106.8266666666667 100.288 106.7733333333333 99.9253333333333 106.6613333333333M59.84 90.2186666666667C54.9706666666667 89.5146666666667 49.2213333333333 86.64 45.5466666666667 83.0666666666667C38.7626666666667 76.4693333333333 36.0053333333333 67.056 38.176 57.92C40.6186666666667 47.632 49.088 39.6266666666667 59.3866666666667 37.872C61.8133333333333 37.456 66.1866666666667 37.456 68.6133333333333 37.872C79.5413333333333 39.7333333333333 88.2133333333333 48.4266666666667 90.1333333333333 59.456C90.544 61.7973333333333 90.544 66.2026666666667 90.1333333333333 68.544C88.2133333333333 79.568 79.3973333333333 88.352 68.4746666666667 90.1226666666667C66.3093333333333 90.4746666666667 61.9573333333333 90.5226666666667 59.84 90.2186666666667M67.9466666666667 79.552C69.5306666666667 79.248 72.672 77.6266666666667 74.1866666666667 76.336C76.624 74.2613333333333 78.6133333333333 71.2906666666667 79.4453333333333 68.496C79.9253333333333 66.864 79.9253333333333 61.136 79.4453333333333 59.504C78.256 55.5146666666667 75.0453333333333 51.68 71.264 49.7333333333333C68.4213333333333 48.272 67.7226666666667 48.1226666666667 63.8933333333333 48.1386666666667C60.5866666666667 48.1493333333333 60.4213333333333 48.1706666666667 58.624 48.8373333333333C55.7226666666667 49.9146666666667 52.5173333333333 52.4 50.784 54.9173333333333C49.856 56.2666666666667 48.9386666666667 58.288 48.5013333333333 59.9466666666667C48.0106666666667 61.8293333333333 48.0053333333333 66.1333333333333 48.5013333333333 68.1333333333333C49.6266666666667 72.7253333333333 54.2186666666667 77.7173333333333 58.6186666666667 79.1306666666667C61.1573333333333 79.9466666666667 65.008 80.1226666666667 67.9466666666667 79.552M10.6666666666667 69.1413333333333C8.5706666666667 68.9706666666667 7.808 68.6293333333333 6.7413333333333 67.3813333333334C5.856 66.3466666666667 5.552 65.4293333333334 5.5466666666667 63.8346666666667C5.5466666666667 61.872 6.5706666666667 60.24 8.4266666666667 59.232C9.248 58.7893333333333 9.5146666666667 58.7733333333333 16 58.7733333333333C22.4853333333333 58.7733333333333 22.752 58.7893333333333 23.5733333333333 59.232C25.488 60.2666666666667 26.4533333333333 61.872 26.4533333333333 64C26.4533333333333 66.1013333333333 25.6373333333333 67.5093333333333 23.7866666666667 68.5866666666667C22.9706666666667 69.0666666666667 22.6986666666667 69.0933333333333 17.7066666666667 69.1893333333333C14.832 69.248 11.664 69.2266666666667 10.6666666666667 69.1413333333333M106.6666666666667 69.1413333333333C104.5706666666667 68.9706666666667 103.808 68.6293333333333 102.7413333333333 67.3813333333334C101.856 66.3466666666667 101.552 65.4293333333334 101.5466666666667 63.8346666666667C101.5466666666667 61.872 102.5706666666667 60.24 104.4266666666667 59.232C105.248 58.7893333333333 105.5146666666667 58.7733333333333 112 58.7733333333333C118.4853333333333 58.7733333333333 118.752 58.7893333333333 119.5733333333334 59.232C121.488 60.2666666666667 122.4533333333333 61.872 122.4533333333333 64C122.4533333333333 66.1013333333333 121.6373333333333 67.5093333333333 119.7866666666667 68.5866666666667C118.9706666666667 69.0666666666667 118.6986666666667 69.0933333333333 113.7066666666667 69.1893333333333C110.832 69.248 107.664 69.2266666666667 106.6666666666667 69.1413333333333M32.2133333333333 38.8C31.0346666666667 38.448 29.488 37.1253333333333 25.6266666666667 33.1626666666667C21.392 28.8213333333333 21.0133333333333 28.2133333333333 21.1733333333333 26.0053333333333C21.376 23.1413333333333 23.2106666666667 21.3173333333333 26.0426666666667 21.1573333333333C28.3466666666667 21.024 28.8746666666667 21.376 33.824 26.3466666666667C36.2133333333333 28.7466666666667 38.2666666666667 30.9973333333333 38.48 31.44C38.9813333333333 32.5013333333334 39.1573333333333 34.3093333333333 38.8426666666667 35.2586666666667C38.4533333333333 36.432 37.4506666666667 37.6746666666667 36.384 38.2986666666667C35.28 38.944 33.4293333333333 39.168 32.2133333333333 38.8M92.672 38.8C91.4826666666667 38.528 90.1706666666667 37.3493333333333 89.4773333333333 35.9306666666667C88.9866666666667 34.9333333333333 88.9173333333333 34.5706666666667 89.0133333333333 33.5146666666667C89.0773333333333 32.8266666666667 89.3013333333333 31.8986666666667 89.5146666666667 31.456C90.1013333333333 30.2186666666667 98.208 22.1706666666667 99.4826666666667 21.5573333333333C101.488 20.5973333333333 104.5866666666667 21.3173333333333 105.8026666666667 23.0293333333333C106.944 24.6293333333333 107.2 26.9333333333333 106.416 28.5706666666667C105.8506666666667 29.7546666666667 97.744 37.92 96.624 38.4373333333333C95.6693333333333 38.88 93.776 39.056 92.672 38.8M61.9573333333333 26.1493333333333C60.9866666666667 25.728 59.7706666666667 24.5866666666667 59.2426666666667 23.5946666666667C58.7893333333333 22.7466666666667 58.7733333333333 22.5066666666667 58.7733333333333 16C58.7733333333333 9.5146666666667 58.7893333333333 9.248 59.232 8.4266666666667C60.2666666666667 6.512 61.872 5.5466666666667 64 5.5466666666667C66.128 5.5466666666667 67.7333333333333 6.512 68.768 8.4266666666667C69.2106666666667 9.248 69.2266666666667 9.5146666666667 69.2266666666667 16C69.2266666666667 22.48 69.2106666666667 22.752 68.768 23.5733333333334C68.208 24.608 67.3813333333333 25.4026666666667 66.2453333333333 26.0053333333333C65.2426666666667 26.5333333333333 63.008 26.608 61.9573333333333 26.1493333333333" />
+    <glyph glyph-name="sun-1"
+      unicode="&#x73;&#x75;&#x6E;"
+      horiz-adv-x="128" d="M61.9573333333333 122.1493333333333C60.9866666666667 121.728 59.7706666666667 120.5866666666667 59.2426666666667 119.5946666666667C58.7893333333333 118.7466666666667 58.7733333333333 118.5066666666667 58.7733333333333 112C58.7733333333333 105.5146666666667 58.7893333333333 105.248 59.232 104.4266666666667C60.2666666666667 102.512 61.872 101.5466666666667 64 101.5466666666667C66.128 101.5466666666667 67.7333333333333 102.512 68.768 104.4266666666667C69.2106666666667 105.248 69.2266666666667 105.5146666666667 69.2266666666667 112C69.2266666666667 118.48 69.2106666666667 118.752 68.768 119.5733333333334C68.208 120.608 67.3813333333333 121.4026666666667 66.2453333333333 122.0053333333334C65.2426666666667 122.5333333333333 63.008 122.608 61.9573333333333 122.1493333333333M24.48 106.576C23.3013333333333 106.1546666666667 22.2453333333333 105.2693333333333 21.712 104.256C21.0773333333333 103.0453333333333 21.04 100.544 21.6426666666667 99.3066666666667C22.1706666666667 98.2133333333333 30.3466666666667 90.0373333333333 31.4186666666667 89.5306666666667C33.568 88.512 35.7546666666667 88.8853333333333 37.424 90.5546666666667C39.008 92.1386666666667 39.3866666666667 93.696 38.7253333333333 95.9093333333333C38.4693333333333 96.7573333333333 37.968 97.4293333333333 36.112 99.3973333333333C34.848 100.7413333333333 32.6826666666667 102.864 31.3066666666667 104.1226666666667C29.328 105.9253333333333 28.6026666666667 106.4533333333333 27.8506666666667 106.64C26.6186666666667 106.9546666666667 25.472 106.928 24.48 106.576M99.9253333333333 106.6613333333333C99.1093333333333 106.4106666666667 94.976 102.672 91.888 99.3973333333333C90.032 97.4293333333333 89.5306666666667 96.7573333333333 89.2746666666667 95.9093333333333C88.608 93.68 88.992 92.1013333333333 90.576 90.544C92.2613333333333 88.8853333333333 94.4426666666667 88.5173333333333 96.5706666666667 89.5253333333333C97.0026666666667 89.7333333333333 99.2906666666667 91.824 101.6533333333333 94.176C106.6613333333333 99.1626666666667 106.9973333333333 99.6693333333333 106.8266666666667 101.9946666666667C106.624 104.848 104.8746666666667 106.6026666666667 102.0586666666667 106.7786666666667C101.248 106.8266666666667 100.288 106.7733333333333 99.9253333333333 106.6613333333333M59.84 90.2186666666667C54.9706666666667 89.5146666666667 49.2213333333333 86.64 45.5466666666667 83.0666666666667C38.7626666666667 76.4693333333333 36.0053333333333 67.056 38.176 57.92C40.6186666666667 47.632 49.088 39.6266666666667 59.3866666666667 37.872C61.8133333333333 37.456 66.1866666666667 37.456 68.6133333333333 37.872C79.5413333333333 39.7333333333333 88.2133333333333 48.4266666666667 90.1333333333333 59.456C90.544 61.7973333333333 90.544 66.2026666666667 90.1333333333333 68.544C88.2133333333333 79.568 79.3973333333333 88.352 68.4746666666667 90.1226666666667C66.3093333333333 90.4746666666667 61.9573333333333 90.5226666666667 59.84 90.2186666666667M67.9466666666667 79.552C69.5306666666667 79.248 72.672 77.6266666666667 74.1866666666667 76.336C76.624 74.2613333333333 78.6133333333333 71.2906666666667 79.4453333333333 68.496C79.9253333333333 66.864 79.9253333333333 61.136 79.4453333333333 59.504C78.256 55.5146666666667 75.0453333333333 51.68 71.264 49.7333333333333C68.4213333333333 48.272 67.7226666666667 48.1226666666667 63.8933333333333 48.1386666666667C60.5866666666667 48.1493333333333 60.4213333333333 48.1706666666667 58.624 48.8373333333333C55.7226666666667 49.9146666666667 52.5173333333333 52.4 50.784 54.9173333333333C49.856 56.2666666666667 48.9386666666667 58.288 48.5013333333333 59.9466666666667C48.0106666666667 61.8293333333333 48.0053333333333 66.1333333333333 48.5013333333333 68.1333333333333C49.6266666666667 72.7253333333333 54.2186666666667 77.7173333333333 58.6186666666667 79.1306666666667C61.1573333333333 79.9466666666667 65.008 80.1226666666667 67.9466666666667 79.552M10.6666666666667 69.1413333333333C8.5706666666667 68.9706666666667 7.808 68.6293333333333 6.7413333333333 67.3813333333334C5.856 66.3466666666667 5.552 65.4293333333334 5.5466666666667 63.8346666666667C5.5466666666667 61.872 6.5706666666667 60.24 8.4266666666667 59.232C9.248 58.7893333333333 9.5146666666667 58.7733333333333 16 58.7733333333333C22.4853333333333 58.7733333333333 22.752 58.7893333333333 23.5733333333333 59.232C25.488 60.2666666666667 26.4533333333333 61.872 26.4533333333333 64C26.4533333333333 66.1013333333333 25.6373333333333 67.5093333333333 23.7866666666667 68.5866666666667C22.9706666666667 69.0666666666667 22.6986666666667 69.0933333333333 17.7066666666667 69.1893333333333C14.832 69.248 11.664 69.2266666666667 10.6666666666667 69.1413333333333M106.6666666666667 69.1413333333333C104.5706666666667 68.9706666666667 103.808 68.6293333333333 102.7413333333333 67.3813333333334C101.856 66.3466666666667 101.552 65.4293333333334 101.5466666666667 63.8346666666667C101.5466666666667 61.872 102.5706666666667 60.24 104.4266666666667 59.232C105.248 58.7893333333333 105.5146666666667 58.7733333333333 112 58.7733333333333C118.4853333333333 58.7733333333333 118.752 58.7893333333333 119.5733333333334 59.232C121.488 60.2666666666667 122.4533333333333 61.872 122.4533333333333 64C122.4533333333333 66.1013333333333 121.6373333333333 67.5093333333333 119.7866666666667 68.5866666666667C118.9706666666667 69.0666666666667 118.6986666666667 69.0933333333333 113.7066666666667 69.1893333333333C110.832 69.248 107.664 69.2266666666667 106.6666666666667 69.1413333333333M32.2133333333333 38.8C31.0346666666667 38.448 29.488 37.1253333333333 25.6266666666667 33.1626666666667C21.392 28.8213333333333 21.0133333333333 28.2133333333333 21.1733333333333 26.0053333333333C21.376 23.1413333333333 23.2106666666667 21.3173333333333 26.0426666666667 21.1573333333333C28.3466666666667 21.024 28.8746666666667 21.376 33.824 26.3466666666667C36.2133333333333 28.7466666666667 38.2666666666667 30.9973333333333 38.48 31.44C38.9813333333333 32.5013333333334 39.1573333333333 34.3093333333333 38.8426666666667 35.2586666666667C38.4533333333333 36.432 37.4506666666667 37.6746666666667 36.384 38.2986666666667C35.28 38.944 33.4293333333333 39.168 32.2133333333333 38.8M92.672 38.8C91.4826666666667 38.528 90.1706666666667 37.3493333333333 89.4773333333333 35.9306666666667C88.9866666666667 34.9333333333333 88.9173333333333 34.5706666666667 89.0133333333333 33.5146666666667C89.0773333333333 32.8266666666667 89.3013333333333 31.8986666666667 89.5146666666667 31.456C90.1013333333333 30.2186666666667 98.208 22.1706666666667 99.4826666666667 21.5573333333333C101.488 20.5973333333333 104.5866666666667 21.3173333333333 105.8026666666667 23.0293333333333C106.944 24.6293333333333 107.2 26.9333333333333 106.416 28.5706666666667C105.8506666666667 29.7546666666667 97.744 37.92 96.624 38.4373333333333C95.6693333333333 38.88 93.776 39.056 92.672 38.8M61.9573333333333 26.1493333333333C60.9866666666667 25.728 59.7706666666667 24.5866666666667 59.2426666666667 23.5946666666667C58.7893333333333 22.7466666666667 58.7733333333333 22.5066666666667 58.7733333333333 16C58.7733333333333 9.5146666666667 58.7893333333333 9.248 59.232 8.4266666666667C60.2666666666667 6.512 61.872 5.5466666666667 64 5.5466666666667C66.128 5.5466666666667 67.7333333333333 6.512 68.768 8.4266666666667C69.2106666666667 9.248 69.2266666666667 9.5146666666667 69.2266666666667 16C69.2266666666667 22.48 69.2106666666667 22.752 68.768 23.5733333333334C68.208 24.608 67.3813333333333 25.4026666666667 66.2453333333333 26.0053333333333C65.2426666666667 26.5333333333333 63.008 26.608 61.9573333333333 26.1493333333333" />
   </font>
 </defs>
 </svg>
diff --git a/js-packages/web-console/src/assets/fonts/feldera-material-icons.ttf b/js-packages/web-console/src/assets/fonts/feldera-material-icons.ttf
index 8b1d7fa97691a42cfcd68a92a285c05f55312f0a..637cdd239167583bef97a3f59572c9e3ae8a7ec4 100644
GIT binary patch
delta 4356
zcmbVPdu&_P8UN0G`r1yKr`=GKwn>|ov~H91{Ypv+&7;mcDM<@$Zk(IgisS3rH*H#A
zt|r0C{-_2AX+x^eKnRrzX=vVqP0%s4A&{#6!!#i@wyN8pbWEe$G%+-${m%7uU(^1X
zufBWEJ>UEHec!cx<wf@HD=bfphyrw)WNPUe8Qb^9Uw`&*BDS4K`(R*XV_Wb0J#|FB
z3P?@H=gmy)xl3^(;|uUVo=u&ci9Nfgm8kMO(eA~BWlrbJH@^qjE1<0j9MD(vd+gr;
ztxC*0i;dX8UIsqSr0n<}^CyqLa*3$o3QpgdHy1PPIDG`>QarCnoAcJ6E=k`Y>R&-5
zUCh`y=fl73-9|JBdHLGYZ#0%oxfvjf>m4t@@bqV`Y>L;j+58MuQM0sD>X+-~VfnOt
zRz9aRDf<*hc~bd-@|K!V&#4!*W~!lP8l)_pr3>^6`YnCIs@QtApB-Vx*;)27yU2dU
zuCXsAjT&LGpJLQS12jTo)Jq4bo5rylz}iI*;dGJ|st{87n_^uw1cqRb(J)wpa9DPS
zp-DWAf+iui2|OV`3P;`41D%+wGX!Uhg6^4c9HTziJOG}MDg)=v(DDN`fe43?-<_;+
zocDn<LLqSObS3gS2&2pYi!%u~hu~=MUDhUCEMm~P4^4Di2zdZA;5u4=C&P6)0B-cI
zb0I%LM`+7k=fz-SwDYd>68tO3f4gI#*o|=VVKT58hrzL%p*%>wJ4CB#E2(ZkqCD$R
zyP^ieZW-x7;{dYm2G|e5Nr-j>ofLhYo~0M*HM&UeQU`is05(PGVnB5a)`Wb2o*u!b
z2L=R0t$^()(3k*Aw9Ytqhg=mIhK1^=dmqF3L0n7jI_<*wAk`y$5t68S51xC`YT9ku
ztMD`g-UvMAC#e&Ux18=lP7|)1{TTH=7?8kUMfXy<h!;Fzve?<Ts=5*=#K04sG)AVY
zvw}7t9nsPw&>KfMW1tbL#(fQJy0ehSf#_I;R)a*l#oQ+!o_dgBH-HaP3npTQP9cO!
zI5~pTKG&RR(jMpxz;vl8cO%>XB~u(k2_+ZvC1xc*3{wLz|A5;E#qkr>9f9HP$Vvbz
z;1&)=m;qcPa3Fel47rJ{g_c06p6bBu#wCXMuq#!ZcHOmJJTF-n);8v$Rs>FDE{xnm
zwQhVxh)aO&y6vnqWWvA>6lnyA_|RbMQObw$iaLYFd!E{W+bwj45tQhNZiJ;G$Py=i
z`-|g#H@6<-)9*nl8fXMf=D(?M3+T1(sgO7T{KSh!RDUVVm);x^1XvvIeeO<_rHE4{
zJjHNz=h5G{hp-t&U50ypd!`yp6vNTb2kmIlX-d-~@(v@!UR)C>m6#e4{;k)qXl=nS
zy#oz+5TiE&tcED>P9cV{3AOHrYH75Ba3^}84+RnPE{3!LU<(-;a5vCq+U7zmMt2w_
znzy9g4v7i4yv1pOmM8&3z+JHAy__R3IDj~Yp?nZ+BRcvJY9ziO4)aTT2iso=`l5{Q
z@dfz~<7=DRVF4d}@yhOQJyt)y^V&&aK`_eUSzsJR101C!ow~7~UpF>x5mWiF8&8+}
z7CPt-KtEg#z+Dew8;87jHyuFEqX?p!j_`i}Q${B}Nc-VY<M$gIwK3t{#CClI=7zf_
zM-C1S!OXznp6>CZvEBoHqlc=GJi^VuV|>u?=S57U;A`LgOyM5&NLXs~$i#ZoqldAI
zXF(Gnp(AJ*6!)kL>$FFcSS^o6u+DgN5bJDS+(3h%ghxYIlOFYBo%84+tSOHMu+DpQ
z7;D<29;~)U-B|Ja#HDep$2<~=WIY;-VUzQy7pvpZ0jvui^<h2k(J0mv9v#BE=utJ+
zlO7!@w3M~U`5T=?f-v@U<G~`KR&)c^5+thTex~ReJ1ddYDZL~sa#p?|f375ySJeu2
zT05<m>+SkgU&Qx}5i#}|ANZU6XZ-&NIDwafzOtsW?y_^`k@9aYi7Z)Ma=qePm2H)m
ztM*pCUcJ6L|D&2n&4;zkwY{~MLp7oHP$FCt-WtBTbm!9V)@gO8>Mq~Ya?gcjv1M;Z
zsv^51=OZ8AJ5#^=|GSWe>ZbB2fNI6p@h;lSpKmV|{=7NF3XQw>F|O8M=igp_hJRA|
zQ~pBrTm0!&SGnGr;d6~o<|SA6G3eG~-e{Yqm$Puqaw!zv#oF1ncD8}7X)0$+*qRNj
zF&tWs9oS6Qa0|6<-Mo=?ur;`EYnR%>^-_%n$)+`1pt!B6%+OS3=+!k$l325>t13={
zh9XIdp~<Q&=`7DQ-N%^D6j@?oqbaJU`6bm*WOeOoLt@NtEHFbY_XPraO*MlZqq4Fb
z1{IkxSqZ?lPm-CY`IrJbvI;w}rRj<)Bz%U?udQ9>_o=Gx7s<+Q!Wqm$1+65W+kBeO
z?RlFY+x7i|ymf<AU>hThN82Y0Te`X#uWWYs$xWXXj;*a>{D(_N3-9e~W_;bgbNp`)
zT;yiWZ}@%p|BF8rPH>~{ox-MdTP41-vXg&Wf4=ZSmB#p*$gc}utysl8oHO(&egy9n
zI5z_5M!lh&>9wJ7C|u9BZFR3Lz`0=q+bH2^IjgOK*b>&*<bm43I)I*5t}2qqj;VFJ
zq4<2Ys@Q9i5fDjh6}rl#%5s_ceHD_bS7`F~N13ANOj4wEsu~K)GN23AsOmadlQcX9
zRh_Z5iX5m=nWFlu)}a)tfQv6(@yEiRP>dDcjCQiZdv)6xzqjQNe8=9;`JT3Gm5K}J
zqsVI+x^IvU@%1gOO`?lJZJRpKLT&XZD%vHqDJ&j0BR#!As~20o*wWIZ1W+*<6%#cR
zTU1_RsFtFlVPpwoi8}M&?QLuDDR`D-8OMqusWJo8Fbr*rCPcs@{z>?9;qmSUiT}8B
zXW^@ekMSq&dxpQite>ymG+MaPInMZVy`6>m)!6)e=WF~}>m|;XUE)I>*Z337=L@ad
zUuT7t4V{el?EgFeXXAHxGCImX-Eo!Mm5cm=+Aj;gY<iUyKI*+9;a}3lzKeNgvMCm)
zVBAjUoa{o}N!n>6m7GmDQwymnf6mGtx3W=tW~L&Z%*InzG@h{HbJ3~fY#?K%tyDBC
zWR(-iv}H`$_FUA?SZO7hp0WM&cGfzYu(Qci{-S8gnsEa7N0@b@@vIr2Q|7IFdLif;
z&ZW#;qB3Qkv=^M{Ern7DaeG!PMiVfzS^GrMad_U!<;+=xRgCV~f|U~~u*H(ujJc4r
zjF}`tcdSJxi1?3Z?Q~QGW5n}z=43RJTF9xcT)<6X-ptNf)5^SUr}ebuoUpTVijXOH
zvPm;N3rl9o$~wNB<v7XoZ0@GbY5PRl??p0gJGzraO3^lXJ{hknW$D<NDE{`sftE`o
z^HyqFL4a8uG6H5TD|ikNOQxNv>_RRP@H9mPWhLXu<H>1Di6i<FJ7J|VrF{k{2D4V&
zN@g54Yt2F=R#rw(!Q8P0GiyaN_6aK+%ol;4vK_~sFDqf=*3@5wS>#l*D*{#B1_(}@
zjyVOJB4#~h&qh%-dCs~SP7Zk%Q5Oa(?kFo*O3plP`KC>+XoZ^t)hJD|hAy}Pv{5{n
zil)$50N*@m2+-W_(ux`QJn=<2w~%IWX0tTQF^6T@0!y+Kn`H^KwuOK3Q8vToSO%?r
Tg3Ys|>=Zl6j<IQm-zfh9E-qC-

delta 3531
zcmbVPdu&tZ6+fTtIJV=2goKa~nvf7^Xk#Ac-9mUJj_rhy*a;z!0XNQd?8f#r*VlP4
zTC;YKt^y?Zy8re-w3<Mw*vi!=ic*BOwxScAy6uns!z!q%iZWDXQnjkukoNnoubYtV
zuf_WLeD|F1ywACq+gI4VODso>h)U=*S!sP|cwq0_!MA#e*ft{jxdY*K-r!#XONfeZ
z<JR#=QcAz^^)<+yZ$dsZmY9yda_<WVQN;?P?K3f18qG-W{t9>R0b62V&|~8~gXiX0
zQk!Z#jT1Rq;Nw(6iR_eyfAB(zsQfs%x02FSnq}y35Z2&%MM_G_f4^h-5mE3ik>zGu
z$!OoZaI1`H|4)gmzdt{-vh<jd0kQ}`+?+W7XahUO>)BYYo+_xtQg2yrIciZYS1mKv
zQ`Xn4H?4PUWb@kEY@ZiJi)N{kTBwK8bcQa|@8~Z5la;e)SUVeL8au<@WH;C!***4%
zs%bHW$WQGwL_X?*PM88Th|>^gI~@eK8+XbJw{pg{cIp5X;w~D1XqXmJsln@nu>b|Z
z_Z$2U7~BTgd?(#_>IAxBgOPiIUN`jj!$Qe_NkoXb!!Y;^MDq;}QXlmqb{}n8An8FK
zeUNm}7Dz;3B11oJw}XZZ&aMSIeMT+(kh>7XlYWMBFn5H?76=MuTeW~c2vZ`kwgvor
zuzs}3^@IbFdzhXlC+Hyjbm2R1p_m-T&0L{V4YZGnzHLJb*-RCN(_XS8N0GM=)PkoK
zv<F#=mib_25Kg)PA2r~6CFF%(htUulZKq<$!e~PP`UkN>4r)Se>&Pwg4+8_H`7T^J
zjL$k;c~Y_yY9bq9&<cc5d>=BaqUWfeUchEvpo?^suG3Ns*bwAm9{dQp3uy_*A^Hwz
z(C{~ev3Jt}%JssH9~VVw#GnWj56UQLr}5o|ECU$HjSIN>KpPRL$W3%Vh+92IeGZ^a
zdArT1#+<FS2)xg*yBtaMQc%2CY_tTJD{eh)Mt}YIh=Ar#{u+cZ$1hB_u&@jWqHY1h
zeKT?^!_5$!iJ<b!I5&tkG$h~9Tn8NV8%p)G18xKOh&4Q9#Gl{SB4dE^d@)Eq7!^*R
zMh-rVl>-HDMU{q0rB~^7`Z?7j0O8sP*J7nb<HVcb5ZYBTPvXxZ#$og)OtlaQ!|mV*
zCDB1)pcFax8RswziB%KpS7UGs4n%%pk)Oi|7gpDa0Q0lnWSqpF*-@1?q&rF}nxfs9
zl$;OddZ0866Qa}e_fvFH$P1gj8cxL^`RM4pk#eAzA!rsx*A920ia~l7Cy`Pw-gj2x
zP7&&|9;YasBris=FNdfCxF8ltyml65v;wLk^8a-w|7vYTa|$&afTbZ+X}!^~{QI=f
zunh=PjIjt)_!DcqjKWVD>iGdFZ1C23ytyH(K#pRPgIKKnsEU~I5DX1qUIx+GA+&&y
z@nK%&*v0ng{SFV~XPqx?+=gMnAM>IJ;?xT2!aq~n$j0n=F2ewcXgny%F^bd4f9&IJ
zu63KmU>=2&0XP=BeAt+j5Zn#HT@ZN;VuQtohY?ICf@+{6{F3X(d_#%X-X(nY^YhNu
zIv5#f@Ae%Y?tt>pp<rO}fWIf)+qu8t2>*4-+1&TVRs0<TJSK#?*F-<4kO>?GBolq0
zBPIqwBPQBGM@@8t$|iiEQ4^w8V|nC|7g5Ya2WZ?x2z1=ULC}PWA<(3WL!kI!U?2#p
zm<WKTO$>sbFmV7>HQ@)%poaJ&l#xg?5eChgz|R<(FwqG*X<|R<l!*q=X%k2E*Gj$C
z9G;r!INf5q*+om4<(zesb=3L?>#VKcHd}PC=ycJScGdn_@wVbq#a}v3JDZ#_=XKX=
z*Plx+yS?ry_q9@cS#w!W+3cd17R{Eol%K1xRJ2xHs`z|yqVm<shgG9hA1`THa;mzi
z`iIrOU0SpBOpUGP<(iLcqqVndA1r&lZkMa>>hi?$ndP7Se;@wUvmN}K;LCh#^$q=g
ztDW($t8egkR^NRi+r{)3H*_<8z9q(=+WsEDzp|fy)AE5{xyj4;7klsUKke-2_dR#@
zojV+izhCu`?`plouPiyof3f}({oS?AOn>ZaXZ&%^8SV*O<ZmziRIl3|VtTgwEvA3e
zRK<A5&I>%#nBqTczpTHrW`~7;6zJDK^tLnoO8s((H-E;@)=cn~dq3c{TOaUMZE)E5
zh)*v&r)L(IGyS{E*IM+Bj_Zs!20!JKdw$73th=VaQn{CLR(G4f-*B8?sd$h7X5Rz8
zX3H%9$<zPlL#r<78=G4h|JSOU{PFX<_35@ljPLP(rF&NFX8Qf@O&0#wU2S?}&piu%
zJ6if~=Exn1$rGxQ@{B5zDSPHbR#Ii#WIQDoYpRrqdA!aMMH%-fX*p#}DoV-`iK~%>
z?3pS~#v>jj8nvYp*-VMaO(&%3Z!IR|s8*(_aVa$h1t}q`nky~EQ`(4{&BP3qC<GZz
zNtYI)P~&4U%?i`*d?=o@GAXO&rg_|ojC)4nV=j|1s%Rx?DJ3U7hN3N-k=4bfOxX3{
zclWqF%J=kF=HOdg6j7BRn@AjI<Y|kiqKbP|(xee7Ba4iznQY1#jUzNop3>ZTwGl<r
zlq8!fM}|sP^W?d3;mF9E7Eg_3PzY(-t_p{m9dS&^>Ref}nW!tNsPeIxqQ*~J$K`2T
zL`hG(Bvn-=joP~lC6thaEh(q6&V(q&NH#Iz%A4~<lrdXInvflZaGfGQqdCP1Wz2)X
zcu#0q4oMWuWfJION#2c7BX>keWi&M#(c+4krf7X>p`!7L_^4c*lC?=i9WP3YXq+Nc
zkI`pi7?P5TqFP1qO)XLPf=4M~kyZX;s5b0Y<%k?lYepUIGUiEEi;Nz!2#Yb9O)!-y
oEX6!*lufb>JHfI{VsZSB#LGt5I7_o6ORy-LW@GFm6YuW-0F&Se(*OVf

diff --git a/js-packages/web-console/src/assets/fonts/feldera-material-icons.woff b/js-packages/web-console/src/assets/fonts/feldera-material-icons.woff
index 3e552c9e8182d0b2eb66fac7757c82104986b86f..61ea7203d1eecb0f48552f552093b8afe7cfd171 100644
GIT binary patch
delta 10218
zcmV<GCl%O)Pn=Q|cTYw}00961001c*01E&B0030TkrX3;Pyhf1*u3(;{!ddcG5`Ps
zSO5S3KL7v#U`o?T8Dni>Z~y=Vm;e9*UH||F=1iH)V`pr6W&i*N_y7PMRsaAzcubT%
zF=%CBWB>ppPyhe`EdT%jHgjRUuV`pxVE_OmfB*mh7ytkOBmn&Y<7jPkcmMz-m;e9(
z5&!@Jh$8@h003-nV_^UQB&+}c0Gj{+0LHm}smyI*cyIs!B}f1O0384T03ZQ&0Nrk3
zZDjxeC1?Nu0YU%(0>10a0*7#Kb94XzCaeGe0&V~R1L)fCKsR`tbyYo66HydBn=B!G
zsi1<QA|j$9Dt;>>Dk9min}lQ&Ab=QV9Ml<x!eJbL$I7vAtf(v*3kwS>3v0&0!XIF5
z?N4y5Jomn=*$v9h=Iy)Zex7^Z0~Ua03}XzjiAk@BU8~FMYv_gz^Cx)t+gg44cp1rH
zN6gkW2`jOJ4h+UdV%d04ybymC--vJ81NOMRZojcV+g}=<G;B6(B?hq%gP6uMY+wst
z@dLkqtPX3)nzWXz=hlYx(b~4YTR*Meu>_9OV-_A#$iYVmQ*hy6j$b*hDa=w@VFr65
zS}EkY3R*&e$TZ`%MKmhh75P@UyF^U%i^LtIiF#_2XDkb?DwDV#GPHMziKLB4G_xGa
z{LQnvC^AQRhKP?&BGE{qF+-n6cOVt6^ZdGhQ|GO$t4EvDXsL^n(>OzQa`BrZdiEds
zWh~)Jo!sQ=VWdtTaNo;$iE`->=|YpDOQB5eb1K4`dvO&Fe|vL=eKQs^MTgKxxyzaz
zTFf#=Cq~K5DqiCqKHw9!@eQ{*54mdJJVub}9PQTw<;_)oE|9Z_%%DufR4QDGMVx+r
zWi9G&iSijfyX&MW%BRu8>?I@Vc$)huPFW(P*Uw#^n6O*H1b4NVw^&hG^(GlJL;D!<
zejLFr&9<x_>pOak9C+0!Dq&e|dU1}`2xC6&=BQQT>yt|tCy58Az*QDc@HO3&U6OB_
z^*Lm{m1n$w6})5y?b>&TdAZg3OluW?wRs$6t^d<8QxIdngHuwVR*t{-bOy}16CIy6
z*IARWS*rSyyjuA9%9N{YOU+^>_4eQ(QHPIsSx_x=${W?Y6Y(zI&eO`UCUuLCZtU0W
z48H+eH$$@Ebcy{9cF1R~NzT>~`?$!P=`CmOJuZ^9THOVmbE$rTe71y;+I?|<S1U`i
znrxNNtZFs$*~#)Lm1cEr3wpmu=MT_(aAO>1e&#HV>zDMzu++{-p57Mokqj==XH6ci
zGr`wnli&=DaXKGi4KG-A7iCj?%JgCG&+w_0srL2so13qR5geWJ#n9;+V1Kf-3C>h2
zqX`ok{a@m!WgnRqojAGfW2V<IlwUcsg=+r->oICXkzranIzJusP`i<Z=RCE9(OI3-
zdG@FB2Op&AhIpJ~U}1=6lRpF{e;Y#skju@`4HjlZQ6vrkbFv3|0C=3W)aO!DK^%th
zClI0_s1O9DSP>OO5u^wR*yu<vf&z9KdoNey?VT&o|I52Ge&&OR`Q>5H<ecm#*#Kog
zX}BEnP%=y|{v+2PXLEb!OR3m9pU+js_%H`4p+E;+Y_rR+Z0ygUIPdXee_m&~z45;z
z7uWdjBttP?iDy0J0gH^Y!xF2^v%r1Um}8SkCRmR<%`n9@vn;bgku4s@eM(|3`IvEm
z12K#8nAagHsfs%v;V9MA#4~F-MjiDW=L8Kj(nNE-?kP@lhO?Zbh4Zv>fs0(CjrLey
z2UoaCC)Z*H-CU=KUi#?ge+B~##*A+=%m}00;x>1<%RR<oQ3dvQtmxtKey)i3XmNaJ
zX?1=f-kZ72$%*ytnW^d7<&EOjqkX>ke>(JiApbj!o}h1mX|-L67QLN3Ok;VFu93y?
zG#L-ilAZ88Sqd+b)$lTz53iDiu$$ZuuamX#CYcLwlg;ohnGElfe~IuRSq~o*t>IHL
z6Fw(X;Y%_dz9zHbTe2L!CmZ2MQVc(nt?(;}4>`-3c4AgysHLWzo8?WrH!Cyk>a1X>
z2MqO~p_UtJg=x2EhYYpS^l4{RhI-ggj~MDvL#;N{8bd9b)}GZG>M=vDGt_!RJ#MHc
z47I^f8x6I|P@4_)f25(FGSt(Cdd5)C8tOSiZ86mIhT3YV7Yy~Hp<Xi7HbZSU)XSz{
z=&ZxE$FeJideu-n4fUF#cA55M)@`WQ4YkKmdkwYEQ2Pz_hM^7^>Y$+xnST4Tn}#}U
zs3V3tYN)pi^|qnjG1R+;de2bDjIqDe4(PT30C=38TibRVf5&z0s_Lrh+gvd{jq3oM
zA!kU!0*Jv}B!U2BnNqA9rR62jvSKG*UXkM1jID=2aUdso$y)h<<R9`EdCXhZ$|q&-
z(>*f)MN)zQa?st=Q(blHoPGAWOke~4d=q>f90jxBBzQA;90c=zL*;|M+fkivahw<3
z@wu8V|DLH+e>EBItLbPc_f1C!YF7<L$MRBijz-767))<#rP{_?(^kqWbzfeuUoh=v
zbFcY;FL&41KgrfFjLK{{Fjnmv{Op#m%9=rFGiC5@rnI_``<r`NZKIQ|bM{8o@FiAp
z61*3Dj`=%ZSKj5FqPwemYCJnoqv4^NpQ&?oJTAKYe{E>j9na1cuT3Yz5q}Sqzpq@U
zIMK8DsTz(v*5^9A>Uchz&PS8MN$j=L&gd{SiZ3R#3O|VpZK$1%lnNsqTBjA>)R?NV
zJ~2@mYHd^>=SpuGUe;aBlS^f_HF4%W<YF;yY(tFYTxu|E=+oH6VT3WQamG2k=d8yE
zpBjtNfAOPo+~+t4o<Rz(+Rtx-e()1W<JZA6>@9ZG?LZO*_lUCL3D<SREgek`RMD4(
z7UN<^xq%<}a@}WYeyR`Dq4NFVbTr*neFu%`?kdW53?Yr=&0;X>k51L>cz*10$M{TP
z$OO}KVc1Leb%-gtQ2)}%T%VZ@%HyXZ53{L_f6+UOTRuvRT7LvdsF<swqNq@Z-R389
zx0>8D+CcisTtcFTpGx>avo6P)gQ;hDn;WA|p{p@gx9nq-&U)8T!q`J-m5%WQr8b-8
z2U2gaK}H37Da$v44@HK)ZhQ{q5tTSsv-yms(02_Dnbt8h#DRa1+H8#5&eVY}9yFkQ
ze|6RAsS{`-?;o5-4IjqND&0t%zV6e+K}Af+$(m+r9e(2mb~<gQVHP=qS!U_jy;f6L
zdP{|BZuF%MO`K$|-mPbtz411!M~R~%)O^~47?eq(WHYZp<De}TYt1Z%z$#5^h863j
z?R<^jA{Yd(VU=~&P&*2`a-z%K*Q0^Ye+MJ%Ki7O*^i;<+)L?pC7(NZ=@Ub>fd2UN@
z%x!{P4|Zg`+U*NW*?zp(-jB70VNCb&-V@nhWj?@0Jgw&OYsh*ZIP_!8<H6AYHtKUc
zuOJF7RB|>s<ilrT&7;Yo_T2&?B(_~(8}>C!{rDILq9QG}X>=QFRzJe7sy4*ze-b_y
zCg=2hZvT3$Bda5wgzEmKQZ}!7=QG^ARp}01wlG5GUF4%eXRQo()xF)fkv6eeVGwcj
zel`F85x@~MKY^k3G)&@LpC||rusPa?Jvr*dXgCl!+EKD7ETjQ6I>RzkS~qlmM6D2w
z*EklD>H3<-^tHAQ@Cb=Qri0#Fe*;70*||{WXM`97&;U#r;telgAMgpNH&$ZpT&Z^k
z1Eo$3@B}jtm%6?MPjC{vEBX%jgVd?-+=Md?;g1gVK(?f=q45OP>12*~03bajcJKRu
z7lH$T<5Ar5afAn(C<eHtMW+@5$7-ES*SnaEOMH~)O{@`8P3*$931-x&e@k!UG=qg?
zX$*@FRZ@$y?JTY(iEh{8c0GgQ`DW@PYm;WG#HuNhuF*MtM-CxYd-E)KKS+W+*b^Pc
zT=j4;EM9Qb1D1Plf#-Vng@^AcABW2Nh^q0eqvvhv;1xD?pr-Q)P?HjVxlx_9OQUL^
z%I>T2_+>_AZjZF!+Gr?Ne-%_1_Giqc7d)vvW6{~w)XOt^!~;R624QQ!X*Bq@5?h0R
zgsq8@;Z8j+db(3;?UasTSR;hReyu}%xeoxcxRL=(;m4f8X2Nb9W#g%PiU;D{5^ZD5
z|L&cb_8DKO*w&*o^_?}a0u#4db&Mx^5JFjDm~a~|!tQ%TzXx@~f3WblxFd=Id3SFo
z*ngj_@a!wFfo5<k7*mV)RX_KoSD!%a-*LXH6sKj>XXG0nzT)f)2-;Fl_r7(o!h_PD
zetdIl0uXE~dQv#qo7xdbL8}E=xTS7xLR+mi9Im=WKcW_Vg1X!Yc7xl&J@~@2l23pf
zE<M`ubLUWQL9;3Of55lj>4esXJ#xWqzVvwdXlv_aYinnDuC}%=Z1@=uKU?08cc%MK
z>$R<;>MmR@>RVTN&p3D#{A=(Z!T$vRSNiOd>x?PwL4R1$6d^kF*fjfVJZC{)0BE^5
zZ!n`S)`G2rLBKTlXNnPM9>a50@Xr7yF(VUzrQowJ_cZR}e*ySbw*xoUKh(p?x%SKH
zTzO=lN^v~yR?JJ7)S04r4oAguI%}5J6k2c-{tyQ~BP@sq0Lt4644y17v?K4*JJ8#K
zLSXOt4v3L6-+Bi=f$xMFnGh5Jo<a`7{qni`^9pTVG6B8B?n}R5TCjIraj^2$l9Vio
zShwO?H9Y;5e{;L`4$ey^*jP=nJZN5duzTqoz=HAx!MnznyTM)P&bz^1247s&n=2cY
zkFRdgb+Y@yoqg2@)}E8A!~>;7@#n*ZH0$5*w#yf-J-f2*1*zTtzBfWDBB0>+_}vxH
zv7-Q8`w}3DKcf#3t3Fi2!5Ic<rROACXPZXQW0ZECfBKzlS}Ox8ZiaFdJDBEv$vM6b
zE`mFVJO3v51Lf`|cFQ~BigK9GxzInDFXTF%0We1d%pQCRe*2(Jehx}C9pZ-BJg<X!
zoS7c@c*7JhTW$v4IMA@OLM)h}>qDhmne&`ZOhK9*Fir1FJA<F`CTk|jWi|=HyaA{1
zR~@(>f2fX48t^<JxVj~+#GaTk_7XZNtP+?6Yh-+=!NfA#h$9y{y+uCCScSV)^R2j%
z`78z*1JmECIYhT`Z@CFQf&nmjz5zag;SC-qv82&uC<L^QuxB&8iN^%Xefko=!__{O
zgkwzUL2gHrDLwgYI5_GLJXmKBqcyWl8nfC#fApp8`UYbmrFxrmZ4^x_D|bw7Z!=_t
z{chlb-PttH^TqQjKDvR2V{Bbz6o8b+SI#EGn|V8@7l9%`&n$z+8#_K@dIYwfA$eXN
zE-~UOtaUv&4CcY(;8Vz2m<5>=Bb3tY&(*17Jd*E*$GPyi(ePBy;42;=Dj7|Ee;`Cd
ze+lt;a0I4&v<hl)VQ}TbXfTRYm0*C~Kh~D`T+bN5f$xDUsmD-VJ?cdsfA0uI)Syn<
z)4Hp8=kAr`OVY~EWgNxB$1bd=Yq1sp@AX8Cn$QB)+}O}1m02bjAk;3RNSThVbnYqS
z(4`~>qHdbjbx4CFXZeUMMBO5k*YSgCe|*tuYoQjQZq)0Iieg;Rr9tozEcIEXOA`8x
z#jhT!%58UH!t>d*a@E&`KOHSW*LN5PPM4?)o2Y;b#=*RW?7_a`Jl8_fcNLLs8z&6=
z_3Frndec_v1N~4hU{gTYKClA9ukUDG=B6O6@&I^@Fah`TqcBr75$orX2EeFWfBxEN
z<zc4nq{?wHO1nCq9EhkYS$zp@>>$!S3?`J7By?bO^D4X~A1gJJ7suER&5J8ic83le
zF1s#Eu<%ig6M3i`Obl3UM`^mBreEQ@d$&{or=IX&bp;?NS03DX@6Mg~7IXVbeCdJM
z2{nV0Q=Q_7`y`q%nv4+DlMy2De|gY7*T;DS8^Q2B2b?1S<|Gf*<P`T~_g<?jCcU(`
zABucV1#nfZPF+miMjTMzgQaMn=Z|G;?2j*TbM!t|QKrV!GyLBHA*$8z(b3yVoq}Ix
z8Meo-f5!L%=vvBGFMZOz;5|W8$3$XRAnbTN6E{SyVHyp-Xev1%8gF@9e|LTi&R7@k
z)Ccy#FHtqeCt1?sBEoj&W9!3OjKC<=k@0C7)1qJ`K(nOLq854ppGi#IjKG;P#2gpe
zCLMe*3bQt;QHZcBCKAH7ZR(TA(S}uK;6K)E<U<#h4oPRt7#<~~Ltok1N5Ln-FM_{X
z=nnlw4lvU@YCs1pu3b}^f1oz|O#RAb$!16ZtIF#WNo7puWwvy%!}xWjWHa%CaBsp8
zu^H63u6CkkR=+8)TzXgNq@3Z7Ev$<-c87WXex6@KN@g7&O5uMUVq?2*<c4)xNm`wg
zh4O-P7$wD^yqG8Xr)i#~`86)nuY6>Qwa+2K(U6#cwSdmt5=ykkf4Gj$PctMUo7v<1
z_voGWIORReeI?rq_=tU=7<FILf<3*<p+!rWneyFTMA7uYqbVYS$vk(9bO|2omlWj@
zynb_2Bw{|-AZ2>D#ylWY=&n}3pe5W&iT_SA!Ar^!+O0#76YM?Q8>qwUT_Y({|Bi5F
zW&%%|0_8gA8kiy3e_wHl1t<F^_$>IZ;J<_amFz|CJC0Nf+9G(1m_|85enHG1ck`kn
zFg!lfOlXY3!8CKjdNLE`IE1N4=78Rv<CKZ{6B_s!T!nc)p$#3V86zjxFm4|Ln;d97
z389mkfxzISLyRsDQd0oOm}a(e0(jUI)Os{1FeL(@WLSo?e-mIhv+H3PQIJMb3xa(3
zILrj@)VPqLjWv!*9>vrJ)eNN1SqqY_05i696ecDkQxc&-o4sTNxC2otmzaTufkG4E
zX`N-_j@*$%E@to&VmD#<bUC4kaM|g|VP_q&-bp_CQqiEf*EQ@6^B)}Fa1dtnFdyLs
z;F^Zl9k&mxf0S#qcq>#=eBh*roUjMh7pN*kAQwesPGty(2{HqyShe6(wZ~EcGlrZK
zGgG)6N+vXnI9ZVZhOj=;DXmS;jg7AG(5LWCrH!%Tz?|9@(s>I^?3P{-%}<2`+`?s3
z^2$}-qzGOMrh-s9cLKj-A@kprfgC<cJGDd+VukL#e}XxNFp(IyUM9GqQLpZOB}*K-
z)B<n=yR?(Ll5u!n>Q4O%LI;i+kD?=9j>RK*4iGw+HS~WZc{U)VcswDABjBc6F<{(s
zeB~6MoHF^*EuER?Zq6dhBjIda<t4IKds^3awSFC!-+XOZJ|Qh$Qe>?!0g{%gW!}LU
zh-TiQe=WdY0wwSl2J*&0SoBX@co|SB2W6^$dA!WC{T}P@1h*H}kut@}yy6ky?m*`~
zKtu<I+#e!JoXxq$(v==ppnEJi$f}YkE)zCB8J_t>Yj`mz8q@eOOi9z8G-n3wZzcxk
zCT*LlzN3AznLv-j%f#7x&`lKqH}AXHz-^d)e|{7%3efH2#KoD;XhxZCq#@!n9Aby#
z*r)AP&g;*JNACv5!Rx`#gWm*yTduJ5jZ)e<)KtAQ&GqaW?k`J-lI|*w=kT1RCuDJG
zfKTS#;z+dN2<mX4_JytH4~o1P(1DgN^DJt*#F!*&GO*Nf+5!cyx7R$A!i-Y^N@=5u
zf5UCCG}mfv8C%v{Bx$lmz+yT?@GBPgzp?T6kxLP_HqwmNPg`$iajR|_NeT!U){Yo6
z*A3KHHDg!?La$Ia<?gVlVf!Xb2sjwC@U;a``l{mWuy*pHfhV0{febQ{cziYoRUh=h
z%e7#1-tmIV!zzh<uFe@nV=@FuMwmVhf1@ZDbc1oG%<{UX2Y9vWMkP^GTMyxU13>j$
z&AzqW%rH#OI@azRmS<T+#`^DuCT$|{vq^g&N@8_zMQ<;HHW=Oq;@v!RfV*m5<yuEM
zJWQ8~K8fHk`RQmrIa9JY@p?4N3D$Ok&F|*RLg?sG81eC$2ZCl`^f7gnD}jW|e?*Oo
z8Z6Q<WEE?S)Lp4ki4La`+_$#%dP-}{BKVt3OSuNF$x7~uF2L&<HrsmJfIUW$!rtHo
zueu&a$u*vL7W@*?)J0j*XI@_{w0kT`mE6-Zxiv$^M*^w4Ixp=K<nICNAqTpsvxI)8
zi?Zr_)E$@B%@r3!sSfX(j<C_be=`8*1%XPqmuqdH3!IaM<ApW4Fl9wpR+@+>p+EA@
zt&37VGe<UJI)X_R3F##OgLfL1sXz{CZnM&%FPRK!x0`S~;(WspP9;p8U85zth+z%M
zu+b^RzAirZ8AoL3W+n1j*FuH1WrTekx9EtN1;U?A4rlcB{NUZ-4Y0Zof54i5Pp#3U
zGXsX8bz)vYTsUSs0a&q=M~D#q0eO-hmFMTmkB|IderBLwG=u3}`V>4QD8|AXj3;JN
z%?JvAOj_-Tb-pMm>tY)<20Bat5yZqFK%TY}Whq1YD9^$(Wm}RuH6saNYg3>g{e9E1
zY{{seYj-TB7&wD0Hd3Yuf4#14Xdwnk%r1l|PaR!CYHZQ4E>$iK6Fjt6V|@xP+r}`{
zme6o)GWX8Ka49B{0v^d_rdOPjGMok<2Y(&>R=BaWWKe+G<xE#mAh^o1lgO%|Ft4N&
zMs)gcmoE1u0Ugaj1@#=ZIQBU09O}Lx4m0z>qS1rnFAZV~7S;_Nf1Q$CTI2;We*|3c
zO%kO<d|^(_44LlIX-x>Ty~p4xh3K-n1`*%f0G1@APB6TTW%x_DULkv$)X6}cWe~0P
z95&mc5+~Zij4?Wh8vrYT^i7Ib9&QP^cF)R_YPGkhjGkNKOn5&`b-u!?MUL&Go7a$D
zmG!t`WtIklwYFfhf91gsD9-9DAD08A1AA?aZv=1OJd;>fZq*R3cU9D@sNjtjxuApW
zNWu7c*;o+78!oj;Td_&BZ6t@*^f*iX^*y~4oJvKuUgo*WXo&jGMw^K=TIew|*Rq^%
zWx9A7z9(nEgbyL?njg2AM`ElU>Wbhi^E&lWvRViWwvB`Ue~2v}>Jntx0aI3&Uzb;V
zDH$oI6Bv>U@0&|7;iR3%sXh3jhh-8Ge1HSN$0d?9EAwHJsk)vY{<vhvH`-O!0lH&>
z)Nz^ZXBqCi>@isE@Z_e79Hx>i;EEiP0Kptito48cd!>eT)BTR%qNNOHjRa!!{Baz+
z>7pay8V)kHe|Z%A<R;Ngl`n@pm@6I@-6Q{Ca`gRUoia;qbYJURx)!%?5c7a<!W!@=
z)LpRjw2M{PCI6d9kJ+Dsf2;ZiLH@`t##di<RTb9|_50Ufit*9v=3~6%%q{sVw+!$y
zWhgcG{VVD6E9PET%gdc=ov~%G>{u|7qgWavUib#wf4yNXSx(Bfy6UdyuF<B9^d#;r
zA>uV&+vK%Nt^Tm+voVYR%-Fo>D)aRGf%SbZl>ORiF1b5Nxtl5ruNO)91%{M89s6Yl
zm>HBK*WEQDkbNoj92&@$mPTJoCs_=jI3RXEwRUSuxP!?u{~^-^1Cp$;)#7v6excj#
zdv_2Ge{{AOY*>3?x3+;5@Q@j^(IZ3yw$+4dY&KYnXy3h~-s*Ijez1!?zz4y5;Mk%Q
zjtwW{b4=|}pV1tcZ?#g<3iW$9@d7t;F;vSO)Ym~bxR3bjSF3vLvVjI#k&}@6vdTgL
zWOJH#tKK7DhHE`tMj}L33C>_y2U?mwHyn$re^!00Y*}0_<6QM_1$^qs-Kr63odqym
z@5GV=;yzjFQA{($rYgMf%R#CGCMF**hLQ2oMX%$gktVDVvy1Bhi!e$p2$zs1*I@Wp
z_tcYXeMJ42_vV$!1TMd*YEIM9i`s}N;-@4lA3z_U;Q!MXwGlD)7>_0XkEGqqv{p67
ze@}xig7xb)#;TEMO7RX37FES6s}r}~^R-0gf8sT_8uJ<W^ky|C2yk6I;TX<avPP$6
zX*p{#Nx{<bNP^v-HowCP&KMwr=#GrtIa6kdOT^f{;7vsCUk3kB#&}SMLi&M0(`Qh{
z`D{8Hjt)!-wh&>}1U1@c?N~iHgn3hKe~M*>QQCqf!FZ^iOE4BCX+M<Sz42+*iJbA0
zDYUg#)~Z>CHYx_kP7|-AhD+&%=~1CZLng;1Q->fuv)`2)1XI;(YuM8MH!6wYB^%Dx
z5(}8pcuh0wYF&6E3mWcS+VlvAfaVk$6OS(4OdH;{n4!dj@KD$+LvAQ2f-Twce^9$f
zLQF)JB&@4m0QOa_RqTC056lJtwnh&Jf2aCgiR8AiNskzneW7l3*R9!pB$3vV`}||@
zFTq>Tq^}o!+EwVuoXX@-`X;86BkTxufV*%=@ZTjDf^X=ED-q4_3n7vSiiH-s&jO)@
zmT>-@L0Or4K9`KXxRghE!<IF<f23t38Jg4(KKeE@xWGwPXyPnRQs0Orf<aK;&LW?+
znI~x`t)|ZaQLUsND&2@;2A1u%IEQ9a+yu`488U<6y>D1mrva5hH7u(_s?y2{2q=_X
z$Hp`yEgx=}5HNxe!AScu1FBFG2s4&I>WJ_m-Byc<Ak%0Fg~8dCn$_3PfBDmESSh|>
ziH>F6nK3(40aau`-??Zr(-k0^E^#V1C3-P>F`DiCDvl>q#7P`8AcqgxGE3-_q(%jL
zrN_bw;uwc<%)n@yi`-u24r!z8Cwoh(gsg|KROo~Xov~6f$Ly-+L-1l>_|e?2a!9&A
zDpiI1{zs*b6oTZGk#82ce?~o_gKpFe>(>md;JVT{ozqInHbm@=94GPR5&ds7bG#kq
zlsQ$e<<evrVcWLDG)jBgOM||P1=11Iu^lu~&vCjp5x?As)6rX%UpJ8I4|9OupVFnm
z@_Q12ny}lw0j1kAi_h^-E|l)M`t3CM*_Ar{D)L~noA2}tbGVLGfA-O-meRa@L!gja
z`$#fMi)1j&uiucMv$rg!KQ7DP+e&4OLG&6_=V4h;9~J<>wcA<~d=O@9c>x$nn^V;Z
zC4;=n0Xh*&AAlVB@XtKI69HGf1~#(h=~VG)8O12S_N|^qX0InN?rHQdYF~VLqhn{;
zsi>Yl{rO8994}U#e~jzb+8D1jG}hSDxbpw&u#&%6bevoxLWkOS@`8peEhB71WKls+
zX*UD!a-Wa-hb)%KBnL2DsRUKTAgpI|$p5~Q#KoPv>stFNhLft0_S5_KFUs31n()xt
zdfJW3_H^z<bNwL>?<~;b4%r1RywlvfR!=Oz<=zyX5?&_Xe?}S4s@m~EnI5K>-WLO*
z;dpV??BzIOr)GaRI)aK7<<*>MF(40|K5Ew*#&p}AwB?{AiEB1X#I|+DZ9FpVbR(^I
z+8OiXt+buC0KQRmC2VDF-t~<NZKR)Q9|MD}!vVh+k}B*dvt|O!p;cRKkWlLcX<k{s
zC&lXxR^)8Be-W(oi~T}(pjjUUzYYGW^qNc-&*sxIRFM)o&Axvnei4N$OGr#BcB&E(
zD955bsKoW7MZt*GrRCnsaL@G-9la}<1$f>q^HY1+*SQooM=TVA?sv=3sERVQ-lUlt
zHCFugRrTS#44@DXm^W8%UzYxXwJ1>r`lw_TtlVO9e*pBxle%;{k5n&urON{J@`IRL
zy6P`l;p!gj^CyxO`YsmNV|KyI_qayGlDb{5tTUfD7<~_V7JCo9NoxsI!N4Q<=j-g>
zgL=gq8%)va$Ts7~Hs-zXr1Y!%(%NUtm7X5jc?S{Q?Xv3G(4C$-KG$Wp$)N`0l$__8
z@<oHGf8^(P`IpAL?XVMh?F}sz?U3~%enZ7%;VjX!bhT?2`ki&AbFw#BNtR$U#YQ=%
zQP#qlPG^r-Td}P5TmUaON~W%>WH<GarIH6wz2jb4a;}{k{ef%borg+Y01SRZWR4Ir
z>Z4X%s}KF|aK%}^2_BZ;H4*3UbH4zGRU<88e;jsK&zT3(yZk22ME1CPG+V8wl*<?{
zAgbY6F)P+(L?a0?L^Y>`JR2e8*V5gp<a>PfmXsErNTTe6OPzvZt&yr3eZS0)5&7;*
zhD&uct5EC*Fd|>?$f+OV5`#p2w`|Z_aj_y8y&_`6v;~(XY<qF6rp$+Bcd2_>oc2U$
zf2(|v>UwUGHuK33uo&;)(8{lWR5_VhNxu%1lskTa>B!gkvW#4|CSPCUS2#oI#QFh7
zv@OBpa-eEZT*FC_EZ3hwPlxd89|yk*ei!^H`1jyH7g6iD>{aq*sbMA&#<5g!x@<C;
zFtaET#Dcr9AlSWH5Jap|)dR0|a~@x7f9+(VlM>WZ3|?0VO3L77=&#P<Y=J6wDI-Xf
zfuMPhc&Tj&Cv^XN)DtJGzRyorhfnFWjC_eQJYjHQ8Jgks*5a9${2m$ZtSiMvOcOI}
zT($!uB4n=1wxD&jMk=L9P9RZIiwvb0O*IAaawe+)z53JRlQFeea%L=8hh=65e_OSB
z<o^SWitKR!0C=2ZU}Rum0OD76UQ6ToZN4&aGc*7NqBtM#L!yD8hM^8faxgG~H~=}x
z3Q_<70C=2ZU}RumXkcJ~lQj&C45%Op0444L;dq>5U;u)KQH&MS5dZ)Vh9dz00C=2Z
zU;u(7h8K)|ObkpeOiP$qn2VTKe=&bx$zWN-D!`h;*1*okZpZ$JLxy7#rwpeP=M643
zt`4qm+$G#gcsO{~cs+RM@X7FX@yqa6@V^q6AZR3bPRK!Mhp>+DHW3+-TcTQ`UZUs3
zM8xdGGQ>s1&BPx`SV=69WRt9tJSSx!wMyDY`jCu}jE&3+nP;+TayH~aBLFGiD~14g
zoMT{QU|>jMxX8f800K-v%mrru2lE*KC+`AOv*9C50e^GbFcdRl#ZyV0bfkOlRvqcy
zd+)uQQZy~`Opyvn*>Qe-DJe>>cjYJE5r+rhfwiexc~JZR2{DB_JWQj3CR%8tgD!l`
zU>2Lu!yM+Z8C$Rw+pvJ`*nyqch27YLz1WBSIDmsVgu^(3qd11+IDwNmh0_Rd24`^&
z=dp+jxPORCxQr{fifg!z8@P#ExQ#owi+i|_2Y84_c#J1_if4F^7kG(Rc#SuBi+6aB
z5BP{r_>3?3if{OiANYx1_>Cp}0YL~_^Qn@?>Wo^hWLxkkwqYj1j$wMlbf5-<9_5+}
z7SNc{VG#1Dn-a-HpmVG@=90BTrG|k@ne@0EsDDnPG+T<5=Bu3&D%ikwV@9+Ms3vsi
zB}``i8m|$=#B+j7RAz$>e5HV@s8L?KL~AuJ=Po477!o;ECCPHeOzr?H6>Ul~!`cJx
zu9mG>-^m|oB@6C0Rp}&1MP{Z8Shp~c5ItmlFHuT1C9`9thhC1EwVD$dIU*vMwk^Y~
z<$p3V>y&*pmYub+ePx?gJ4eA{J>hh|GHF#B2u0n1hKV^7eb3F+O$W&{Zs`2Uy12Ns
zq0UU)t!y{}GZi-<@jml%@zrz8M7jYb6JImRcxnsJ4d#R}U3Z#%vz!s_Flx-SU#1)?
zYgIB+xhQh&lo{uaD%xD<bg_KDPb>)?Wp6IIDO41=mDPuAT}|$?j65gk{j*c|<QXzz
zt%_vc2<JwdplFJcmWXP1Mb2H<C(2zJT*JKFTRYFMs9B?Q(^`YC)J-Nqp&(&kp^<?@
kAVTaq&M<O+YJee9*ZDCL*Zx&Zu#7$yYqh^S2_$U*0I=zI_W%F@

delta 9807
zcmV-VCa~F@QiM+wcTYw}00961001Y101E&B002>7krX3;FaQ7sj<HItP)}1YG5`Ps
zH~;_uKL7v#U`o?T6=Q8-Z~y=VcmMzbPyhf1yrcKBP-kp;W&i*N$N&Hw2LJ#$yo2EB
z2xw(tWB>pn&;S4cEdT%jHgjRUuV`pxVE_Ol000007ytkOBmn&Y;Am}hcmMz+7ytkO
z5dZ)Id?A2;003-nV_^UQBP;*_0F?j$0Ki;@YHn>|cyIs!Bg6mz0384T03ZQ#0Nrk3
zZDjxeBjf-80YU%(0>10a0*7#Kb94XzB`5#@0$Tt81H*xmzz%qvbyPb~6k!xSGy8Bs
zKu~<4A|fgx>WXjF^))-pu*=Hq@LE_&NDM|ph#?ez##mSyLuIUug@u*1F~-8$_zNto
ztSqdoJ@?LxJ3A_5_WR~O&V8LbFaWe7j{;1~E>EFjWodmCJxC+?6Mg({tlYc1gk1DS
zU0Tl^jBGEuFlhFgd2`WRGvAsYQjb&5QXf;FX*7~9q`zmDGe5BngQ(yEHt+_Y@D;y|
zPGiV_u#CE~ZfqE@jrYbE<D2mVJFpd1IIvKIjS_u)xR~Xw#?!(KrDfW5Hd$FH@)T_e
z)6~?l1??&uqm_$s${m##iFbjzxObUvV|>bdGtidsEAyP-ZS!9m@t!B%5H)eUS$LRa
z<~GhGG!>p6e~UOrji5+<4y`SoRh3*#_;`AMI@Gr^hvqnfwt$X=JnGq@f7nZ2g@ioF
z)!~d<6Mb=sbO|krwh%+u#L34k_v0oqe`YX9b_5>6lpDy>(hFmleCxw?)+n|%QDzyV
z#K$IzkAu`lbN1E$BBRNDf^vuQ6l3?ZvwMi)QSNc#0eXoR^ZY+ai)PIgdbuH9icgh)
zeYROwH%2jq`*?!qc!jrkhn?hBE#!hj-x8~Gl{>d}I=;@Mi?MI96CO1|XN4o;ahyGr
zb4-7QnJ!s(Iw1}6Jit7qGGFtlGn#a#fjhvrhSv$^?dg3lYnY^mRI{B=qqDs@%h@{0
z(1|9_A7us&dBkZ!kgXqQHm)KJu(A$+_472RBnQ)+h7)qQ#NGu_FEgskf7!n|%|6)E
zjB+QC3nT0><`Gt4lOH*Ddzd|{V+~L70xyZxrjcz%lwEeUKQ2+b8Ka?TRJNOP!L=x<
z=~f2QZD+-v-hJXY%G)A#sWd`~Hh7eoMmyWW`~sHu>rFN+%bpZi?H#P*A+C{sB{uaH
z>gwV5C%z3bL0h*l*yzKI>FPumV{FQ?lU4deY{=@?i2X6%q@qcF<x*;sVOR3JE#nbJ
z$Ue!*rQQ#}HpzPW==ndJ;M*|FI-?Fw)2hbbyiUt%n${_1DGV-!STgS(>{IWc+Gumn
z$7BtDb?KHnyq77dD7UK`bA}NR=4e0v8*J#>Ab6Z(U}1=2lV1cSe=|b^kju@`4HjlZ
zQ6vrka{dQ)0C=3W)K^mzQ5=TxClG@LMQnhA0jZ*hASxmX(tGcq40gxf%e7y4KY{*V
z-ZSGh7jEXaPtIntdp0{Kz#*VCTn%|B=_MEM$aTlj-2U-Wj_x1N=L#`C!C^`$&_Or5
zyy90j{O3;`_jr%je_3vS{BO&}cl^3Ye~hPD;Sr0hGQtdFY_Y>AORTZU22)J3&O8&$
zvCIPF%u-~VhjE^gm`grpT%aswaU|w-jB<|0nJYL+C8s#e8P0N!DypgBJQt{?F0Nao
zo(3+_NE6Mp&`KMZY3EAZUkBId<T_n(2RG>9CbzgvFL&tUe{Rh99`_kwkOvGg9Jf>8
zVB55ID+l>T{5q>6Gh<sjqw%Y3ZcI(C&ri%PFO1I?w;vwx;{RzY*Dn7%jds!VH{ES_
zvXVZNM`15n43Cr5@FW=tPm`JOEEx;WldbR~*$FR`(eNr+3a^v3@Fv*|Z<CGiE}07N
zlgaQQSq~qRfBEn!nFybgx$q@f4quan@GTh+-;>$!BPoWT$#(da#6!+<rZt$A7;33$
z&1QMiy3G!m)^k=c)G|XoY^X;J^{8o`XU7b+-1M}w<A!>|P%8}eq@h+C>M27#ZK!7q
z^{k<uGt??Wtv1veLp^V(7Yw!5Q0ol!qM;T|&myZgf7Av;y=173hT3GP&4$`ysI7+D
zW~i49wcSv!80uBie{<GhT4UKYL+v!w>xSB8sNJSDncXnd9z(rpsJ9IDwxRYK>K#Mv
zGt|3=+Hd;T&+ZxOeM22E)ImdiV5mceI&2L81?s!r!+4yXd)bm4SCU=aJ+@pcBcm2n
z6_80}e}brCExD2as=)3hspbaK+L~w%)iW9!6Dg^O>fwXX8Wl#;i_G)^(m&`g^r$zP
z>63JhN90lf$YwQ)jEsnk<u2~W&vCyQsfho+i=IclC|de(sE$-Qz0#xM#b6l5qv4TO
z>YlRdo;F6QqkW^kQd(=AQ}>KJ+&59A<r#m%e_t7m@sy@&DS6IgeWjL{`c#jHp?|DG
z5ypcvHD4~Cs?vBo#vA>mHeM@Z4Gxu3=5xG7DeYe<YuuOGdZoO@RoWVz;hSd)S7M8Q
ze5;Xn|6TMlI*At1FYxyBi(yOqP?Tsuznm7s;Cshvx?If8)NnpsEU(m4HJ+X6&@YSO
zf1F3tvZ=y}9-XP_)S(qI{!cw#*j3u7zfwl4t~S=EY+x|X>xar1y_@LR=~$;$J-k-R
z6^-CSj*AbJ3Tz-Y2Y5mrd>rCZ=bao^HG?~Gu{Mb`-PL3FGI|hAq9@U((KqPBps5el
za1e&R*MF?aUWx5wxtK4flf`U29G##8f1~lR#Gs-J>_E{{!|`Z5p9bGjMcJP`RdXB<
zr(1`(b8eh7eHmf24qaKG2iW7#tG)`(aPO|xjbp9f#p(CoQFTw)_nuxIXnn1`cbE%n
zKEgACwI3OaN4Z#~e0VVGy`jwIuRGWbF<{upzxDol{$64P9@g_WxR4f?kJYg{f6^1o
zkAAEcRd-HQ7@$Mg8=>>~J5(~Mn8=oz&#o}dnHD>;V>Cw03N0L4d9QBn1WcdS&Kpdh
zwrKnC=$AudF{6hsl=%%BjxU@sj@GUfPrwdwhgKP8(z&Hl9}Us=$0lgDe`WhGqPL?@
z#Dnlx^!j3bn5`x4?NXhpVQ4Bif5IGRF45?4UR~B-PS0Bk=7-w`<5N8!iG5BU=V=FT
z(6*b0#0A?(LaeNgO~|qYE`d%qmCn;vhfNM9PE2Z&cC4Jq6Rloom-cXDZ1XM$!X{xS
zK_@)C$7Lan;dyvOZbHa*TpX;oFb0lM-cGU<R;)I2^D?>{&7$9mXS1EOf5&4D-&#D?
z=+1mG8lRdWdwitWe@xFQ<_KQ}KMV!D4=zX(gdNfg;fkk<vpBrWduR#l$t2b_I(etz
zT#PA8VjIv39k+ZELXvm0Mj8@jnyozHOy)VJRy7)!8}4H!v9DjMH1VO?@~)9OmuQV`
zmOJ0*#};Ovq8Z8FUXo*2e`D89T6coKBUrY6Q2kJx!$D-%{lAKSAAOHGhIO{!j>i?e
z^{0LIsR;f=4NldW9u0t>GV{l}=ueiH3PYsMkJJ?~ux#ohHM!E_w7v2I-(M_f85pdR
zUfSbz^YQ#th29Xh0JBNyKs#M{moeUHYh!1;%~F~;Mop)&u`$3>f9v4=uI5aCZ!S25
zFk|b9tgscjtTSOG_(~L4<}JdhzScyxZreB_o>A5U=xyfR4sLJzxCx7)kpOuCf4g)g
z{XL%uMAr0uXLdDlTi=l<oM6Ah0R{dBeC+daMqH$dGyj0UK^<oRZx_A?H$PM|RB-ay
z_yW*&seoHoh%k7fe>Qi~ySqdseGgCn1Dbgk@8v0ehX&p?1d`2MmC-xE(O*?4T6md`
z37iU62mcZ??Kd^O5f(U~EwA)43<PqfPZiB`RQ4~z`Rw9J)@#6K;ClI;JZV_;y3xyZ
zvrj)tLtGSX3^-6dm0?Dd7-)S@H<HeEiVIuK`kw0cG}YZkf6{H{n3T}YLhM}H&QxEc
z9R?p(_f_Gu{(7vQBP#dVi=jkQ4c8gbcb2r7FO=$ZFhXcR6aVn?Z#!Ly$~e_(Hd|uX
z(Pms;M7xNPkD?Da`YqkW1CKf6f<}yd2++Fc8S=;T*;74R7MLW>nbDXIabPsyL_M+A
zwD&dV-h88hfAadc0k>fwc%ao^6EN=qDruB#gQ+4rqPaUbbKU}DFaXxtcl($(1k~`6
zwh~X2e%xjZ(z@W>7C3XFJnxU9?fIQYUq=5b`nS>#%pmX|Awm1%SP@5C3TKa%%s8C$
zsk%~I!#3vhBUJh#;F=!pUoIxcdI@Zr1RVCx^k7NMf1bi-nuw_9)9;M#Be0<v3~~%9
z@WMcr0AgTWXru2sl{i??D=pDOXAS9`dz*lp!F=<k#-Q!*Ic3urv*udxE7eip4Sgf#
z?Kw2YRSt?rED>%xw5(LS*zxIzQ#RnS2u>M5&t!PEf7{8M8jW9a41vBFUt=HIOcyuD
zjehZdfArz){DLL`8n>ve0AyqO^W7rjq?#k?ow5D?E!^V3tnTASA#PFo#aGd{u;mIv
z`o}^wNfywNIVO5EJjHG8eBZ2CYSQ)UTRG_D`&QTi`E0V|H~jG*Fh0HLt>|-(PECU4
zk%G{=IKoSMMETLBnk|;(SXGFh*5Eb8wO6Dle?$@q<!H-nbQJ*Ah_2QX9^*ti2fx6E
z%m`!BP7RJt))m@CL=Wjc;-0eCsdsM&+y%rp4}F5kw&sMlVxs_oAxS+#Sq=}wrj^+Q
zkrb$%g(L}CSFbUVyu1%~^=|Yxb?@{RHHS+S3`p$Kkc}304i>p`{!<D091<;_vEU#N
zfBd0X%c%x0n~nBhbqe<TrE(QruXvvN*wuT_9$?%_^ARrK+|6F%5VtTX7JLPpBm-%I
zYrF{ShtxZO68FLCG4ed}uzmJ=-v}wQXkF5T+u1mC3G@P)jc=vKq|HD8syP~c;Jwuh
zH%%z|jKouRS5R;^8VE4L15Ox|@gJRIe}c=dU<2hj(Wa>orNPDJ`r&2V3N}GgG5+n)
z1ZD9Vp+W*}J98d?Ny`PDwKJPzet;EuHu3KW-{`;!mquU1x05vY&3-c{z66&w<CN-1
zH$v8-WtcQh_lt%|B<&ETbB9M@9870{(bLg3SEHZLZ{y|Vz=L_H(a(2m3ujGmf9Wk8
zdgL>Zu~4_O(uza0^heZU0b87p#T3!x9*q+$|8>oHG!f~d?dc)W0%Yb*x^aGj@19jQ
zWIluIJzx9%i>M3c{#nIs5fu?TI9d`cipen%Cdli@V0dT|G)5SZ1`F;WZp`2lj{%Z>
zsw~_`%XwmBG!wcHY!;FaoE1iae|N)`gBDHV;}%7S*R`68)dNwTf&p2KPH5L`X2Nv=
z{&B8FepqMd0tmtQFX#nq-35daW8zrF*s2&?-L!EE{}+IZ{yF+1wB;23|GVh#qkmJ`
zzkp{crhP^b7+q=N*|DL%gt{6Baq%fIbu6e~(m4=m={6UlMlT>oPvI(afAqLGFN<<G
zm%z!Zuj00+1Lkc{pi45aLf`B{etA*@#4Y2pR-eQX=IcA11L>C{6@dF5z-<+2IA9I{
zF0y2A@88EhYx&U1NZ{#Xx|=7Rrn4|KBX~;RF-N-DG?34#oxoDHL9}hl)wT_Y0H0u7
zrqn4zV>L$9-@DO$@cb{pe=Pn}#Vt6Yi{-q^9Dw=EDY-fM>vVz)QYF(%%Jf=hpQ-Zv
zVnuH?S?x-cQ^7Aq!4JpP<5m||j~rioEKmo#IIegAkX|nx$79SiL{sa2#Wf3zn-GP4
z8jw*F7{RfsZ!WYbZw#<`fAclC23Z94zK8+>Ra!lUr|w~FNUa0Ke?y<`$iP#G+jnbH
zw!RT<BQRHQd&Q?uf5NBXLd)4=x+L=cxKm$sE2r*WR*8zq<j0)ayfv1d>hVatdOPOz
zq9a6fLBf^>YEPf)N{OH8a#C?W_;T3-O?+(@es9c&h|9WYyhmFz94QFr7$%n6MXDFs
zW>jD3k9ILMK7S8Rf9XU-XBbEyW59OoLT8H)Hbb?=#}1;4=yCM1_+yK@nW|c3B{2EV
zqBRtB#m=f2{Uqsxgl{x)ViT8@y`REw#9TokMoJ0G*TEqKBZB2wf*x3v{u$Lmw`K~Z
zk1>KZ2wSi1;6FzHCHf^;+Mk4@0V-=rOsts^Y``&Q7wGB)e=+Aw$uR}<glNxX0h~xI
zW<Wq9C<o8P2w}Md&DR3cPf5^7>d&xC#dxA1U7i$(wj61bc4)8Krihw0bR}u%Tg<2=
zd6H(Km0+xRMb^#Zkavk6?X=SlIb?PxZNd{;aYCHwc16*)+oET1^q=7ru-8vPTx4Da
z+8NL}2skNFf238Z<UAm)CGy7Z84G#?`p&U)%q-I1@c#l(XPQ86Ob=8YNpq`Zh?6+N
zh^A|s$)mk!1QzopxZEG2e~SKl^gmZjn6XEMn#iApj4YFXP1Og%na_Y+UPi7WwpD=Z
zZwEMxaUI_%_e#;@!|C<`A1;|3J;%eF3X@Sy>L_ftf8lDS{vL1u66=^hGoKJ!z+MvN
z9{!B@I1>oa06hKGX7{;rmcxdaU>|c(9U}p@_g3$`W}XjMLK9O28}LfYGy&g^>+mYq
z0hlyenS@q0AXO4utpq0`5G0;Ac@2K`#}VI*rX}<l31C*{86S<!E9-djgT#}wXbHXj
z6?8m&fBZzmX(2W}6>&=89s0$wofg#uj4m|;==lk>*8IjS0HDGaK%KpYSi^CQhF2(K
z^#_^(&NlOgaBQ=K(;v{T#z!%8z4tc*8U)X)9QT8*{cD=|H}V|C-4DENW;+Rax7J5T
z5~cLlilIig_UbVz>TDC^ME}k4VesReuS#Z1e{rB5kNNmb;eiV7Ia~Fa6aut*{$sU*
z$wczcu{fgXY&7I|_#55SkVi@qln`+jvpGR!aiatxiV|V(@Q_}=yJyv^9P)~`ymN;j
z09)R}iK;&0*Zpsa%ACQ2uLSp@D*J0SAv`O*a&r2ni-cqKtaJ8jZq)PVzvJf-llynL
ze>vjelY@iD2L~_e^EkEJIJl_4J6d0by|Q`GXdY~0=ga8p=zm53JNmyeQw88*z${Bs
ziSaUY3i~aYlbV3{_Qa+qSDL|n(#H;Iu%0cJ6+oYA$<%-uNw$VyPZ70TOhK@vRwJRW
z2M{4e@GS$WeWqup8gClS2w!Im6(c-de_o{KPxW*{UAploCZcDO;X#vVU&1y<i^m8E
z)R@fL7$rq45op@scET`Is|?(@$_FNP$T^KrF6*JUfi_TRqE{tP4V+M-@Iah`q)jO@
z<4jITDhHAfj^n6d`S^;i+r&!#G#Jecw~DO+;Dfuy9=7CZPTc6^S}{4#gi?cof8H?H
zj|j_$uqvU+GKiIE6wiC6$e@1NM_?G?k&%Oqg75@QW0l8Aju?;hF_TX+3YsFDRScYV
z(p2WR0El=I9)XrYe*-&N%>r+hOf%!0k6nm$=6&Vg7@Bxp2l)Yds)ZOOp2Z4*<loMi
z5C>#|@=lMcrZp~&{>-<E-Xo=6f1oLU&*sEq%*;h6X*5USc(n4Hmr@&h4@ml1^tVuK
zut_b&gMmah5^ri5dDVP27M?&=6V7R;dR!fY<V`NZaCrri+^2cWm%=Opj91bcW0q)`
z=b=$i$oym4>Bg)T#c9Qr_8QoP5PQYMivS=j#r5JmBSgkUZm*Q<kQiAre`YFBH|9R!
zbeOhh>5nMM7{w%=10DBy!dMq#8+2n&vSlVsthX*MGS4zv2JdV+pDCZ&6fZq$5DdZ9
zU4qf?uq>5%M=D`_5@RP7Qb!_~%am-!urC$HkE4GXeY?p6Rk27Y<e4fa7)d{b6As3g
z3N)Q)1b42;<}Gj7ArS)_e}A)rWzpwftLo$P6$5SlyvweGHM_?8D!|pdxi+Qb2(iuJ
z+;o<cpL^kroC&%37q@5Ph#n{EwHn5WsEk`Oau!bD+#UF7weuH{a=mrC?5I`j{XY5>
zEV7913Zk>lG#ZY|H|!n3;R%AUspB{9exd?^3<$s||JvU6n7$Rge+?bL`UPtWLpqxz
zqpnzOSYphi3eUvUD3oEm3^cByhaqlhR=+3{Xlnnc)CKrpn$ffJ*teP~@vGIK29|`k
z4K_=%B`bbBVM+L8KTWPLm_}&lo|lJaEBC6|fRv@v0lMzkEY6NJcqri0C*stx;{!sf
zw)%2Ex{RLHyrrONe>|3UBP7jPEn$+1`bB8Wz~7{K^Kr#)in3sUlN9T0IqlFeSy{Ha
z24rR4C6y3W4;a5=1hNqe9_gx(hajdZW&Eye-8CKN5lguMmnuiP6!7Pr9xu2HJ^H93
zaX@xH2+@qV@^0l|{8(|K?}4rRH7COGH>H=<XhMTP?8)o%e-4A^7{)l3WX+K_f50=Y
znBW2Ejg33JQYLy;=RU3TuD9^6x+W(X6^M<kquJ<ozU9}87L@6k)xN#0dr3*cRCS51
z-8GK<08ZJC?g3+k?GK8uO8>wne){+rDoL2c*Q5cT|HRR^oX9FA^Xks39p7QhA4i|a
zIug;}Ug#Bzf6t3kDVT{_PA9T}q7VMnpDY+WC6zD9KfwJ%RkcnO9p|E!8uR6NHhi1}
zywH<Xk*6>}A|{rK?|B!KF_2Ygavw?fxsZY*S+c5u*xmsZIrB_BxJDP8N%BChLMD?q
zMnUg0&X)~Y;u9O=nc!$(JowI&+^FYF8;T%XOAj91e~5crRr6n?{}KJ4=>KiUy@|-C
z!Ke;gB|{lA|Frw95Vr|v<-iwG1Q<X9PwC7oiBdgRc|BR&FoK5Q#}GVZ!HNP#8~6G`
zm~DAJ75=P2s5OYKeq&S}&@iTx{&sA=QdI4uartU|bqxKc;&T!;Wn~Ne+|}{)*(!wg
z<Xf$)f9eGFwiP+$m@awk8?Z-yV{@s_vfN+o*ppWR_K!3`yElby=3h3USjlRmb(HSc
zk-34l|76>4e4{E%)T*^<WVO?N6BT%^4Zzf5LkYID>Mo+!zgQ{v8$~m4%N|ruDM6sh
z<#GX*meem)dl3p*=k`>KP#Y$yV&Juig)U#he`_8p$z0xlunXc{W3jMt9p(=ozNjv*
zC-ISU&8#0+OPkn>_U<F>-WN2(DBPzK#)*&GccX0`S4Iz`_oLs`>yo4o)tV%F^{K8B
zY@X{^hzvBrAj^7S)Zv2O0ROl^j4P|N1*7<oB5VGn+h`fn@Ak5ekCjP%yIp0`T$4D;
ze?8O9_OfQLn=_Z+$+}qwlM~lxY$xyXs+S66S3lDsfi*af9gC^Um~0`eNwN&!a=^^A
z+NCh#nccVfCcQ`4adt1-tiyU4J*sl5LO4PZRvq8C7@{$~6GxLHeasbRGr_!CrqEUA
zR1K3SO2-Y1YC;uMWfml81JW)zosddke?($BO7PI#6Dxft!Thspok2A1P$C)qu!`ZF
z)rS&=RS&d-hVJPF2%f>ycpu>ui>3O3y0O0OPvCBsH|n>-G}jf|Do@09L|mR!vr?dc
zk8r_kpRS9vrcZuYtSqPC(OYbGlFS%kW=TR9hUhym>vF6Vs_H_l<avnWNrK%Zf1&Sl
z85K6s&0NQ^aKJa_I(|H@@oEAjtaBZ2Om7^nkCo&)zFucVRw<78$@Auo#7D_o$0j}u
zqF*6e{vG(wpQ?6>mmJH2y|v|Bka~=(D8N8iu9Q!`xO6LCkP;p%;B+~yR(h?<g7~t0
zlTu2Btl6XNWaaL^H{#^qn>~*6f3F4Ks+#xV>XI)~qjsN2?Od%Xjkf*vZ!0vMy}ia?
zL|lQsbPEQxWGcRwMDz*?D~hzf<OEOY?MkL!m?v`+^i8$jenm;$)KR~<y^b2TU_2{B
zy`^$0xDpEC;hws^Vmjz_naa6WFP7S@Q9It`25VPZEi)0TJgdmC>SRxuf5yM67n_W;
zzE^*cpw!9X8&yV-WH~EBv|8)SwXPS@0vzpqS&c<zJFJYpoYow7{mF_IS6$UBONQja
zFwOB)Hf8T(JcUus>A+pudsk-hp=@uSFx__hZu^{@2fMq!&39iIl{-7cI2|*7A6Hud
z?$ElNNWg`a>LIRg-_09)f4zJ+TE~_jB%g2^%_X+Hu6Rg*Lhs0MeT?VI>hYx(mL=X%
zvT}v#A8akOK|n$WIsHd2tkc*MvF|{@(*pGlAn1`mkQ$Y-Q9EyG9aH#p2tOT0h*<bW
zO-|$?AM*jdm?<*#r1Fj51oB0#n>&4@cLM1J?v|$*6?ViH+zp$4e=qv*_6nv_)oKJ!
z-w^+Lsl}~Ke6`$y2*A~XM(wQ@VBFH++sq@mG`?d*GPDDZvap#~_V<hEx6xlme=93U
zROJH&C{VQ^y;?Vb&R~|I6i#TWa#~hw>uMt9{7jZ>&ugwRJY=nRgYpYW<h$fR*doY3
z*Aw=seR-hYmo0T{e_yDj9N~(Cge4@??~jV&)1tU$;cVA)O_0U-;fh@&7wk%6tUhKq
z;|XRgSr+g-S)|2RS&?SNy6@k?s(au|XVGlcca6R;>!s(6SycsxCnwd4xb47opDo3^
zn^mz1(V<fHcxg*ZVcm_h>?F&6z<K|1rB=Lp#+}U>42zsOf4~39{rjJ6&&v?Z<{6^Y
z#^1_`XpA#eOPD@_Jrr6kTVBgTtP*zMcJRpgIu89*7Hg+U`o=817|Be4r&fD#v;DQJ
zKH4~(^!~hZ({~TGuCN5wR_(w+Ju?xus?&mSNalij8cb5%3pbut?dICe>bS<4-F}|z
z2vvFoo0b*2e-6cnd*y{J?V&Y}XJeWxuzb2K&-+jHv>@`xuPDIZTS_MMOwBG?qF7Gf
zX)20M(6!H{4VO~RRgES?XZoSDrg=AJYPcvqknX!*T;t;SQ_OfJNfBtZI)nh@Ds?^n
zP^nAsl|07~gx#-WCi_jbT(^!vpMjBdtJna3p;>WVf6UI{UhFc9j#}yr`V$-kN&m=6
ztG00KF5=7YVAcQOXRO<&kJGrhc<DrQ@0|5x=Eci(l||A4Qe**BzFA}`tHk-4{03w4
zGgkFy%xp<*)#wocK&ll!v~u_7>LUei-PwUX4t~aZ|EwK++yn-axUl%*v;C|Ue1}yU
zya+GVf7T^7hUI0!)untGqAaaaF~f^dH}H|ah4__3gWLWZqI`8lHP<E&$A7_(Ai}Hb
ztN((ZK9no=Pc6We*0QW;<462W%YE3;zmEP$OAL}rDtb~bEsmA^^Z{y8gw%Y&BxluU
zQCut-h9z)wK9W_VMH3yr;@T|LGG%{S%92E8e@xHRpj<C5hx+N{K9Dvg^c!=?UlMrJ
z%>fO;<n2`X+@;nVi@2C-*9-Eq1(&vbV2Fo=<PRIHuYN_Q<>y*TR#ig8trw%4+_jR}
z1J(|zylF}?ZW^JJU~uyU0mUOYH9VM*MX!wwoC=rmi^R%cSzG0{Wa%!5F^nvRyDv6t
zf7aa^k7lAT{wexzHQ&R?$**CyH?r`Bk%q;s!OcxMx!7Dh#in444O^ECv6&OpmSNzx
z7pSeN$JV;FUj2Io2wVR4iH(=Nq*^xirZ4stKkI`k<yK$y$~nd|BV6+Cny$RVbNf7Z
zt<@h_zo{~-|M}~IH=X7B1pb3lej{0(e;bE|Osp(5F!kz#^-{J~9_OE7#YfRe713E~
zzVQ8HQ)_3I_|FW+mRyb%YW@hI1n`d#@_+5z!GYM20ZxBTYB=N%Xl$p$_ja1H7U=E!
zkYv3BE@X7>g*&*z<;d3Nj7no;Q`c#0mA6}5gVB9(U;VPzXPMTmaGp8io%)vye?xLZ
z3Jj)LN5g-o27UQO&mCCc6DEMaRrmV4P{2=Q8E_Q+e}R?5mjHO2V_;-pU;yIa7cXYS
z^V@u7;AUt53Pf=}-iJg3K@CG4kmO)s0&xIUf(rHk004NLV_;-pU}#`qfRi;0j0~tC
z9snil0p56=V_*P+hEWX1bOZp;f6XC*0001ZoMT`B0wsn7h69Waj0>3fnEIGam{XWf
zF@InQVfnxs#@fL8j;)C83A+V*4f{Ke22Lf;49*=~YFwANSMV6|RPb!#W#d!f^W*!#
zU&sGJKtrHUkV#NSaFO6Mp&a23;a4IlA{Rt8L~F#9#M;ERiA#w0NU%sWJV{)TOp`nz
z`9f-nG?(-`nH-rtGWW=X0N5`-e*gdgc${NkWME*3XSm3~#Q*|KK+FYZ{|ECK04JUT
zQL|+wOaXs)n=lmht%(OFX_Ag~@7>ao?!EWkyRN{`SjQj{N!W3IeFd0~bE;3A$Gh*{
zA=TE^%7fbfPZ#S@hl3e3&_oMuxah#cEatEt^H{(lHee$*VKbJn1zWKV+pz;Xu?xGg
z2Yay(`*8pVaR`TT1V?cU$8iEaPT~|!;|!K@7UzF(9v5&Cmv9+Za23~Z9XD_jw{RPG
za2NM*9}n;lkMI~z@D$JR953(^ukadg@D}gz9v|=#pYR!9@D<<i9Y4^;&zctwXr!d@
zdvYuqdL?6uoG};FG>YkgzuXR_9QraP;UrRuR>)NtlfT+bc<9T1-$~<4cc#@eW|Q9&
zW9omKIiolek^RMDQpQag7bZ}d9#jx*WI9_x6psd`ZYO&s6F-$>QuEVR+Z7J|fJg4M
z(37T<GC^?(bTUn9@vpglEW;u77In;fq_jVfimypwSnQUtoMOjH3%UKaq8%>!((5t9
z0;VaKSJ#<n_qiQtXw`TnERe>?1grB_uFQXoUsmnHmL_Akh_sVC(NOt%)3B^Yr2cr6
zX*ZFIx&@v3kS0zj(}~NJlH(!=uWDshk&}?f+Ho#0$l|~)r}?3b9L+}5s@S%3u|-hL
zSVq3(weSzUTx$ik!m1rQwlR0g-Gz%@D1|mE3k{c3={cv_%5y%lW;O+xu~fsEf?``c
z=U)ix6t^W|%GzGf<C&uJWU7tDO;}1uYZlp1%i>B#I$!813W=wtu)9I_4w9NFf=7q}
p2qP#+2>U>K7(-(P85lT>eJBBjNRc2$9}`4aL$_A@1(Bv09{^Lq<YfQ=

diff --git a/js-packages/web-console/src/assets/fonts/feldera-material-icons.woff2 b/js-packages/web-console/src/assets/fonts/feldera-material-icons.woff2
index 199c0aa8dd6cdb56c09538e15b99cfc753831d49..b1252da7e27eed66dc6190a55cb2f129a7d9d9d8 100644
GIT binary patch
literal 8548
zcmV-qA)DTJPew8T0RR9103l=m3jhEB0942T03i|p0RR9100000000000000000000
z0000SjaUX?0F7n}_;}qD0X7081A_<)fkprXAO(d!2Zv}ISVdI^g^dFNHq#;zQAMg7
zi7;84mF)j737m{^)E!?X)VU*aZ$W9rOm{^C7TiQx3#%<GY=laePUX2Ydtfb=J<+>5
z!Xe6c*j)D?II&~rZP%P~YU~Cn&jWBjd+Qci`#9>V!ue1>-J+Wrqyo%c&SUoI#(VHh
zwW^U90fGf8?o+3ZbN&CPss8VC?!7Yt*SQ0dDRJ&dhSpB=M-ad_iX|t!WJhv=9CCpI
zjvc4u*6oX%_n`pjekibukpGDD04WH#d$nbjM<p3%kYGwtAXx!$<uCoF15=O04R0l`
zua$RYAMgi)wYM(I-lQ{WcaI>YPeJN(5Z>`N_5J45zIs@AZOrY-o?q6S3<47iM1*X|
zA#l2S_&vk0cL><UV8IB0=i}Z_ezPFEw%YFaCIJaxKr^24xBcAnDR`4krFNig<DY}Q
zQ7hyPB&J=&Gyk@gEf5i@^t4RT-Bn4SuHef|nE5ly&U|c`bvVHiV7PtEuFn!I=7y{p
z5LGX)x-?b1PTM6_f+(9U6D9!S_QzOiQKNlG72lba8AO7ph*#n){k{xbO3U8$%0#qh
zPN_s832$Hf6d@ojuS*#HDn<9)_U;A7p=5Rl{M|n^&wY3st<g%z=?&pO_51++lCjBK
z(Jqc+Qv9d5OLobj9F?Dx&&oH{IqEJoWA(r+Y444HGw+<QGE$nRbS90_f6^oL8hw#|
zLVpV>LX5T)#&R+e;Yt~cV+zhKjr0Orn3zLfn@JdvbsFxSZ!uEFEzSXc)`62!I3c6N
z_l%K%x;auJipJ7}b9GT`b#;~}#Ri!JB~SM`!>1YL>MbWnX3*8$!c~OxIDK_x3R$C|
z9(%b>*0sePtF$G$Jnx1hV|vb|oJ13_&oxViaZiqnkT@6L&|=vuT6YYnB6eB50fnCw
zKrYM)sql->E3~s}yL#r&O%FWz+6SG{&Ss@Z!;;%7uS1pu&4c!+{b-&tvbajP8pu_q
z#ik6Glgsrmj%2vVG_K8;6GMndy{O2Zi>LzwZ1*jfHIKLD4D|4(ucCWz2q7xWL#t_e
zWv8{~wmHmt1y$y@_!hq`HCS)w7$uS+&VZE_bOR&-xH<wY*HR6CxrH3pL@n>=fiJol
zY+jsJl%*z(J83O0>@+=pYz3?hNgL$Igk~i!;jt~(^7nLv;~0>gOwFbMQb?XaN&>nR
zFLCb><>jE5;|j7C7~A04qIhY(Zvf>`z{*i!IaxFtgLVR_i%&HtHrAa2s6ljc!~2m&
zX=B&C@%N^C^3*0bNs{5+wI&MlBv+9aj4FYRlG!?K#B@731Hie;Xt_la*K(i~8%3PO
z>Pfhb@?yQ(y8%#Rs5NE6DWlIkB(qL2aW#dSd`>g1uCsey_@tlBi6nWE>pW${)=io>
z;q<DFyxnFx*EZgP%a|>;o%%bWY2oMi7H_3$p2$D40T)zOgLWJ765CBk&UF@N)-DnH
z?tszE8SiOWu>{O4)@W7gr-NNzq3fW4x6Ol6_1y=k00<)q$y+R6Ub%<=<z2-u$oN0)
zorGSk0mOg^&;+6&-1r+q6=I!DN7J&7#Lx+l$L;o_jG~{%z6AZpj?qK6Jq_rjWOay^
zZ1HLXcaYcMNap-9xA$#~f>jezrJFACPDD#p27IGu1q32QPz<-;KaC1C4J{o#10xeN
z3o9Et2PYRd4=*3TfS{1Dh^Uyjgrt<TjI5lzf})bLimIBrhNhObj;@}*3og3kvMa7a
zC?i?1Hh>fV_xJf#cFW~aY)~xKf|oayB%M|RH?HGii7X(xvF#MJve*FqH~~kUeYy?T
z+4-$l1!pk?=Wz@!VhvozCb)`aa2+e)CKli>w!nQXfrr=wk1+;MF#^xA4PN31yv7W?
z#RR;^6nw-Se8xKXie2y>72qch!SC<^1S+He6oCjNKni3)4wQg0Pywoe8lV=a1L}bW
zpb=;Snt>Le6=(z6fexS(=mNTd9-tTK1NwmhU=SDrhJg`a6c_`>feBy|m;$DO8DJKe
z1LlDRU=dgXmVp&u6<7n-fem02*aEhJ9bgyO1NMOf;1D<hj)4>4RCN{@;$SA^kAJ9M
zwUszfj(iOi1gxhQNQm?>MJ!Jx$PCxe6S)D4Y$1zZpkN<zU`5Ca5eP~Ui@=B#g{mMy
zPqk@B^?9YRTscQ)1Dnyx3cgOmEA%wyCo6eRa4mPfVI?2_eskkJ*{HvF@3j00KcFk?
z7P{3(r@JTkcu&^WCi-x7b5l>04p{Ep)8WzT+3~k(XaCA%dmaD&jjr<`59f&M>%1|a
z=X-~p<%w?VEAJd^JeqIjhg++E-CcjQCkF{UTzPmp43>O|gRDRJ%hMIN@^JOhw$j>k
z$a%7Re5C7Z^uhM=@&5GQWRPv#_F#YGo^FLEXZMC}*_y0QHuo%!X&o8wZ*Jfl>%+z|
z9j#9Nw%(h)w!XToL<y^<G&<)r<V_W-a=inTKm-X9fVA-&#<TpFeC-i*3r1KPS-L!p
z>}+iJ)*~cDw0G6q7=YMlamFNi1Sljzl44P-jhw}H1qhjq0q80@YX_Br%W5elcg|Br
zj4|NxFg=Zw|3{>D?#Yc)G9;9Ry;TPhB8wUzF#oKYb9QDOxz=Klab}EC1)yimf3DiK
z_7X9qM3(p{UGPXyXQDs=rj=ypZ8D;?5|>wgbaVFJV<!5j(3=uwqyLn1`ww)=(kw&<
zSclcAL<s&qp#(hdIgqFB<7E;;UKT)_;5j9B(A+uAM=2t$q%U77DY7GU!3p7RRNglu
z)FDLjvI0rQan8(ci~6n$E^h|~2|=V8fSLx{g{Gvkf@di~1f}=<cv-KBj4*Z9z<YPs
zhb|Fui|jwKpWoXPU*CoV6z%;^C)M0x(+rhTO5mD+E{%2eJus$+lorPFZEL_`naa|S
zocC`kG&19ndHxgU++S+Hx(o@Vl7uN<CgLHu*7b&-a-cZb`+8#^<Cr(!4guY-xU7gZ
z5&TYF5nL>!d0h1KinG}`dYdX556rcOoEx|D<t~`F7xG7WzTdC44B%9j0(={^5o>@K
z<Nu-<qM7?s7S*O{$;5?7s*Rp`R)FbcrcwpX!_^k5jJ81m-L9I5&KH&lC5cOB_K|FC
zRW^>IS$|Ha-!(}cGiP&JVwPQL&$;)I3DX8T@W81Za)hk85Bu@n?))+c`J55wk)KhZ
zD&JlL6gdlAR=QRfZVYERP-1p{%+9&#o%So}5{S%pB^P95CshPbc0mF{J5iI_b*#0y
zP0T2cJ+t-}zMrT{JsxU*3B+5W6HY<nO`ptNYRiJ0J<%Qr6=w;h6=`&+#3zmD2aMd2
zOPuS7Yjz$ru(OG62Tx3M;+RJQ8tR(oMNa(iYDM(J;DUw%R0;IxM6VXW1sRuTyDuew
zk>^qo?U-jSOB$r=1hR^c-axZ=kWcHa*=17KrqRk7@Gf#vDW#cY#0KA-h!?`}Xk=E=
zLoCCm_A_fkOjikfGa=-+XhrY{?a1KH&r)ucBA;H4pL5H~#Z?b;N_~I_?5&dsBH64(
zqyT8onwLh`gQd~uM#}9PuAQ<Ffn*jD0(B%HLWM+37rw{2Q2o@9Rf#~;lCIi%00KD6
zM6;Bz(vpz1eB+RCLSC1}3X0#5qV*2YB^lEU9g8INNJ!Dy^27L1h!<r9mqs-FYCai4
zPFecn&doPV&irgNTu2BM{XmN*Q~e_f?%}+wB^s@YU^SaqpN~YMkBd{NdE)W>8@Jvi
zEe-T55hNl?p9Q$@XhaeqC3<4a#^5<?&yAUgj4X&ck_i=}U}-}XkrEL^7V}*VxN0c9
zUGB<2RdXARkk_gmN|1ouJQ*eY0nu4|<`<m%OOC2`p7NsJ=$<k^h5bs20E#EH6WZuG
zKN~?-T01Or>qRgS=gDK(DIuulKct&Dqd<PuNPa@WY|r5KtFw{{1JduuP3|d;hFAlj
zbUocWIt#EfAL)16yV=7~Y>=H|h7jfeDc`$@#Lp5}{qAO<WM)md@QTi=rNmhwgkqYf
zUWvoPmz<$zVd$XYC^eA^C&s2DPtd3!S%xrQtMkRwUAx}xc7+J65h8LmT^h-*i7+BN
zRXkpoW@N_3#Q+2#2(vSjo|UK(AX<7qQj8r(Yf~+;Ejxj;Cr{XES&4X@&quGbXIEuU
zG-wGSvJ(}x2z%_qgsSBy@4d(WV`63wUNmXmk%5oKzfB_E^5oIQDg}XvS4XT80kE{|
zYa$7Z6*3D5)4Z5!?@$D^U)4lJLqq2$M1nHio$99z2=DlM=eO#P3i@FW;SijXi6jEa
zJtZ<C?FvO_LLi+HktODWvn-B?-}5$1NLjUu_v%mL1lc_a3dG*xZ)<PNtWC8o=+Jn2
zDzy-Pgy(&4W_VVzkK7BQp4M|Y*qC;JS#@xAC+x$;fDw?%ONayr6xGb`-fH&2;;bV5
zBo9II#EFbBL_mw?8{;S<ZGP3}exTFys5b{5dFnK(3*!JL&H6?!@_I}hPD+908kJQ=
zqVHFcC4>^uzTd+UrVaKnXH(i0q8S6gp7W4>EJ44aKESKCuJf|eY-R)|8qCH!kMC#?
zIXji$Hf494&E9@T+hUGq5?yr}3Q+>+6j@>!`!)?!uu=*n)mJ70+Ew$PtCBNLbd359
zOr;)sBw5t0Hlx-wrIth_6<*p^pZTN%?_?*3LkWd&l<;W0{2XTf;+ZB>EhK>5c6Loh
zOl0;?^PM)Bt^HCW5m8*k6l@%V#w}Px;<8iLq*MvHE<?09A%9?eq3ctD(tBIln+2GO
zrn1TodtNMN>eTzlLM5G`fb+EV(SbBdGO=k_O(R^aN<`dBWxruo;JKD)XV8A9$Ch|m
za(`xv!@Vrh9U1|iE)C`m+P}|ap|0aKi*bw$P%<;Y|02!(EE$L2N(e3>@R87V3lZg<
zpR{^CN(@Y*pVkVKIjQyv#_45~J((`-Zg!7iM!FDNenuHaPnK{_Xvqa|tit>s5&Wx)
zWQl@!6N~zEw3R3vqHFA%MZ>t(r;Nil;sro!e>y@C1+^7Xe}z0xgomXnh-8V9R1wf(
zYY5jSR1mqD=62^FZGoBSosl8Nt%P^xeC|#<j0AR#SZ@UacJ|ls=^ldJ(BnkNpqM%q
z0%TA@aKI0%I=J_$Ap+RNqoHxjw8_A5al!0dF3^mG(|e<KWIq6=EqrlKb|OLJid}|o
z*3zN-;uqEp=g0a(ujz<%!dQ<l&cNT2{;;?{10O~8A9T#~iBG3rvcwWPKt$-9VN)9n
z!H+>x`1pYMCv>mX8Y1t}o%Rx;z=4uGMa_yVlK;HYEB#{;9t<fxvci-D^dZno1Ysu7
z3XR{1e>Ng!7Y;7p8OqF6I~07i+BCLJ0ca6lGjcu*ojLh0e$g9BK-T_a>KiEyt6Mq6
z6mD#Glo<`KD9fxU8+Sgl%{;&7M={rwMOK!D+W^{whMoq<v>ej}=FiZt$KgQpR&Tbs
z8OtXocRDrq<OaLTEfzc2k%i+s3Kb!hx??a@Qdj%N60t=Gyd`~B6BYBFuCioGbe2c1
zH@g#c$*u}0Lz<XV{2>7i%jmS$OpWRgpJ10VLexX~*~fczSQnz18bhBRfGlRB^UpVv
z@+}7I(044Fh)t_Dw$bx;tY%A3!Z7^t=R_)xI6zX)X$X!BD(LW(W9P$?Q9LZt8EM$7
z!C>V?><2sY)2D1yjj3Ng@%!P%;RkN1&8%ulSQJQy8myk*JW#4CE4u2ZYtL<Y=pPS+
z4SNPmPG+CEuMM>$M-T>rL6UZ{q=1ngHCx%QvR5};WmETxQ7D@a=!?C1XvSvbUJMt$
zp?MQ)xI-@T6M)i?qjPO#-8q;u+~z{t1`A;9_D83UO>Xc`OWAh!NU*WmMm;1??DCrr
z`{N~!@eND42Z>RJb_YR_-FcT}hUm!6cS{f$zw~vZH!OB!9H%^BM2~jzzFHERY=3(x
zlg*lNh3FsPH?U$NZta{t*qd%l_a2<iUmZO-yzI!*)8?MG^vJS?md_1rYNj*p+`hlm
zf2=tiQ?ljt#B~*s%7lgm1u1qpC0xrDDJFw?>!ZcZJBG{Yla&6>@0170?0PyZ7Ng$)
zSzYM2!~9Slouh9|*EZY9!z0-|m~ngNoGAMLD+ivO%4?mUvU;MxIh&a3yT&0g0+~?`
z#+hi>P@%kaFrlMEOJgTg#`~^qQqsEpO0@4JiZcN!ppz-E0@^fxDebQ--9Q8)=|~MQ
zlYuuX%kt!mwu>LCm@EFMqFp{D%V&GrhT8t;xHj2utbu}()p#9&JE2A}-!&32b|8cS
zws11SugD0YeK!yhH{6?3kiTs!$s+=?n)A{nC>Sdvfjn_m2J~t?z_#tlGZ9Zl;cMUm
zk)nduO8;_)|93+N(5I3z#hW{U=jk#H`{vW{&?D;xJ_y9_O^NsW_1B+QidE-o2nL?`
z1UXhft8dRTlg?gqBP402Hbhu9N}6YD7d6MMrW75P3=Q+49vrqU<GwPqJKlJH*X&=e
zOH`jL-?sep&f+W*H)^$brx0CsV%g&I9p6b-cP%YQ-MOZk&w5^AFaR;JhS?GHDYCkE
zMUhM`sdej^8S{2(D(P=#)2PG<eEhK!x(uT7foluYA?oA)o40467dn-h+tr?H#|Q95
zr!o%FH4!6`t1z8PvKH#HE`?8F*(w};`K=hU>*NBjy`6wEG@neQyT6E-O%Baj$3##L
zH#(NXJAo<zur!O?k3s~HTA1H*2wQg2B*YA8=}7w4(WBoYLP>W*?w7Qj#8{QjvhEh6
zsED!juNYQmhx$4jLq0&3<;)*|da5E=t5E4fG#{}`4GlyE<$+wQb8E<;<6;qH*ji7i
z$b2?RVGB|btSldq)OxJb-{At&7OLab#hu9w$%pd)16VN8NTm@!wowuMUC|~$6I}q-
zM|==7(UET=BC-;dGNM(gU>g74`2j+YG^hNNV&$AmEF7Y!gyo}8-4x%Ejw{<+;XJb~
zu7<<6r$_e26@|RtY`^cJ!&btsyUY&00Z!Y=r*HbP#Sop@k<93%Nti4DenmX7zH9a>
zO;|J`!YqmAR5Y1v6DI3f7Aswn&B8B<G!IB__DfoEGD@<>@tau=a9WrQi)Oh~EQ^Ff
zZOO?fwSRIdkxr#MYsnOOL%hIDkxUSECFKZXgkybwR22an7y->#F&Y*+{&tVAys|N;
z^7c-W();ndnGh#HFYd0eM<)ZCm?-gogmg_(C%J$Wljc?uJO;}rqO&dLHA3g4+;>4I
zyFmsP1$mdHWUoA64~jL+(kmKc$*|lZJ4OxK+bb#IU&-4+ii191N<WMIKvdEu$E^Bu
zM#+PK#T{2m83rU%L~ypMSZs#_5*cU?%<hMMwnz)1NvK6vS9Ph>FHtMU1bg`aa*+%|
zDX(6n1Zm0V8NIKYV=Tr)6Ek6<9#iS@0hthWi#iM}n5^&*VP1{Y7XnDYrSO*|x$MY|
z4UHErJu>y&+~=m~`#f7D>aADblo&yALPV8LCDH^U>5`2~Y-gYr$ND{qicPL00;Mf=
zb|hLru#N5N<9?EL^-^f8i{1c`b$S<+1t5I=_q{=yv1-D;J*7@ak8hK*I_`r-k2-Kw
zQum2oF0++^>Xo4X&5#vu>0J8v>qP^*mdg#|{`MX(7E^39>DH0kT5lU^B@VIbg4mz4
zI~H2@!aHVvTMY#1$@{6Txq8&k?h1z3g{DAoS9#`pXD~H3x^r{$pwEgs?y1K`pTjnB
zfwTyqxs5dfIfn|&F?M$(0FrTqDEz$rIsape)dw{fwtiWKoXb+Ll$B3yzbf3jZ)2a7
zy<D;Q%7@qFO|tf<;plkDt#iI;=*H2%I=#{GpK8I%y*KtbwG&T#c{qx8&)Q1bvsWfb
z2YD%^C<n&YqL3AyerV4RWi;s2(prqgHrp{Y?WN;sZxdqFea74<njYVc_=F%P3LGu`
zvvWpN*XTll_C>;y58jdTS*V0oO?Qt5;T|+BUa2H+8{CR<9XjG=?td&q`#VJ-oZ_Gv
z@VS`*vIyY0^6ZisK2;MrOo0iMZ84c;#4@Wr!MJGRI@NZ-)sYpud2zR}0&Y3d!en^c
z_PwXXrINKn&$g;KNS_Cm{i{cxn?dT-?8L^W!lQ&u4pC<&G{Z8sGt|yIrRw3Hlw{ZZ
zZt%I7U8XhMqM6xo2exr<NnqE6(e+H;F;Ya%t|Evt#e9D6aHNUod6H{({$>#weS08d
zej!tKSSm3R$`<XjJM%FS-vNQjbgfwFf81z#<(u46B8TXfYx*g?VSnDE_1~wL1Ck(T
z+L0Z091g6Y1h{YKFh_8<i9TWKty4F}&%Tp0Dxif0Mfoo=)C8N7>WPx{Z0K~Il4K3#
z7z4r*Mz9n*<yZveRYH1Q)Lef#`8A`LYg6-SIk8&^DXtkyL3*jC>bPgEZtm{hx7L#x
z!Q}9uUG_OUl~Wl;Y0ZwM@pZdY*{i2jdvtXsECh>LXr!a`JJ<YoLXGeym~auu=&3b1
zky|sE<J{mcc}ky)DXdlQCj600rTl%JV$%9lt%;{fE21T5lri&<$<F@ckZa%3fn`kV
zx@xd?RF!9*06|z@c6Qd@OiwEJe|E?f@gn8~QIh6-%kf;-IaD@0w^V4WyX2M2Shb!I
zWNdZ<t#sfz*`jD3wMHaWN!Fvn5!L^U5pohF%aVZgk<MYQ*>X@jq7_!Fj;(^sK~34T
zWj7x!OqB}b3EAu|g32&EiyE(e;OT4U^%IMH=uulWLe8g$u5Mf#6B=8f1%_~<EfjSj
zX`6QI^te1e(dw5G<UAfBNh9pbCzm(GYH|fu9(;1yfqK`4jh0++ZL$0THPDCU^1)td
zHC!`Z*!j>6cFXP`)o12gR?``ECry2ZyIA)*X=EzrwVZm<kDiN+-gi93SdQgHOyml+
zxNI7)h6ypGI9uNC1x_8RXlA9myR~9A8Jx2dx<1a*=UI|8OUWxFAgs7F`ax+I^G2qv
z!A&sQmC)gJZ)cEV<c3`egp2BTw>xOkQ%_D_mmL1?l%7L6U<a~Ac#rr`#?F1x&j9Wp
zuA|@Gdb*FCytwX5p(OX0<A>PG>6B*HMC|_SU;Ru(<?5-VB29f~%FH4)sV-kU!AH~6
zMNrv_-~GrUBg_+E#uEk?O%MTF_ayG0lT-^|**h@j%Xhc;cH);u1eY7jO3#MOpI?|c
zG;?9;lfJJ6sdEOxNWRs)j{2UGWZgc=G~EolqFs>A9h!c5ipew?^IjiqN~e;g{G`x&
z&@ADZnD7cY?X4uzYPr%xgEld`cE$`-V`dS%?2SRW%mAM3=_-tQL6i-l@HOTI+s6&H
z4Go2X6J+r9Y5x#vd7l68{9Pb38YfYzFeCcjSgwjkU)~jCVl8`MED$)-$B!>}^l&GW
z#!^Hvox@Dn@^9tEitaHzSaDFl{ey1a!d)k8KPd-C)nTF=2Y&yXCr|oWp!~V(kBdX#
zmSp|=4nO!=-+9*91mtDXP0Bn#_JId}^!nMLg$nXX_k^*i1?wg>I7MtZupdThu>i0U
zk~E*Iv||}`w=1E~vMZ#isze2xvdFcV(nMO{0oY*>DxmxsQUJdOQHsfO4o&HPb)c#c
zF2vu2aO5%PtxX35YnwjjoatHTzBg~(`CqYx-}upUBN`$lDh(+CZ@h7s5o2ncHY$R0
z<s^0tS3aJe>~~(dMPtHN%1Bhk-5_|nP`|#lp6E;Bw#*yVMB9lpoA=+#NM~bM{mG_P
zH^Z9W_0(E3@t%*GSa_3B!Da4YuIF@B=jwlcR%8l>-|#72Go@I#wc>NYh9sx!&Q=q}
zHNoa!OTaeBY*M$c32dg!CJ4e7Kv#!``&3+(8LzwonUVPT<L{8##K}4EC9FfEDGfG4
z^W|NOOy|m;Q+CV-6xDd;+%#CJ>*PMSwqW7Q!%Ds6GpWrc6R`4BOwe^r{zS6AcSY3A
zt^ehlhjQWSWv7WLw?ezb#XcJc%A5v~Ni^V!W63W6HPj^-0|1QR655~=$9QWEFFJPQ
z3$Rf{yc8Y%Zj7ifRLz}FurKb{!9Ygbjq(k#xRIzIkCio4xyB{-F`0ZrI<cY{9r;pR
zq;hfRXQZ<4R=wKTkvCxjB&@et9lPuo=$?BCl)HT#m*?9JbsyirR70EO+YQlxs+nJO
ze3M^az2V`r=B)f<tOJt(of`lCYZWq2dpUp@IP?<$7RxdCH5dCG_rIf)*<U7IkpOJR
z=f26WGVt5UX5biV)OgQ!jfAvt0ASb@4mnYa^N?AtQJABU#QHfF(x}Zzpcm&&orH&*
zAwV(?!U8;YF^AEJFU}EIfbW^)2Glr5Ax+CUi?v2|P69)8=_)`HUG({p`+^(_m;{Ov
zflRcV>j#FBKw473AB6uXHF9pZt4*u&j`{k*Rdj8)v~>zQRo{By)V^_6B;vLRf1%Y?
zuUcN$Ykze+R+iJAM{+1&5-7E@7lBN)oa+aMkwB!<CPx1IYK`<|uidUT(&l$D3*8z;
z*LF)=r?6A?UO6wE+BZ3(BWQ`+!Y=oPR#&}5puDb0J}*jEBa6uu<%jEGuW!{I@u9(J
zGFz-RyTj>ndo7?CUbk^Sw&6a<t;X(fy4)VG&;JGEKS3xQiN@lIWGbD>=JJJNsa&bn
z>WyZr-RbuF7cO49eB~<RLXy(PMsecOEH6r5)z_}yxOvNZpks@A)!kDnqt(dyj9Tcm
z8>u_5Arp#W?{94sOK5DL(u3(@xF|Iv84<g~&D=7cb;*O_g1L#W=kt_;pFK<bJr8C<
z==Gux5H(i74o!-4yj1zlDnae<2o@gIh_a*mEr;Vn!Uc5UdCcxF32TLbriZrg5v%sD
z{hvN{1;&bJz8wOJKYBTJ-z1#XmOHaq7E@@fM_tIp<VQ^)1G*+9=aU>dM;@Bnn|-Z4
zLJoum2t`k8sKy*>e-X!XJ|8m1v7Tr*roGvT)a?BXW0i{`w!Q0)>l2Y&Go~ab?GRr1
zSdMeLRLf)5PU`9}=3t__E46WPiVmBJvu!8nkxI8Ruv|)5j781W9b<=za;Q(tW&K7F
zewb&JOMu&Vtjg)i00gOU4lgu@?Gx%qj_&!GOIH=T{@`>+I-v}PM?D-u6KEh_Zg_I;
ztv$i<c1^7lp7zlBzEX53)vS^|I4h9d5X7Y~N@N?!P|Vnv#h*ck&N1QG5b?C@WBYSh
e|GaOptWshWk)YQ>6T=%6V3vIPwfN@j3IG7V)LtO~

literal 8196
zcmV+fAp75UPew8T0RR9103ZYa3jhEB08wB703Wmf0RR9100000000000000000000
z0000SjSdE20F68f^E}xZ0X7081A=@Dfj|HRAO(d!2Zuu&xk4r5m?a(u1Wo6OqC}9A
zC`#67DEt2p$&E3>1j(ne+vyM+A$mxTAu^U2dPk7@B2$|!<c69{wNTwzeAS0FG1Shx
z?C-eb6|8PUDb)XeTCV?n&b_y)T4-)nS9gqrTip?SswGSaGTo#S@ZSmD8L<GNM+^ys
zFvfVEkBBm&%=(M)%=s!jQRAvExf-!&aWLzjd=mgX0Qa-EN*xYlO>NOvReXT*{eN|@
zH^6v+Nc1FI27NLFxWH3Sri@+3?l;tWiE5~dbEU?KbFEZo&FBoBp(;t1dN<bqy|)1V
z-)FkP?k}o!U(J2hi}PADEH1~$+hOM)D^GEh#MHKoB&U=Jn17w-sso^nXljQIaO|*l
znfyUY^uJ_MNR}P2L$*Vf;=b5U8ayPhoeSVODIiSU0AMUH1JOLS6GK$X6rT{41_41L
zuKnE8N^uo!xFzHq0dgk5*eo%XQ3?ndKqG)m&rgTBpJ91M#6qX3bQo(k=-qyM=NTC(
zAt@jV0)DmcZVd=P93j?$qmiw3q^{mMbuHQ<@v$@k(behdD=ym!XCXl*^d>mp+Ey1_
zEaEN>`4ZmGZ}3TRgZQBMgg7N3i*lX(o@%OJKw}ZMV=q38m+=|=KYmA=mQX|&(G-1{
zo~IM^kMs@ti9S}IF$$9q49g*9MuIRUf~T7%a5J0$;f$hKuEV@|I7uOzp>R4|I|t@b
zzEPf-6!QpGk~GKeAwI1I3!yXREP+z2UZ}E2$P#wIFe?%D;r5hGv}}P&h;icBw9d(C
zwBI+yX_m-i-x85bJC0M=^yWyfDrB8uKDVXxh^s_PoMSOYQ)bjxZs6oj7*eNx+X6`(
zSVdZ|-bRVT3raPMQPoNoi4ZGu3`dx-!_0!KW9n#?RqW`t_=r+c!;w?gA!(EoDKd5%
zBn_6e&cQ0DgdF!(6-kiBXhIX;pt>(U?tS`=zi;6=-wd3JWfoeZ#BLVU)dk-*8TNNV
z(e}PlEAffzs`x(T_RS22<hC(=9=oY-Bpoj`XBBfB%V%d<6m5+(3eFuR)ac2x8B(d&
zcIlU}k>ceJbANVG95*!QT18rX+bl)Yty@xxCL@0CYJU5*?3z5`j6#mxnz{+uURF5o
z+i2FAO&>R**9DQ^uk;Z{WEy#viRAwHcmI=JHQF>GvEwAwyq;9_N?>o3YBKcFjZ`Lv
z3rWqkHgTg-b&B@YEN&1pWH7Ye!z0RG_nSxq&*|__Bbj<B>(o8_;jaq=Mp#xP_dR!5
zLaDuyG_>YAFK#~13b%%IX(QVhW(ZktF@>})lhU+MCy{(wouts1SMRpC{7eWgI8Sre
zmsgvllly+*a79dc*A|5mMH@9Wo7GLW@h%uP=T@_{>!j>UI<(ry_v5#jR=O6xqi9%t
z)~qwm?^8<3DiWz$7liIsU}6c`{&@m=ECGb6h>verx#G|G|9pV)0U00atZoCf0Bk=T
z0VNQHa5MRAs3F2uBE)gm%1|8SIZ}RXxuQ#b_8ttKIfG6=_!`h{ANwJxpjbk}F7np<
zB=aMgs`=VjNuollHUsbSHYX(cCS169Ulk@uisfN5=JEf&q<K>2(_Ef3Uq)7oR&CmK
zSfEpvg^WN>Ubh~-`Yf{85=$+!+zMw26%>_}^;_v|16CQd+8S%EbB>BjSFS+;5A9=a
z&43N_iusSf$vlzfJVt4^qNyAx>q6;I><e&V7Kr{&PL4r&9W&5a*ua;vI0C1!3eI8^
zoJSvA#2j445M0F`xQ+vG69aG?Yv4Y%z(eeU$JhZ+F$K>t0WYx)USk=&#TdND68MO9
z@EI%MD@Ncu7T_m};5YWc-^?KdpLqQOegl7i5ikZOz!aDP5fB3jkOCQy0|ih56;J~W
z&;lLM0|6L-Ij{hhzzSFc)`1OR6W9W_fgNBM*aP-~1K<!i0*-+b;1oCm&VdWy61W1c
zfg9i!xC8Ei2jCHS0-k{v;1zfS-hmI`6ZitYP3iwsP9^Xs0Q?+CpMn1ZTIcRP_+wNB
zVPArrXI+A%Siu$8St&pjh(}3-js?c{gZ>bCL69wRLL(^1^^k2pD!D#+!iRr7=#v!?
z6O4xlaXuz^)NGo@y(Y3YIG*^RIocIG1E-^4#n2npJsEH*5Tt#3h@<*R4m8NCCLq|N
zSe6d4w{FrgYJb<rI1N6fQUb<(5s6)E^#5yIprOR6qF$kg<kHpfoUt2)9>}6}jLDVv
z!o?cB&4dc02((jY-mEBf+u3d=j*usd#wsfF$3s#{NlE&L7_Ga{z2i;ILq>J8;W=v>
zj(SB0Z6{>kDRr6|YJ6}8h`*)PgG$0lyJwOP?#uuY($?TALnhBvi9=)$d}penmDyn+
z@k+U35Hhfc0EoSdG^?RX*vcqFnht$P`C5SRFi(5bovE=?wH>C{0zi|=d$e}hWjl0P
z;Q?e2l9EVADoF?}nD>4e*iTcjz2%&1$}&TAPHIy?r5q;0Jkpv-L{`3O)>@@C5;HM}
zBr|q|02DWpOCV+(Rqg!XeB3zn1kc|k+A0gkT{YN=-Ic-P(O8J8Jba;FOPsgCc%FlV
zshNZ+y?q`07&l9oA&<ni-P(p1n(HPFygrz@uCLfnxdD%L+_l;`F?133E|FP687j3J
znS}<@X_%#7T-1^!TAcR)cB1+2r4Qv~s1#j1P!p_-OdG#P&CvXRQb%P%t7I)*FqxEW
zcFlYrntPC$P>(Hdb&^IxG?uf_Wb`hrL8hTv4aFov%yM@h{R%u^)3P^k#*ulSROor-
z&VIZPO*rt5TieV!lAFDoCdfN^5_mcW9`umx^b$%;az>0RkaH$){_=<yfXm+Fm4{N5
zkFLvQciL+z4*S%Gfiv(1IU<jgp|eI3Wl(UZsY=s1hl5CkftiKnV{Vi0nh9E0ZU3xF
zNg{yoj4TqJ`2(vZCD^jV?@`ZwcBa!Rc!h0`#&V};Mk@s?05mw3->eM~Hv3FHksT*=
zt_S8+8;zSjg;QEU0}%k-09=Tp%tHA76dzJiAfLijs5zOzNK^Hpk&Mc+cv%UiR$y;%
z_<gSSno?8q)R_l*PjtQ@lWqVBZz5JRWDE{vXMo5(VC@H|aSiZSONq$r&v<jUtX4==
zWp#Z%_&rVc9>2G?{zE(|jm!S%^k7pVpQe2YNE7dfW#2}0L1CGn#o0YV#H#)SV2OkX
zCx+FTiE5+jiP_vKmxs{?qqUTf@I(wMnJPM}J0w!H=9_<L-mTkv0s$b4dl1l_(t<U^
zR0hJfoy*L$bwCI@Mn5dHOrlKHFa(6~dg6(hAP2}4_P~&2Pa~B+o9>q5ADIr9kvQoN
zGefrnn>A|A`W>roXbiPKiz348W(Z5R?N3!DK0d0Qe;)GaZ0O|urccn$?boUgvZ}1;
z%xYB|`HAh<{S`XTqsjS53aR*oxxJmXKe3I>rp0P(=fhF&&XH^rYf;rqRU8<yU9T*P
ze5ZO@nL+==w0`$>O577+K#y*ox11bLI!HV#!k)dbVY6y_ODc7%*p7vDl>aqn7KvOe
z&6%c%S>d3!rrELO2*CxSV@jXR?iSV5T+|M1d*@EWY?w7F7ANFXukny|m_%O5xLJak
z8c|g@L7pbkAjbeiENd5|?VbzYy4G5ofm~1X(zhzE;(ZDV<{M|1c}(LWk7tTimd`b+
z5C`fr&)P7>e>y;q*47yzz2&s_C#Ka<@>L4qb6e3kaQE2~P?ueb{)Y4-AXcpa=_+AX
zN}-Jy3JalT<|wOQ@EYLEny8~w!L59VXw9lE5oSk0XZapVq-n=ub|Os~nfdC<VODIw
zqjl7}UVb#Qwl>a%s~m?Fj_!zAqHBYKS?cnHkY@Ier`Fs#iS72gp*Y&Xk4I+B_Rh;)
zT9Z_&DjbT>$R*|D!F+Yv0E1ZFntip9>A+Pb??*l|+GjhrbB}QK0h&o10WHKDR@Pb(
zY(^OPC@cYRnyRNFR<kOSV%g;^ekA=QcLUpI0HPrank#v5C$arX%I&|fhe<zaD*2JU
z%Ymngs+zR+tm&Yv^F|u8uOdXCvpX|SkCJLtX8fE<s79(Lo|decnPg=P^W0546xBu;
zaIiCV!7;;{M-}=<y2szGt--qqaW-ic!}h_1b*(8I0$c7}q6yq4EFA5RQV!0(!ulRg
zB35N;stRLoOCm^NX2%L9AsJ`EBrW%IW`cZE;%@SoVoNj~WLk7NmDrhvLB&+|=0xrh
zT2w-33T~%^3}$8T(WJNlYZ2ky5VR)4N1DkHQnaDdRZU5UMrM`KJVZhEsj4}w8F)>5
z=~TwtD|GmX)ml~Ri5?^0TUO5tfX-iaSPE>X8}J6U3t;AUT1)J}ptoVV=%pizIWmLs
z?rqz;wS?3hwv{>`J5k=(ytccLc5AljjD94V_Z1T#dK5#zykR;MVX?pzESAU4(uGW=
zFVM=WR$z$;gKu6!>c=7S2rwx=mQ+UHa>=1IltgHex1CwKh;>TrwQ^GaG{pQP58k}f
zPt$#=H9(i5e7D>Ru}k5HvCMS*Un^`~M1SImZ(>V6SC*)F@%8kOcC!@Kw_8GY;-4<7
z*T}_~hjgL!4{mkR0pg-Wxc>jh^#E}&EReXd(yTRVFO>Kq4f7$?=JP_&wAVMCJDT@W
z!DTxe`}l*jZ-&PV?5(<hvI!TZ;CgE^K&B=DF=AS)CS@}7JZYsC#LF&`yXipmr@eN5
z&H%^}0irJpa10VT%rJYoV#7@#O$a~JakDRCbC3vn2ylaK24@XtqTL%n#)TD<CSvPW
z%#!rpOnm<Ww#4Z24|?@Ka`cEHeVOiaUYu>yB<>|D;_FPDwoIrAQW&9ILoSCKj-g+{
zy^=bb$q2K@8|)3@2xc&-5)w_NIuI>;@!&&|W}yDrEYPncB#|Bl1Og2b0i8K-QcZC(
zBtf-+!G$S(xo_Y)o+%D5Fv;(POy^`I-?n&_2>0XNJw!GgYdv-@A#K^M)m^NX6K4lN
z7(bn=bowyrof!});BKor(GhB|T`bXL2`2EuC3HUdwE=Dw84=}<47U;GE)*=KX-v4p
zb|Fcd#=sSb+7Q8tT*5Z9|6Ixr=6K6-pa7cP&KZ5&$ez8==tHa2XU;TbZ6(5YyAM9J
zwZEWeG|TMZ@9mzU>0@Y<=`7!)`yR5In19H)NnW=A(f>b^BV?z{4)$xDZWykyX{5J*
zY?Lns)UE++quf>q!gfH{P@DmjhMZbpE9<ebg5eGi+BR4QV{3RFYzkwKS<1Hin!%P@
z2Q4AFyw`92pg&z@hwmNWB`D8`%5aYoSpt#t$i}cU8K{-cNLpgpCQlN9vX;86BHBQ(
zjqT}qKgfG}02&)BpL%uX!8U^}0O9LHBWbnArx@BB13~r`J(9V=hrD8+1OfBl=u~<_
z?9RDvG-|{W?G}A?c4+b=UDaGZZ^G4LWRyRJ!Kt_JkL}LJl$~DfzPs}sYa;yYY;*s!
zl0rUcc0K+42d%i>@R(ivA2@3#-nsw#7DM#po4Ki@CT?!|^UbmNrrx<*HDS$>w^ki)
z^j?#)<gyQxqc2gCz8pnImP#vm$8>4(`FriQz29rhUVi!Pocr{rADaA_v*Q20cl<*j
zV#djnD7=ENesu?tK5oJN6JW$<1Tj(IYT;j2Frv0zmr8V?A}smbqZyysX4b0ZiK!sm
zhoonDoZy{fJ20(7SI|{g8B`ATh(NgIF*E9OD+6Q^zzgJMRWoscCUThq6DZqaGOLJX
zUZ(|P?G+lr1f+$OD~u7Y1&N}(QGpTAjMX!VRj2Mtrmh({b=&a;$8S3|aN&XrzmLeO
zWZS=tZf&KDAKP`XI&x+(>nPdw$@tw3CaeGpopGhB^yltC99dxdBoQ?Bq0rKm^tIEc
zzXoP9SUnY%y8rZ~uhNk*7x1ngk~01M&*wrchF;k>%xOAr=}Sx$f0K|6X@*C?43p+|
zW9dXRccZXp#^^?_=o%?1?w&G;bLC=j|3pR8x+~u&xqk8&{bckbfpq**E^=8a(F|pq
z_Srl3RU&>A0>iWQ?WfjPjHZ+S&uvw5i5|RTgu;6d7Spup+jJrz2~vm8G4@24Aiasv
z6eg4t+3Z+8sVA;q%srB4QLsJVC9__Guy)3NB%>B*r*}$OoA$wCi8_31LJx_h9I>?q
z`#SVlhOAgy&%mGW5lJ?RyCf-|=~|L@9K|-1Zf`!^{&2IMI7I7|)s$2t*{Ez|DvhX?
zkP{#oNdh)i^ah5S?MJjL+Ozt}Zo43JL{mO%*{!Ebw^d8iaoL*ghsrU#{izQ;`_2bC
zM~FocYi6A9>@LopzeS}oKYjJr6RC-3AFLl++Y+}ZkS-;yCBJyKT2of#)*o)TqV4&=
zJR2tWjhceYzx#9t>ZeX23<QHD?O{oQ&Yi%1(P+Q@{&>>?w)EeZ7NHs203ELQl;*9h
z;f;IRcUK&6>&us)n5b0t&e=-ZbGIZ&2Sq8Qhyr74QOb*t8pij1S60T{dRERSwy$6g
zTK3Z-+TQ{PdC-|tqUDvnSbMee`^KXyEPKVHbHA(wg7nd6sH3%Z+RyI^#@U0WKyYt#
z>{}NzrBdF4LMQa4F?S++MGU!Y6PHMf0Gc~kBgiMB60^hJ?l?d)rU3B!_77EcW8;hl
zXNWBq_CjMUY&}Lu(tL%|u4T~Y#@+wSo{;W25*2X9BF|#V5^4P?V9)OssDO$TSOI<x
zq70Mel9kcM0)c8mco2UgIxj%Vpa@f81-J2nbz97=KLxUSAHLj+<3(IJC4y-9Ty_l)
ze|6RqQh8-#!gk6@3{QJO@J^|5PkSRibe)ft)iW_`a`wp5Y%06-$ZYZU%5xK|G@*6F
zB9jXZ3kovqaYlHSCo+yEf*UH|sqSIk!n7l}A4Yrf`6l1}*&H&A!h}bG@KF2aE*CBO
zwzrPnotXIMZF)Yu6WN7q6X_TIx11~9@^gUqo4e^(6YmU>TNHQyM<~hr>GWNkF6crt
zYa;gk_BW4-5FKF2H${U}uH|wHnr{LT&laMz8@XmPwk=6Vg;}stcgq7_ec6f=6H1vO
zqxv0<L$?!#O`xkORw5hwS2Gcmo8i=r14k#KQVSDymY52wwMSeY>L$Q$s$?M|LGO%1
zqA<*K0m*u(BVCQY7?D*ved03?v*#9qbXOMv5j3Air2GCIj!iDj-<aDqCxIFPu=)=C
zLCDr1I9eFX9hN}tc>U0|EgKx6u^n1q9Gz~_WJIg^oZQf35JiVSP@(}(E$Jy4$u1Ge
z^JFBtB5!-%c*pp7xPVx&R>T5<M#U4}Pjy6I+dLc?oT*%9F|QZ8AmxFpd)NzduqY^c
zEG4I-QF~0RXO`)*F_sLYZkaOAn7wN_Bjzt?dN(N!hI}dgJc^^0sx}2?HBvB29sw-w
zzFo>NAekY8yF)q7ZWknS&>Wb(FZgVc7DAIy{kPY2wK^hEj~v12VgT7MgHX!b`;{Oq
z`AVY?^s&QYIy8<6OASY5r$=R6G%V^iuwe4SzYCpHnrIi1X7j}_<fOYLto>l?+6Q1Q
z>?K?~bGPa^?CFZ-Jg~A)SOK@4YGX3IbJza!V^YcbUGKH47)W0UmLuz?jvqtjg8a;u
zx5Lwftu9edE;JL;nGCi2xoYi$OEQu@^Q*Drjvdi@ZqvN3zw3?e<fT;sZ$>qRXceLn
z>I-z(h^k03i56m<htF5+t#OgfNyE(Mf5|7ki|}WcU6%tZ*nyXl$eWG;otr8vTX#=H
z*>jct#uAj|Q-cWDu`mA2{DfL@a{uW3|9qlrX%BvSN^rzPd&Vz=EM8SQcGt0Ms(1Rn
z5~MC44J%St?()-0lJ&?@=o$H*8Z_ABxmC#;$~6Xrvl+nvbjGy^Dm@(1Cq>=!2g$D+
zJ*Z9Hr$J(`6jDqx20(g1)84{b_37#+T6Y3LA<a#a)MQ^;$|he&o=}nd0%q<SfbOA-
z$@l^(%ptlaiDKM_v^{SnY3srmu(zk|(Mh-NotLzGy>hvmU0GVxT^bfrsYk~`C3S7+
zP~7Q1oIZQVYN2wm$5WQfh@Pl<kJ%e<NcL1fInu;T`gs8j%jm4uOrVs`9lau8>_7;k
zIY%-=Xx|G&MYrO&Wi+YoHIya-@|ug%BPa|o{eU8IUIu78E+=UirA>t!qVN;o5|N^k
z)=G!-58pKD3KnjSbXrH+eYD(Ej6`*q*@4zGsLH2L>~WY_%O&WpYvqbwG(G6*i5@16
z0la$jOfX^lapdJ;y~HfR>LdEI-|6G++<Tt(6LM@y{j2Z3(O>`K%D4PH5dF(N^I{#`
zU6l8q{@`=}?7Qz7n}DKBcnMhq$Ugk+Kl}Q<pp8oME$;#owP{tWiT8b_g+=;krQ|U$
zVQv(3O&1!`7b;gW{3)NZbyIc19m75cY)Epp;qEY%m?qd9Y!BE5nXNrlNo1R2Y{m>x
zC6hselr<64>};9lMk;?QWswu+RWRdK(;ZBCUY8&)=m5m77ti;Wc8qttKJRT>pPIC_
z)QHWnN4ct5Q~vWSOC6BkMFGfSrZJcIQTCL<Mptx1)2@webZ5%jzI{pDF#PG`B2z>R
zASuB%b4*Z4hv%QEU$**C{-6`9Y%>vvq$@Q>RA^LJ6$7uHL#`Fjy0HZzSJ1j+^>IRe
ziWx~yL^3ZT<1K8=u?v^%gLx(rc^L^W2{Zx8C7fj1&gcMcLS8=)hg)}~=UQ9QX=Q!r
z0y67J?8k&Qf#wMBIwD;v==2&Qtp=4Q8ncPfJLwpvRIZ;rP9K8um;t~;-%~i0W)i=?
zb4;WCw)<n3J;pf|&<cZ)KPJZGcXPan{uvSGNwj7vM-v^w<kObLN>^p8@T(%rqmo<w
zs#ct+Bye^3tt>}5D@=|>tDMP}MMUn7#L-HIykI7t&18G(iA?6rv2En&zD@)=wl-0w
zV*a_3!FFUSu=0GOx7q|B{S7WLZKqJJuIou`PCUN}4R1yslr%`<P>nrEQHxPl#27eG
zvAQhOcb9Lw!FGfAsmdgiDucBOmA*vt74|5ZlpO5l@+{;TO$N(mQdDjF&K5=R_f)n5
zn&@h<KIMa$iBA1LDnwR%I6`HuDw))ulZPO5vo+(N>qG^QShz%$D%Nfy1UZ}CKr0=1
zUT#u+HS*{kTWDD=7dPB24H@obJ>+JQ8@{sbf@{Bbykhi$MdYwNR1l6Rl<G0rGF=Pf
zVq9^4aP#iLnY)HHv(kNiS}~j4JsEdXLu5L9YewKpgx+CJd~;~5nj+0}^=n%lt0hAp
zlnf2?Wj!`wTgE#%zBiV-s(0=WcgJhTqlX7C>M745exFt=Cxz&><EvIikA5Rj+cQv-
zx@Uc@m`|rmV*!YXHO%f{NRidIr&5ub`xdQB&oJRykkPlTFNnhWu>u#y!VS7j3&zS%
z5I)V->L$-^Oj=)X)=PX_^+aCDIc3a3j6LOVn}_jp`caH&$F&3-rc`w7RS<-g&d<%+
z+vqEnhaf-hiC7u)gGz$tf6YyMo_kkhctN$)(eNl8MYwztx-ret=Q)xzM;{{t!p&!T
z{6cABe9s>Wya8YW*P|GU*W+x5a1c&?J>;(nO2Gl+XjXvK*1#T`sjttoOcD+!UImxF
z0oU@>=};N8OHbn_IIX>;Vw1NL6ON<;ymEWt>i>Z#4_Ail9rn&hQ<iBRQf-A~C<jb^
zXi_H0@|)Nz^NMW6=E>9tp$^AdZ2lMMdy1hS{NUkB=dby#lfY4cE{J{m6MICiy$OH=
zM&K*PaS3JqX4r5k_+7aE)vPEfU-=irCvFB1k4pTflTG6b^<^VuiJbt$M(~^$q1Xx9
z$POi{{zDLhQ5LeOkBVa{u53JkG#-Ee$ruRB@bbebMhgEvN?;kj#mF9%8l{k>LEgf3
zsEvwaoNo9UkU%f}Yx6!7I}&sWjU-@n!E@FR8frv2Q-PP4!haGCoSWwr;aT~e^3#25
z)HUtC(P?-w>ziIUHE*1aV&tX>f04J%XjWby&uTv2f{o`i>nV05=n@*jhXo%OpY(#~
ztRFPgh(a~V$mo9@uM3DCdd>6ZiMq|Zn2BzRQP;HlMyKJ$tcT%x;ncj*QOiLaxheQ?
zU*v5wQaH=&V=%3rlx}hslmD49|EJ({OaPD|Nv(XOWRpWNic^A;G>=j=pR{Z<`JW71
z>O6$JD63k%aZCGupxx>A`h($UJekhsi{)y)+3xm-<LP|4-tG^GFrkbKskE`qhnRAy
zt&h3(x$paBG|T#tCgJQl-sQD^R}@<ALZ$-~)X}{hwai<`h4L~n=R+UFM{++0DR{?y
zzbvup2_~aN+%pRnskd{JfO$CGBt{ZDE*P@4Qguu}T8+z@hlF9Y1ykXa3vX9=M{=1C
z5P18oYr}ASRJdb1DVQl<w8v#tl53W?#zpp9>aI10jzrza5`H-w#^V=QJpM#1lMhkd
zA=5JCo=-b8Y*9%x&xO`})Q4r3(T|;8;@h$rC-}J(HI=J547gf|LnX722VE+`yq0T^
zWospwN~kBG>TzPB&!W_~*wTLKx$KWogm-nIKTXG=A1xE*dK87rYHMtd8CBst4@<>~
z4ml-9f}%=t9z-4-Pg7qN4a&(~2!!I;%NnsFaK1=^<kSOsn^bRs#fJQJIIFJ<Q|Ra*
zlkHfxtKyL(-jPuB#8BjfQs!h)H7o_J6)rbq1VtYbsp3FxY5%UIR|_~5@)U}db;_Cq
qFQThTf7rmo2m})dFl2BY>_FigDj)<fcxhn^1rkK)VGjfR!siSg0F9Rb

diff --git a/js-packages/web-console/src/assets/fonts/generic-icons.css b/js-packages/web-console/src/assets/fonts/generic-icons.css
index 34ae10699cb..40d8aab5a38 100644
--- a/js-packages/web-console/src/assets/fonts/generic-icons.css
+++ b/js-packages/web-console/src/assets/fonts/generic-icons.css
@@ -2,8 +2,8 @@
   font-family: "generic-icons";
   font-display: block;
   src:
-    url("generic-icons.woff2?93adf303867ea39c2b4e5835c473116a") format("woff2"),
-    url("generic-icons.woff?93adf303867ea39c2b4e5835c473116a") format("woff");
+    url("generic-icons.woff2?033f330cef2f06323d21562ae6e6b4d9") format("woff2"),
+    url("generic-icons.woff?033f330cef2f06323d21562ae6e6b4d9") format("woff");
 }
 
 .gc {
@@ -17,18 +17,18 @@
   vertical-align: top;
 }
 
-.gc-layout-panel-right:before {
+.gc-http-get:before {
   content: "\f101";
 }
 .gc-circle-solid:before {
   content: "\f102";
 }
-.gc-loader-alt:before {
+.gc-layout-panel-right:before {
   content: "\f103";
 }
 .gc-boiling-flask:before {
   content: "\f104";
 }
-.gc-http-get:before {
+.gc-loader-alt:before {
   content: "\f105";
 }
diff --git a/js-packages/web-console/src/assets/fonts/generic-icons.svg b/js-packages/web-console/src/assets/fonts/generic-icons.svg
index b3269604155..c994c560a5e 100644
--- a/js-packages/web-console/src/assets/fonts/generic-icons.svg
+++ b/js-packages/web-console/src/assets/fonts/generic-icons.svg
@@ -7,36 +7,36 @@
       units-per-em="128" ascent="128"
       descent="0" />
     <missing-glyph horiz-adv-x="0" />
-    <glyph glyph-name="layout-panel-right"
+    <glyph glyph-name="http-get"
       unicode="&#xF101;"
-      horiz-adv-x="128" d="M91.818 92H36.1818C32.7818 92 30 89.2 30 85.7776V42.2224C30 38.8 32.7818 36 36.1818 36H91.818C95.218 36 98 38.8 98 42.2224V85.7776C98 89.2 95.218 92 91.818 92zM91.818 42.2224H36.1818V85.7776H91.818V42.2224zM74 82H88V45.3332H74V82z" />
-    <glyph glyph-name="layout-panel-right-1"
-      unicode="&#x6C;&#x61;&#x79;&#x6F;&#x75;&#x74;&#x2D;&#x70;&#x61;&#x6E;&#x65;&#x6C;&#x2D;&#x72;&#x69;&#x67;&#x68;&#x74;"
-      horiz-adv-x="128" d="M91.818 92H36.1818C32.7818 92 30 89.2 30 85.7776V42.2224C30 38.8 32.7818 36 36.1818 36H91.818C95.218 36 98 38.8 98 42.2224V85.7776C98 89.2 95.218 92 91.818 92zM91.818 42.2224H36.1818V85.7776H91.818V42.2224zM74 82H88V45.3332H74V82z" />
+      horiz-adv-x="128" d="" />
+    <glyph glyph-name="http-get-1"
+      unicode="&#x68;&#x74;&#x74;&#x70;&#x2D;&#x67;&#x65;&#x74;"
+      horiz-adv-x="128" d="" />
     <glyph glyph-name="circle-solid"
       unicode="&#xF102;"
       horiz-adv-x="128" d="M64 117.3333333333333C34.592 117.3333333333333 10.6666666666667 93.408 10.6666666666667 64S34.592 10.6666666666667 64 10.6666666666667S117.3333333333333 34.592 117.3333333333333 64S93.408 117.3333333333333 64 117.3333333333333z" />
     <glyph glyph-name="circle-solid-1"
       unicode="&#x63;&#x69;&#x72;&#x63;&#x6C;&#x65;&#x2D;&#x73;&#x6F;&#x6C;&#x69;&#x64;"
       horiz-adv-x="128" d="M64 117.3333333333333C34.592 117.3333333333333 10.6666666666667 93.408 10.6666666666667 64S34.592 10.6666666666667 64 10.6666666666667S117.3333333333333 34.592 117.3333333333333 64S93.408 117.3333333333333 64 117.3333333333333z" />
-    <glyph glyph-name="loader-alt"
+    <glyph glyph-name="layout-panel-right"
       unicode="&#xF103;"
-      horiz-adv-x="128" d="M64 10.6666666666667C92.912 10.6666666666667 117.3333333333333 35.088 117.3333333333333 64H106.6666666666667C106.6666666666667 40.8693333333333 87.1306666666667 21.3333333333333 64 21.3333333333333S21.3333333333333 40.8693333333333 21.3333333333333 64C21.3333333333333 87.1253333333334 40.8693333333333 106.6666666666667 64 106.6666666666667V117.3333333333333C35.088 117.3333333333333 10.6666666666667 92.9066666666667 10.6666666666667 64C10.6666666666667 35.088 35.088 10.6666666666667 64 10.6666666666667z" />
-    <glyph glyph-name="loader-alt-1"
-      unicode="&#x6C;&#x6F;&#x61;&#x64;&#x65;&#x72;&#x2D;&#x61;&#x6C;&#x74;"
-      horiz-adv-x="128" d="M64 10.6666666666667C92.912 10.6666666666667 117.3333333333333 35.088 117.3333333333333 64H106.6666666666667C106.6666666666667 40.8693333333333 87.1306666666667 21.3333333333333 64 21.3333333333333S21.3333333333333 40.8693333333333 21.3333333333333 64C21.3333333333333 87.1253333333334 40.8693333333333 106.6666666666667 64 106.6666666666667V117.3333333333333C35.088 117.3333333333333 10.6666666666667 92.9066666666667 10.6666666666667 64C10.6666666666667 35.088 35.088 10.6666666666667 64 10.6666666666667z" />
+      horiz-adv-x="128" d="M91.818 92H36.1818C32.7818 92 30 89.2 30 85.7776V42.2224C30 38.8 32.7818 36 36.1818 36H91.818C95.218 36 98 38.8 98 42.2224V85.7776C98 89.2 95.218 92 91.818 92zM91.818 42.2224H36.1818V85.7776H91.818V42.2224zM74 82H88V45.3332H74V82z" />
+    <glyph glyph-name="layout-panel-right-1"
+      unicode="&#x6C;&#x61;&#x79;&#x6F;&#x75;&#x74;&#x2D;&#x70;&#x61;&#x6E;&#x65;&#x6C;&#x2D;&#x72;&#x69;&#x67;&#x68;&#x74;"
+      horiz-adv-x="128" d="M91.818 92H36.1818C32.7818 92 30 89.2 30 85.7776V42.2224C30 38.8 32.7818 36 36.1818 36H91.818C95.218 36 98 38.8 98 42.2224V85.7776C98 89.2 95.218 92 91.818 92zM91.818 42.2224H36.1818V85.7776H91.818V42.2224zM74 82H88V45.3332H74V82z" />
     <glyph glyph-name="boiling-flask"
       unicode="&#xF104;"
       horiz-adv-x="128" d="M37.0488888888889 126.6915555555556C35.0862222222222 126.3786666666667 32.64 125.4968888888889 31.0755555555556 124.544C28.6862222222222 123.0933333333334 25.9555555555556 120.1635555555556 25.0311111111111 118.0871111111111C24.96 117.9022222222222 24.7608888888889 117.4897777777778 24.6044444444444 117.1626666666667C24.2488888888889 116.4373333333334 23.8506666666667 115.2142222222222 23.5377777777778 113.8915555555556C23.2248888888889 112.5546666666667 23.2248888888889 108.7004444444445 23.5377777777778 107.4773333333334C24.0497777777778 105.4862222222222 24.2631111111111 104.8462222222222 24.6328888888889 104.1208888888889C24.8604444444444 103.6942222222222 25.0311111111111 103.2817777777778 25.0311111111111 103.2248888888889C25.0311111111111 103.0542222222222 26.2684444444444 101.1626666666667 26.4533333333333 101.0488888888889C26.5244444444444 101.0062222222222 26.5955555555556 100.864 26.5955555555556 100.7502222222222C26.5955555555556 100.5937777777778 26.2968888888889 100.5511111111111 25.0311111111111 100.5511111111111C23.6373333333333 100.5511111111111 23.4666666666667 100.5226666666667 23.3244444444444 100.2808888888889C23.2533333333333 100.1244444444445 23.1822222222222 99.2853333333333 23.1822222222222 98.4177777777778C23.1822222222222 97.5502222222222 23.2533333333333 96.7111111111111 23.3244444444444 96.5546666666667C23.4666666666667 96.3128888888889 23.6373333333333 96.2844444444445 25.3155555555556 96.2844444444445C26.6951111111111 96.2844444444445 27.1644444444444 96.2417777777778 27.1644444444444 96.1137777777778C27.1644444444444 96.0142222222222 27.1644444444444 87.8791111111111 27.1644444444444 78.0515555555556L27.1644444444444 60.1742222222222L25.6995555555556 57.6995555555556C24.8888888888889 56.3484444444445 24.1777777777778 55.1395555555556 24.1351111111111 55.0257777777778C24.0782222222222 54.912 23.9075555555556 54.6417777777778 23.7511111111111 54.4C23.5946666666667 54.1724444444445 23.4097777777778 53.8453333333334 23.3244444444444 53.6888888888889C23.2391111111111 53.5324444444445 23.0542222222222 53.2195555555556 22.8977777777778 52.9777777777778C22.7413333333333 52.7502222222222 22.5706666666667 52.4515555555556 22.5137777777778 52.3377777777778C22.4568888888889 52.224 21.5751111111111 50.7164444444445 20.5511111111111 48.9955555555556C19.5271111111111 47.2746666666667 18.6453333333333 45.7671111111111 18.5884444444444 45.6533333333334C18.5315555555556 45.5395555555556 18.3608888888889 45.2551111111111 18.2044444444444 45.0133333333334C18.048 44.7857777777778 17.8631111111111 44.4586666666667 17.7777777777778 44.3022222222222C17.6924444444444 44.1457777777778 17.4933333333333 43.7902222222222 17.3368888888889 43.52C16.8533333333333 42.7093333333334 12.9848888888889 36.1955555555556 12.672 35.6693333333333C12.5155555555556 35.4133333333334 12.2595555555556 34.944 12.0888888888889 34.6311111111111C11.9182222222222 34.3182222222222 11.5911111111111 33.792 11.3635555555556 33.4506666666667C11.136 33.1093333333334 10.9511111111111 32.8106666666667 10.9511111111111 32.7822222222222C10.9511111111111 32.7395555555556 10.2968888888889 31.6017777777778 9.4862222222222 30.2648888888889C8.6755555555556 28.9137777777778 7.9786666666667 27.7048888888889 7.9217777777778 27.5911111111111C7.8648888888889 27.4773333333334 7.6942222222222 27.1928888888889 7.5377777777778 26.9511111111111C7.3813333333333 26.7235555555556 7.1964444444444 26.3964444444445 7.1111111111111 26.24C7.0257777777778 26.0835555555556 6.8408888888889 25.7706666666667 6.6844444444444 25.5288888888889C6.528 25.3013333333333 6.3573333333333 25.0026666666667 6.3004444444444 24.8888888888889C6.2435555555556 24.7751111111111 5.3617777777778 23.2675555555556 4.3377777777778 21.5466666666667C1.92 17.4791111111111 1.3937777777778 16.3555555555556 1.1235555555556 14.8622222222222C0.8675555555556 13.4257777777778 0.8391111111111 12.1457777777778 1.0382222222222 10.8088888888889C1.2373333333333 9.5004444444445 1.3511111111111 9.1022222222222 1.8346666666667 7.8933333333333C2.8302222222222 5.3617777777778 5.3617777777778 2.8302222222222 7.8933333333333 1.8346666666667C10.4675555555556 0.8106666666667 8.5902222222222 0.8675555555556 41.6568888888889 0.8533333333334C62.5493333333333 0.8533333333334 71.5804444444444 0.896 72.2346666666667 1.0097777777778C73.3866666666667 1.1946666666667 75.0648888888889 1.6924444444445 75.1786666666667 1.8631111111111C75.2213333333333 1.9342222222222 75.3493333333334 1.9911111111111 75.4631111111111 1.9911111111111C75.5768888888889 1.9911111111111 76.2026666666667 2.3324444444445 76.8426666666667 2.7591111111111C78.0657777777778 3.5555555555556 79.488 4.9351111111111 80.0995555555556 5.9022222222222C80.64 6.7555555555556 81.3511111111111 8.1208888888889 81.3511111111111 8.3057777777778C81.3653333333333 8.7466666666667 81.664 8.8746666666667 83.072 9.0453333333333C83.8826666666667 9.1306666666667 84.608 9.1875555555556 84.6933333333333 9.1448888888889C84.7928888888889 9.1164444444445 84.9493333333333 8.9173333333334 85.0488888888889 8.704C85.1342222222222 8.4906666666667 85.3191111111111 8.0924444444445 85.4471111111111 7.8222222222222C85.5751111111111 7.552 85.8595555555556 7.0542222222222 86.0728888888889 6.7128888888889C86.2862222222222 6.3715555555556 86.4711111111111 6.0444444444445 86.4711111111111 5.9875555555556C86.4711111111111 5.7457777777778 88.832 3.4702222222222 89.6 2.9724444444445C92.1884444444444 1.28 94.7626666666667 0.64 97.6213333333333 0.9813333333334C99.8542222222222 1.2373333333333 101.5182222222222 1.8488888888889 103.2675555555556 3.0577777777778C103.6657777777778 3.328 104.0497777777778 3.5555555555556 104.1066666666667 3.5555555555556C104.2488888888889 3.5555555555556 104.7324444444444 3.2853333333334 105.4862222222222 2.8017777777778C105.8275555555556 2.5884444444445 106.1262222222222 2.4177777777778 106.1688888888889 2.4177777777778C106.2115555555555 2.4177777777778 106.6382222222222 2.2328888888889 107.1217777777778 2.0053333333334C109.4115555555556 0.9528888888889 112.3982222222222 0.64 115.2711111111111 1.1235555555556C118.0017777777778 1.5928888888889 120.5617777777778 2.944 122.6666666666667 5.0488888888889C126.3217777777778 8.704 127.6586666666667 13.7386666666667 126.336 18.8444444444445C126.08 19.8542222222222 126.0231111111111 19.9964444444445 125.4542222222222 21.1911111111111C124.5155555555555 23.168 123.1928888888889 24.8177777777778 121.4435555555555 26.1831111111111C120.2631111111111 27.1217777777778 120.1351111111111 27.1928888888889 118.784 27.8755555555556C114.9013333333333 29.7813333333334 110.3217777777777 29.7528888888889 106.3111111111111 27.8044444444445C104.9742222222222 27.1502222222222 103.5377777777777 26.0977777777778 102.5137777777777 25.0026666666667C101.5893333333333 24.0213333333333 101.6888888888888 24.0355555555556 99.6977777777777 24.704L98.4888888888888 25.1164444444445L98.3893333333333 26.1831111111111C98.1191111111111 29.0702222222222 97.1662222222222 31.9431111111111 95.8293333333333 33.9342222222222C95.4311111111111 34.5315555555556 95.3173333333333 35.1857777777778 95.5591111111111 35.328C95.7866666666666 35.4702222222222 96.9813333333333 38.0302222222222 97.3368888888888 39.1253333333333C99.3422222222222 45.312 98.4888888888888 51.5555555555556 94.8906666666666 56.8888888888889C92.5582222222222 60.3164444444444 89.6711111111111 62.6488888888889 85.5466666666666 64.4408888888889C84.9208888888888 64.7111111111111 83.9537777777777 65.024 83.3706666666666 65.152C82.3608888888888 65.3511111111111 81.9911111111111 65.5928888888889 82.0337777777777 65.9911111111111C82.1475555555555 67.0293333333333 82.1048888888888 69.6888888888889 81.9626666666666 70.1582222222222C81.8631111111111 70.4568888888889 81.8204444444444 70.784 81.8631111111111 70.8835555555556C81.9057777777777 70.9831111111111 82.3893333333333 71.2675555555556 82.9582222222222 71.5377777777778C85.5751111111111 72.7466666666667 88.6328888888888 75.4204444444445 89.7422222222222 77.4542222222222C89.9128888888889 77.7671111111111 90.1688888888889 78.208 90.3253333333333 78.4355555555556C90.4675555555555 78.6773333333333 90.624 78.9617777777778 90.6808888888889 79.0755555555556C91.7048888888889 81.6497777777778 91.8044444444444 81.9768888888889 92.0888888888889 83.9822222222222C92.3448888888888 85.7031111111111 92.3591111111111 86.8835555555556 92.1457777777777 88.3911111111111C91.7333333333333 91.5342222222222 90.4248888888888 94.3928888888889 88.2346666666666 96.9244444444445C87.6515555555555 97.6071111111111 87.1822222222222 98.2186666666667 87.1822222222222 98.2897777777778C87.1822222222222 98.3608888888889 87.3102222222222 98.816 87.4524444444444 99.2995555555556C88.0071111111111 101.1626666666667 88.0924444444444 101.6888888888889 88.1493333333333 104.0497777777778C88.2204444444444 106.9511111111111 87.9644444444444 108.5155555555556 86.983111111111 111.1466666666667C86.0586666666666 113.664 84.0106666666666 116.5368888888889 81.8773333333333 118.3288888888889C79.2319999999999 120.5617777777778 76.8142222222222 121.728 73.3439999999999 122.4675555555556C71.04 122.9511111111111 66.7164444444444 122.7235555555556 64.7111111111111 122.0124444444445C63.5875555555555 121.6284444444445 63.0328888888888 121.4008888888889 62.3359999999999 121.088C61.4115555555555 120.6613333333334 61.1413333333333 120.6613333333334 60.4444444444444 121.1022222222222C60.1315555555555 121.3013333333334 59.8044444444444 121.4577777777778 59.7191111111111 121.4577777777778C59.6337777777777 121.4577777777778 59.3919999999999 121.5431111111111 59.1928888888888 121.6568888888889C58.6666666666666 121.9271111111111 57.7137777777777 122.24 56.5191111111111 122.5244444444445C55.7368888888888 122.7093333333334 55.0257777777777 122.752 53.3902222222222 122.6951111111111C52.2239999999999 122.6666666666667 51.143111111111 122.5955555555556 50.9724444444444 122.5386666666667C50.7448888888888 122.4533333333334 50.4604444444444 122.6097777777778 49.6639999999999 123.2355555555556C47.8577777777777 124.6435555555556 45.8382222222222 125.696 43.8897777777777 126.2364444444445C41.8275555555555 126.8053333333333 38.9831111111111 126.9902222222222 37.0488888888888 126.6915555555556zM42.0693333333333 122.5102222222222C44.5866666666667 121.8844444444445 46.4782222222222 120.7893333333334 48.384 118.8408888888889C49.2942222222222 117.9164444444445 49.6355555555556 117.8311111111111 50.6311111111111 118.2293333333334C50.9013333333333 118.3431111111111 51.712 118.5137777777778 52.4373333333333 118.6133333333334C56.576 119.1822222222222 60.5866666666667 117.0773333333334 62.6915555555556 113.2088888888889C63.1893333333334 112.2986666666667 63.8577777777778 109.9946666666667 63.8577777777778 109.1982222222222L63.8577777777778 108.6577777777778L65.8631111111111 108.6577777777778L67.8684444444445 108.6577777777778L67.7688888888889 110.0515555555556C67.712 110.8053333333333 67.5697777777778 111.6444444444445 67.4702222222222 111.9146666666667C67.3564444444445 112.1706666666667 67.2711111111111 112.512 67.2711111111111 112.6542222222222C67.2711111111111 113.152 66.0622222222222 115.6551111111111 65.3084444444445 116.6791111111111C64.9244444444445 117.2053333333334 64.8391111111111 117.4186666666667 64.9528888888889 117.6035555555556C65.1662222222222 117.9448888888889 66.7022222222222 118.3857777777778 68.3946666666667 118.6133333333334C69.7031111111111 118.784 70.0871111111111 118.784 71.5946666666667 118.5706666666667C73.7422222222222 118.2862222222222 74.5386666666667 118.0586666666667 76.0746666666667 117.3191111111111C80.5546666666667 115.1431111111111 83.3991111111111 111.1466666666667 84.0675555555556 106.0551111111111C84.4373333333334 103.2106666666667 83.7546666666667 100.0248888888889 82.176 97.3653333333333C81.1093333333334 95.5591111111111 79.9288888888889 94.2648888888889 78.1511111111112 92.9422222222222C76.288 91.5626666666667 73.088 90.4106666666667 70.6844444444445 90.2826666666667L70.0444444444445 90.24L70.0017777777778 88.3626666666667C69.9591111111111 86.1013333333333 69.9022222222223 86.1724444444445 71.7511111111111 86.3431111111111C74.5244444444445 86.6133333333334 77.5253333333334 87.6373333333334 79.616 89.0453333333334C79.9573333333334 89.2728888888889 80.256 89.4577777777778 80.3128888888889 89.4577777777778C80.4693333333334 89.4577777777778 82.5742222222223 91.2924444444444 83.2711111111111 92.032C83.6693333333333 92.4586666666667 84.2097777777778 93.0986666666667 84.48 93.4826666666667C84.736 93.8524444444445 84.992 94.1511111111111 85.0346666666667 94.1511111111111C85.4613333333333 94.1368888888889 86.9262222222222 91.8897777777778 87.4666666666667 90.4248888888889C88.5617777777778 87.424 88.4195555555556 83.9253333333333 87.0684444444445 81.0666666666667C86.2435555555556 79.3315555555556 84.6222222222222 77.3831111111111 83.1146666666667 76.3306666666667C82.2897777777778 75.7617777777778 80.7111111111111 74.9511111111111 80.4266666666667 74.9511111111111C80.3271111111111 74.9511111111111 80.0853333333334 75.1928888888889 79.9146666666667 75.4915555555556C78.8764444444445 77.2266666666667 76.9848888888889 79.0328888888889 75.0222222222223 80.1991111111111C73.8702222222223 80.8817777777778 71.808 81.6782222222222 70.7555555555556 81.8488888888889C68.8355555555556 82.1475555555556 68.3946666666667 82.1902222222222 68.2097777777778 82.1191111111111C68.0248888888889 82.048 67.9822222222223 81.7208888888889 67.9822222222223 80.128C67.9822222222223 77.952 67.9964444444445 77.9377777777778 69.2195555555556 77.9377777777778C70.9262222222223 77.9377777777778 73.4577777777778 76.7004444444445 75.0648888888889 75.0791111111111C75.9608888888889 74.1831111111111 76.4302222222223 73.5004444444444 77.0417777777778 72.2488888888889C77.8097777777778 70.6417777777778 77.9804444444445 69.888 77.9804444444445 67.9395555555556C77.9804444444445 66.3324444444445 77.9377777777778 66.0622222222222 77.5253333333334 64.8817777777778C76.9706666666667 63.2604444444445 76.3448888888889 62.1937777777778 75.3208888888889 61.056C73.7137777777778 59.2924444444445 70.9404444444445 57.8844444444445 69.0346666666667 57.8844444444445C68.6506666666667 57.8844444444445 68.2524444444445 57.8133333333334 68.1528888888889 57.7137777777778C67.9253333333334 57.4862222222222 67.9111111111111 54.0302222222222 68.1386666666667 53.8026666666667C68.2382222222222 53.7031111111111 68.48 53.6604444444445 68.6791111111111 53.6888888888889C71.552 54.1013333333333 72.6328888888889 54.4 74.3253333333334 55.2675555555556C76.7857777777778 56.5191111111111 78.6915555555556 58.3111111111111 80.1137777777778 60.672C80.6257777777778 61.5395555555556 80.6968888888889 61.5964444444445 81.0524444444445 61.4968888888889C81.2515555555556 61.44 81.6782222222223 61.3546666666667 81.9911111111111 61.2977777777778C82.3040000000001 61.2551111111111 82.7022222222223 61.1271111111111 82.8728888888889 61.0417777777778C83.0435555555556 60.9422222222222 83.2853333333334 60.8711111111111 83.3991111111112 60.8711111111111C83.6835555555556 60.8711111111111 85.5608888888889 59.9893333333334 86.5137777777778 59.4062222222222C87.424 58.8657777777778 89.0453333333334 57.5573333333334 89.8417777777778 56.7182222222223C91.1644444444445 55.3386666666667 92.7573333333334 52.7928888888889 93.3688888888889 51.0577777777778C94.1084444444445 48.9813333333334 94.1937777777778 48.384 94.1937777777778 45.5822222222223C94.1937777777778 42.8088888888889 94.1795555555556 42.6666666666667 93.4826666666667 40.4622222222223C93.1271111111111 39.3102222222223 92.3875555555556 37.8453333333334 91.4915555555556 36.5226666666667C89.3155555555556 33.28 86.2293333333334 31.0328888888889 82.4888888888889 29.952C81.536 29.6817777777778 79.488 29.312 78.72 29.2551111111111L78.1511111111112 29.2266666666667L78.1511111111112 27.3066666666667L78.1511111111112 25.3866666666667L79.7155555555556 25.4151111111111C81.5928888888889 25.4435555555556 82.7733333333334 25.7137777777778 85.5466666666667 26.6951111111111C86.3146666666667 26.9795555555556 88.3342222222223 27.9893333333334 88.6186666666667 28.2453333333334C88.7324444444445 28.3591111111111 88.8888888888889 28.4444444444445 88.9457777777778 28.4444444444445C89.088 28.4444444444445 91.2782222222223 30.1084444444445 91.8044444444445 30.6204444444445C92.6293333333334 31.4168888888889 92.672 31.4026666666667 93.1982222222222 30.2648888888889C94.0515555555556 28.4302222222222 94.208 27.6195555555556 94.208 25.2444444444445C94.1937777777778 23.5235555555556 94.1511111111112 22.912 93.9093333333334 22.1155555555556C93.312 20.0533333333334 92.3164444444445 18.2897777777778 91.008 16.9102222222222C90.2826666666667 16.1564444444445 88.7893333333334 14.9617777777778 88.32 14.7484444444444C88.2062222222223 14.6915555555556 88.0071111111111 14.592 87.8933333333334 14.5208888888889C87.5377777777778 14.2933333333333 86.4284444444445 13.8382222222222 85.8311111111111 13.6533333333333C85.5182222222223 13.568 85.0773333333334 13.4257777777778 84.8355555555556 13.3546666666667C84.608 13.2835555555556 83.9111111111111 13.184 83.3137777777778 13.1271111111111C82.0622222222223 13.0275555555555 82.2471111111111 12.8142222222222 81.8488888888889 14.7911111111111C81.4648888888889 16.7395555555556 81.1377777777778 17.408 78.4071111111111 21.9733333333333C77.4826666666667 23.5377777777778 76.672 24.9173333333333 76.6151111111111 25.0311111111111C76.5582222222222 25.1448888888889 76.3875555555556 25.4435555555555 76.2311111111111 25.6711111111111C76.0746666666667 25.9128888888889 75.8897777777778 26.2257777777778 75.8044444444445 26.3822222222222C75.7191111111111 26.5386666666667 75.5342222222222 26.8657777777778 75.3777777777778 27.0933333333333C75.2213333333334 27.3351111111111 75.0506666666667 27.6195555555556 74.9937777777778 27.7333333333333C74.9368888888889 27.8471111111111 74.5386666666667 28.5582222222222 74.0835555555556 29.2977777777778C73.0737777777778 30.976 73.0453333333334 31.1182222222222 73.3155555555556 31.872C73.5715555555556 32.5831111111111 73.8844444444445 33.8062222222222 73.9982222222222 34.5884444444445C74.112 35.3137777777778 73.8844444444445 35.4133333333333 72.0497777777778 35.4133333333333C70.1297777777778 35.4133333333333 69.8311111111111 35.2995555555556 69.8311111111111 34.6026666666667C69.8311111111111 33.5075555555555 68.8782222222222 31.7155555555556 67.7973333333333 30.7911111111111C66.7591111111111 29.9093333333333 65.1662222222222 29.2977777777778 63.8577777777778 29.2977777777778C61.5964444444445 29.2977777777778 59.3351111111111 30.7768888888889 58.3111111111111 32.9102222222222C57.8702222222222 33.8346666666667 57.8417777777778 34.0195555555555 57.7991111111111 35.6835555555556C57.7706666666667 36.6648888888889 57.7422222222222 37.5608888888889 57.7422222222222 37.6604444444444C57.7422222222222 37.888 56.9173333333333 37.8453333333333 54.8693333333333 37.5466666666667C51.8968888888889 37.12 48.768 38.2435555555555 46.4355555555556 40.6186666666667C44.8711111111111 42.2115555555556 44.0888888888889 43.776 43.7048888888889 46.1511111111111C43.3777777777778 48.2133333333333 43.776 50.5173333333333 44.8142222222222 52.4231111111111C46.7768888888889 56.064 50.8728888888889 58.1546666666667 54.9404444444445 57.6C55.6657777777778 57.5004444444444 56.4622222222222 57.344 56.7324444444445 57.2302222222222C56.9884444444445 57.1164444444444 57.3013333333334 57.0311111111111 57.4008888888889 57.0311111111111C57.5004444444445 57.0311111111111 58.1262222222222 56.7182222222222 58.7662222222222 56.3342222222222C59.8328888888889 55.7084444444445 61.1271111111111 54.5706666666667 61.8382222222222 53.6177777777778C62.7626666666667 52.3946666666667 63.616 50.2044444444445 63.7866666666667 48.5973333333333L63.8862222222222 47.6444444444444L65.8631111111111 47.6444444444444C66.944 47.6444444444444 67.8542222222222 47.7013333333333 67.8968888888889 47.7582222222222C67.9964444444445 47.9146666666667 67.6124444444445 50.6737777777778 67.456 51.0008888888889C67.3706666666667 51.1431111111111 67.2711111111111 51.5128888888889 67.2284444444445 51.8115555555555C67.1146666666667 52.5653333333333 65.7635555555556 55.296 65.28 55.7511111111111C65.2373333333333 55.7937777777778 64.9671111111111 56.1493333333333 64.6826666666667 56.5333333333333C63.1608888888889 58.6382222222222 59.6622222222222 60.7857777777778 56.6755555555556 61.4542222222222L55.8222222222222 61.6533333333333L55.7795555555556 78.976L55.7511111111111 96.2844444444444L57.5146666666667 96.2844444444444C58.4817777777778 96.2844444444444 59.3777777777778 96.3271111111111 59.5057777777778 96.3697777777778C59.8471111111111 96.4977777777778 59.8471111111111 100.3377777777778 59.5057777777778 100.4657777777778C59.3777777777778 100.5084444444444 57.7137777777778 100.5511111111111 55.808 100.5511111111111C53.4897777777778 100.5511111111111 52.3377777777778 100.5937777777778 52.3377777777778 100.6933333333333C52.3377777777778 100.7786666666667 52.5937777777778 101.1768888888889 52.8924444444445 101.5893333333333C53.4471111111111 102.3288888888889 54.8977777777778 105.2017777777778 54.8977777777778 105.5857777777778C54.8977777777778 105.6853333333333 54.9973333333333 106.0408888888889 55.1111111111111 106.368C55.3813333333333 107.1502222222222 55.7937777777778 109.9235555555556 55.68 110.3217777777778C55.6088888888889 110.6346666666667 55.552 110.6488888888889 53.7742222222222 110.6488888888889C52.4231111111111 110.6488888888889 51.9111111111111 110.6062222222222 51.7831111111111 110.464C51.6977777777778 110.3502222222222 51.5697777777778 109.6817777777778 51.4986666666667 108.9706666666667C51.4275555555556 108.2595555555556 51.2995555555556 107.5484444444444 51.2142222222222 107.392C51.1288888888889 107.2355555555556 51.0577777777778 107.008 51.0577777777778 106.8942222222222C51.0577777777778 106.5671111111111 50.2328888888889 104.8746666666667 49.6497777777778 103.9644444444444C49.024 103.0257777777778 47.6302222222222 101.504 46.8764444444445 100.9493333333333L46.3217777777778 100.5511111111111L39.3671111111111 100.5511111111111L32.4124444444445 100.5511111111111L31.0897777777778 101.8737777777778C29.696 103.2533333333333 29.1413333333333 103.9928888888889 28.544 105.2586666666667C27.136 108.2453333333333 26.9511111111111 111.0186666666667 27.9324444444445 114.4177777777778C28.2026666666667 115.3991111111111 29.2266666666667 117.3048888888889 29.824 117.9875555555556C30.0942222222222 118.2862222222222 30.4213333333333 118.6844444444445 30.5351111111111 118.8693333333333C30.9191111111111 119.4382222222222 33.0097777777778 120.96 34.1333333333333 121.4862222222222C35.1857777777778 121.9982222222222 35.5128888888889 122.112 36.9066666666667 122.5102222222222C37.9164444444445 122.8088888888889 40.8746666666667 122.7946666666667 42.0693333333333 122.5102222222222zM51.5982222222222 79.0471111111111L51.6266666666667 61.8808888888889L51.2853333333333 61.6533333333333C51.1004444444445 61.5253333333334 50.6026666666667 61.3688888888889 50.1902222222222 61.312C48.4266666666667 61.0133333333333 45.6675555555556 59.4631111111111 43.8613333333333 57.7706666666667C42.2257777777778 56.2346666666667 40.7608888888889 53.888 40.192 51.9111111111111C40.0497777777778 51.3991111111111 39.8648888888889 50.8017777777778 39.7795555555556 50.56C39.6942222222222 50.3324444444445 39.5946666666667 49.1093333333333 39.552 47.8577777777778L39.4666666666667 45.5822222222222L31.5875555555556 45.5395555555556C26.8231111111111 45.5253333333334 23.6373333333333 45.568 23.5662222222222 45.6391111111111C23.4524444444444 45.7528888888889 23.8791111111111 46.6488888888889 24.704 48C24.8035555555556 48.1564444444445 24.9457777777778 48.4124444444445 25.0311111111111 48.5688888888889C25.1164444444444 48.7253333333334 25.3013333333333 49.0524444444445 25.4577777777778 49.28C25.6142222222222 49.5217777777778 25.7991111111111 49.8346666666667 25.8702222222222 49.9911111111111C25.9413333333333 50.1475555555556 26.1688888888889 50.5173333333334 26.368 50.816C26.5671111111111 51.1146666666667 26.7377777777778 51.3848888888889 26.7377777777778 51.4133333333334C26.7377777777778 51.456 27.4915555555556 52.7502222222223 28.416 54.3004444444445C29.3404444444445 55.8364444444445 30.1368888888889 57.2017777777778 30.1937777777778 57.3155555555556C30.2506666666667 57.4293333333334 30.4213333333333 57.728 30.5635555555556 57.9555555555556C30.72 58.1973333333334 30.976 58.624 31.1324444444444 58.9226666666667C31.4311111111111 59.4488888888889 31.4311111111111 59.52 31.4311111111111 77.8666666666667L31.4311111111111 96.2844444444445L41.5004444444445 96.256L51.5555555555556 96.2133333333334L51.5982222222222 79.0471111111112zM40.8177777777778 41.344C40.9457777777778 41.2444444444444 41.3155555555556 40.704 41.6568888888889 40.1208888888889C42.3822222222222 38.8835555555555 44.0177777777778 37.12 45.3546666666667 36.1386666666667C47.4168888888889 34.6026666666667 49.792 33.7066666666667 52.3377777777778 33.4933333333333C53.7031111111111 33.3795555555556 54.0444444444444 33.2515555555556 54.0444444444444 32.8533333333333C54.0444444444444 32.2986666666667 55.168 30.0231111111111 55.8648888888889 29.1697777777778C57.2302222222222 27.4915555555556 58.8942222222222 26.3537777777778 61.0133333333333 25.6568888888889C61.6248888888889 25.4435555555555 62.2364444444445 25.3866666666667 63.8577777777778 25.3866666666667C65.6355555555556 25.3866666666667 66.048 25.4293333333333 66.816 25.7137777777778C67.9395555555556 26.112 69.0346666666667 26.6666666666667 69.6462222222222 27.136C69.9022222222222 27.3208888888889 70.2008888888889 27.4488888888889 70.3146666666667 27.4062222222222C70.4711111111111 27.3351111111111 72.3911111111111 24.3057777777778 72.3911111111111 24.1066666666667C72.3911111111111 24.0782222222222 72.5617777777778 23.808 72.7608888888889 23.5093333333333C72.96 23.2106666666666 73.1875555555556 22.8408888888889 73.2586666666667 22.6844444444444C73.3297777777778 22.528 73.5146666666667 22.2151111111111 73.6711111111111 21.9733333333333C73.8275555555556 21.7457777777778 74.0124444444444 21.4186666666667 74.0977777777778 21.2622222222222C74.1831111111111 21.1057777777778 74.368 20.7928888888889 74.5244444444444 20.5511111111111C74.6808888888889 20.3235555555555 74.8515555555556 20.0248888888889 74.9084444444445 19.9111111111111C74.9653333333333 19.7973333333333 75.3351111111111 19.1573333333333 75.7333333333333 18.4888888888889C77.7671111111111 15.1324444444444 77.9946666666667 14.5066666666666 77.9804444444445 12.4444444444444C77.9804444444445 11.3208888888889 77.9093333333333 10.6951111111111 77.7244444444445 10.24C76.7004444444444 7.5662222222222 75.2924444444444 6.1724444444444 72.6755555555556 5.248C71.936 4.992 71.4382222222222 4.9777777777778 62.1226666666667 4.9777777777778C56.6328888888889 4.9777777777778 52.3377777777778 5.0346666666667 52.3377777777778 5.1057777777778C52.3377777777778 5.1768888888889 52.7928888888889 5.376 53.3617777777778 5.5608888888889C54.4853333333333 5.9164444444444 55.9644444444444 6.6417777777778 56.7466666666667 7.2248888888889C57.4293333333333 7.7368888888889 59.0506666666667 9.344 59.4773333333333 9.9555555555555C60.0035555555556 10.6808888888889 60.7146666666667 12.0604444444444 61.0133333333333 12.8711111111111C61.6675555555556 14.72 61.7386666666667 15.1751111111111 61.7386666666667 17.1662222222222C61.7386666666667 18.9582222222222 61.696 19.2426666666667 61.2977777777778 20.48C60.3733333333333 23.3528888888889 58.9653333333333 25.3155555555556 56.6044444444445 27.0506666666667C54.7413333333333 28.416 52.0106666666667 29.2977777777778 49.6355555555556 29.2977777777778C46.9475555555556 29.2977777777778 44.2453333333333 28.3022222222222 41.9697777777778 26.496C40.4337777777778 25.2728888888889 38.6417777777778 22.8124444444444 38.2435555555556 21.4044444444445C37.5466666666667 18.9013333333333 37.4044444444445 18.176 37.4044444444445 17.1662222222222C37.4044444444445 14.4071111111111 38.6133333333333 11.2355555555556 40.4622222222222 9.1733333333333C42.0551111111111 7.3813333333333 43.776 6.2435555555556 45.9093333333333 5.5608888888889C46.464 5.376 46.8906666666667 5.1768888888889 46.848 5.1057777777778C46.8053333333333 5.0346666666667 39.0684444444445 4.9777777777778 28.9706666666667 4.9777777777778C11.7475555555556 4.9777777777778 11.136 4.992 10.2826666666667 5.2622222222222C9.2444444444445 5.5893333333333 9.0168888888889 5.7031111111111 7.936 6.5137777777778C6.0017777777778 7.9502222222222 4.9777777777778 10.0408888888889 4.9777777777778 12.5155555555556C4.9777777777778 14.4213333333333 5.2622222222222 15.1608888888889 7.1822222222222 18.3466666666667C7.5804444444445 19.0151111111111 7.9502222222222 19.6551111111111 8.0071111111111 19.7688888888889C8.064 19.8826666666667 8.2346666666667 20.1813333333333 8.3911111111111 20.4088888888889C8.5475555555556 20.6506666666667 8.7324444444445 20.9635555555556 8.8177777777778 21.12C8.8888888888889 21.2764444444445 9.0168888888889 21.504 9.1022222222222 21.6177777777778C9.4008888888889 22.0728888888889 12.6577777777778 27.6053333333333 12.6577777777778 27.6622222222222C12.6577777777778 27.6906666666667 12.8426666666667 27.9893333333333 13.0702222222222 28.3306666666667C13.4684444444445 28.9422222222222 13.9377777777778 29.7244444444444 14.5066666666667 30.7911111111111C14.6773333333334 31.104 15.0044444444445 31.6302222222222 15.232 31.9715555555556C15.4595555555556 32.3128888888889 15.6444444444445 32.6115555555556 15.6444444444445 32.6257777777778C15.6444444444445 32.6542222222222 16.2986666666667 33.792 17.1093333333334 35.1431111111111C17.92 36.5084444444445 18.6168888888889 37.7173333333333 18.6737777777778 37.8311111111111C18.7306666666667 37.9448888888889 18.9013333333334 38.2435555555555 19.0577777777778 38.4711111111111C19.2142222222222 38.7128888888889 19.3991111111111 39.0257777777778 19.4844444444445 39.1822222222222C19.5697777777778 39.3386666666667 19.7546666666667 39.6657777777778 19.9111111111111 39.8933333333333C20.0675555555556 40.1351111111111 20.2382222222222 40.4195555555556 20.2951111111111 40.5333333333333C20.352 40.6471111111111 20.5226666666667 40.9173333333333 20.6791111111111 41.1448888888889L20.9635555555556 41.5288888888889L30.7768888888889 41.5288888888889C38.2862222222222 41.5146666666667 40.6613333333333 41.472 40.8177777777778 41.344zM52.2666666666667 24.7608888888889C53.2195555555556 24.3911111111111 53.5751111111111 24.2062222222222 54.4284444444444 23.5662222222222C56.8462222222222 21.8026666666667 58.0693333333333 18.816 57.6142222222222 15.9146666666667C57.0453333333333 12.3591111111111 54.4568888888889 9.7564444444445 50.9013333333333 9.1448888888889C49.7635555555556 8.96 49.5075555555556 8.96 48.3697777777778 9.1448888888889C45.3688888888889 9.6568888888889 43.1075555555556 11.52 42.0266666666667 14.3786666666667C41.6568888888889 15.3173333333333 41.6142222222222 15.6017777777778 41.6284444444444 17.1377777777778C41.6284444444444 18.9724444444444 41.728 19.3422222222222 42.5671111111111 21.0062222222222C43.5342222222222 22.9262222222222 45.8951111111111 24.6613333333333 48.0711111111111 25.0453333333333C49.1235555555555 25.2302222222222 51.4702222222222 25.0737777777778 52.2666666666667 24.7608888888889zM115.6835555555556 24.7324444444444C117.3191111111111 24.1777777777778 118.4711111111111 23.4666666666667 119.7511111111111 22.1866666666667C120.7608888888889 21.1911111111111 121.088 20.736 121.6426666666667 19.6408888888889C122.0124444444445 18.9155555555556 122.3111111111111 18.2044444444444 122.3111111111111 18.0622222222222C122.3111111111111 17.92 122.4106666666667 17.5786666666667 122.5244444444445 17.3084444444444C122.8088888888889 16.6257777777778 122.8231111111111 13.5964444444444 122.5386666666667 12.8426666666667C122.4391111111111 12.544 122.24 11.9324444444445 122.0977777777778 11.4773333333333C121.9555555555556 11.0222222222222 121.7848888888889 10.624 121.728 10.5813333333333C121.6711111111111 10.5528888888889 121.472 10.2257777777778 121.3013333333334 9.8417777777778C121.1164444444445 9.4577777777778 120.448 8.6471111111111 119.7653333333334 7.9644444444444C118.7697777777778 6.9688888888889 118.2862222222223 6.6133333333333 117.2053333333334 6.0728888888889C116.48 5.7031111111111 115.7688888888889 5.4044444444445 115.6266666666667 5.4044444444445C115.4844444444445 5.4044444444445 115.1431111111111 5.3048888888889 114.8728888888889 5.1911111111111C114.176 4.9066666666667 111.232 4.9066666666667 110.4355555555556 5.1911111111111C110.1226666666667 5.3048888888889 109.7671111111111 5.4044444444445 109.6391111111111 5.4044444444445C109.2551111111111 5.4044444444445 107.1786666666667 6.4853333333333 106.4533333333334 7.0684444444445C106.0693333333334 7.3813333333333 105.3724444444445 8.0071111111111 104.9173333333334 8.448C104.4622222222222 8.8888888888889 104.0071111111111 9.2444444444445 103.9075555555556 9.2444444444445C103.7937777777778 9.2444444444445 103.6231111111111 9.1022222222222 103.4951111111111 8.9173333333334C103.0257777777778 8.192 101.1768888888889 6.4995555555556 100.352 6.0586666666667C98.8728888888889 5.2337777777778 97.9484444444445 4.9777777777778 96.4266666666667 4.9777777777778C94.208 4.9777777777778 92.2595555555556 5.7742222222222 90.7662222222222 7.2817777777778C89.9697777777778 8.0782222222223 89.1164444444445 9.344 88.96 9.9697777777778C88.8604444444445 10.368 89.0311111111111 10.5244444444445 90.3111111111111 11.2071111111111C92.3591111111111 12.3022222222223 94.9048888888889 14.8195555555556 96.1564444444445 16.9955555555556C96.768 18.0764444444445 97.5644444444445 19.8826666666667 97.5644444444445 20.2097777777778C97.5644444444445 20.352 97.664 20.5653333333334 97.792 20.6933333333334C98.3324444444445 21.2337777777778 100.5368888888889 20.224 101.9875555555556 18.7875555555556C103.424 17.3511111111111 104.192 15.8151111111112 104.3768888888889 14.08L104.4622222222222 13.1555555555556L106.4675555555556 13.1128888888889C108.1742222222222 13.0844444444445 108.5013333333334 13.1128888888889 108.5724444444445 13.2977777777778C108.672 13.5822222222223 108.3164444444445 15.6017777777778 107.9466666666667 16.768C107.5626666666667 17.9626666666667 106.6382222222222 19.6551111111111 105.8844444444445 20.5511111111111C104.96 21.6462222222223 104.96 21.7457777777778 105.8844444444445 22.5564444444445C106.7662222222222 23.3386666666667 108.8568888888889 24.6044444444445 109.2693333333334 24.6044444444445C109.4115555555556 24.6044444444445 109.6675555555556 24.6897777777778 109.8382222222222 24.7751111111111C110.6631111111111 25.2444444444445 114.2471111111111 25.216 115.6835555555556 24.7324444444445zM27.0222222222222 37.0631111111111C25.4293333333333 36.5226666666667 24.704 36.0817777777778 23.6088888888889 34.9866666666667C21.9875555555556 33.3653333333333 21.1911111111111 31.488 21.1911111111111 29.2977777777778C21.1911111111111 27.8186666666667 21.5182222222222 26.6808888888889 22.4284444444444 24.96C22.7271111111111 24.4053333333333 24.4053333333333 22.7271111111111 24.96 22.4284444444445C27.9466666666667 20.8497777777778 30.2506666666667 20.7644444444445 33.1093333333333 22.144C34.1902222222222 22.6702222222222 35.9253333333333 24.4053333333333 36.4515555555556 25.4862222222222C37.7173333333333 28.1315555555556 37.7315555555556 30.464 36.4657777777778 33.0808888888889C35.9111111111111 34.2044444444445 34.2044444444445 35.9111111111111 33.0808888888889 36.4657777777778C31.0186666666667 37.4613333333333 28.8142222222222 37.6746666666667 27.0222222222222 37.0631111111111zM31.2462222222222 32.8391111111111C31.9431111111111 32.4124444444444 32.4266666666667 31.9288888888889 32.8533333333333 31.2177777777778C33.1662222222222 30.72 33.2088888888889 30.4782222222222 33.2088888888889 29.2835555555556C33.2088888888889 28.0462222222222 33.1804444444445 27.8755555555556 32.8248888888889 27.3493333333333C32.3128888888889 26.5671111111111 31.8862222222222 26.1404444444444 31.2177777777778 25.728C30.72 25.4293333333333 30.4782222222222 25.3866666666667 29.2835555555556 25.3866666666667C27.9324444444444 25.3866666666667 27.904 25.4008888888889 27.1502222222222 25.9128888888889C26.7235555555556 26.2115555555556 26.1546666666667 26.7804444444445 25.8844444444444 27.1786666666667C25.4008888888889 27.8897777777778 25.3866666666667 27.9608888888889 25.3866666666667 29.2835555555556C25.3866666666667 30.4924444444444 25.4293333333333 30.72 25.7422222222222 31.2177777777778C26.3253333333333 32.1564444444444 27.264 32.9528888888889 28.0604444444444 33.152C28.9137777777778 33.3653333333333 30.6631111111111 33.1946666666667 31.2462222222222 32.8391111111111zM100.9066666666667 86.0444444444445C100.0391111111111 85.9306666666667 99.1573333333333 85.6746666666667 98.2755555555556 85.2764444444445C97.408 84.8782222222222 96.256 84.096 95.5733333333333 83.456C94.3644444444445 82.3182222222222 93.2124444444444 80.4266666666667 92.672 78.6915555555556C92.3448888888889 77.6391111111111 92.3448888888889 74.4675555555556 92.672 73.472C93.3546666666667 71.3813333333334 94.0373333333333 70.2293333333333 95.3457777777778 68.9066666666667C96.5404444444444 67.6977777777778 97.6924444444445 67.0008888888889 99.4133333333333 66.4177777777778C100.5511111111111 66.0337777777778 100.8497777777778 65.9911111111111 102.4995555555556 65.9911111111111C104.32 65.9911111111111 104.7893333333334 66.0764444444445 106.3111111111111 66.688C107.8044444444444 67.2711111111111 109.6248888888889 68.6791111111111 110.5493333333333 69.9448888888889C111.1751111111111 70.7982222222222 112.0711111111111 72.5191111111111 112.0711111111111 72.8604444444444C112.0711111111111 73.0026666666667 112.1706666666667 73.3155555555556 112.2986666666667 73.5573333333333C112.64 74.2115555555556 112.6257777777778 77.5253333333333 112.2844444444445 78.6204444444445C111.3173333333333 81.7493333333333 109.3831111111111 84.0391111111111 106.6666666666667 85.2622222222222C105.0595555555556 86.0017777777778 102.8551111111111 86.3004444444444 100.9066666666667 86.0444444444444zM104.1066666666667 81.8915555555556C106.7662222222222 81.0808888888889 108.5724444444444 78.6915555555556 108.5582222222222 76.0177777777778C108.544 73.3155555555556 106.5528888888889 70.784 103.9644444444444 70.1724444444444C101.6177777777778 69.6035555555556 99.0293333333333 70.5137777777778 97.6782222222222 72.3626666666667C96.8248888888889 73.5573333333333 96.4408888888889 74.6666666666667 96.4408888888889 76.0177777777778C96.4124444444444 79.1182222222222 98.5742222222222 81.5644444444444 101.8311111111111 82.1191111111111C102.3146666666667 82.2044444444445 103.4951111111111 82.0906666666667 104.1066666666667 81.8915555555556zM111.1466666666667 59.6053333333333C110.4071111111111 59.4915555555556 110.0942222222222 59.3777777777778 108.8 58.752C107.6337777777778 58.1973333333333 105.9555555555556 56.4906666666667 105.4008888888889 55.296C104.9173333333334 54.2435555555555 104.5333333333333 52.6648888888889 104.5333333333333 51.712C104.5333333333333 50.4746666666667 105.0453333333333 48.4408888888889 105.4862222222222 47.9146666666667C105.5857777777778 47.8008888888889 105.6711111111111 47.6444444444444 105.6711111111111 47.5733333333333C105.6711111111111 47.3031111111111 106.9226666666667 45.8666666666667 107.648 45.312C108.7715555555556 44.4586666666667 109.9377777777778 43.9466666666667 111.3884444444444 43.6906666666667C112.5262222222222 43.4915555555556 112.7537777777778 43.4915555555556 113.8915555555556 43.6906666666667C117.0204444444444 44.2453333333333 119.3955555555556 46.2933333333333 120.3911111111111 49.28C120.7893333333333 50.4888888888889 120.7751111111111 52.9208888888889 120.3484444444445 54.144C119.8364444444445 55.6088888888889 119.3813333333334 56.32 118.272 57.4577777777778C117.5608888888889 58.1688888888889 116.6506666666667 58.7235555555556 115.1715555555556 59.3493333333334C114.56 59.6195555555556 112.1848888888889 59.7617777777778 111.1466666666667 59.6053333333334zM113.9768888888889 55.4524444444445C115.4417777777778 54.8835555555556 116.4515555555556 53.632 116.7075555555556 52.0817777777778C116.864 51.0577777777778 116.2524444444444 49.536 115.2995555555556 48.6257777777778C114.3608888888889 47.7155555555556 112.5546666666667 47.3884444444444 111.2177777777778 47.8862222222222C110.4071111111111 48.1706666666667 109.2977777777778 49.2373333333333 108.928 50.048C108.544 50.9155555555556 108.5582222222222 52.4231111111111 108.9564444444444 53.2764444444445C109.568 54.6275555555556 111.1751111111111 55.7226666666667 112.5973333333334 55.7368888888889C112.9102222222222 55.7511111111111 113.536 55.6088888888889 113.9768888888889 55.4524444444445z" />
     <glyph glyph-name="boiling-flask-1"
       unicode="&#x62;&#x6F;&#x69;&#x6C;&#x69;&#x6E;&#x67;&#x2D;&#x66;&#x6C;&#x61;&#x73;&#x6B;"
       horiz-adv-x="128" d="M37.0488888888889 126.6915555555556C35.0862222222222 126.3786666666667 32.64 125.4968888888889 31.0755555555556 124.544C28.6862222222222 123.0933333333334 25.9555555555556 120.1635555555556 25.0311111111111 118.0871111111111C24.96 117.9022222222222 24.7608888888889 117.4897777777778 24.6044444444444 117.1626666666667C24.2488888888889 116.4373333333334 23.8506666666667 115.2142222222222 23.5377777777778 113.8915555555556C23.2248888888889 112.5546666666667 23.2248888888889 108.7004444444445 23.5377777777778 107.4773333333334C24.0497777777778 105.4862222222222 24.2631111111111 104.8462222222222 24.6328888888889 104.1208888888889C24.8604444444444 103.6942222222222 25.0311111111111 103.2817777777778 25.0311111111111 103.2248888888889C25.0311111111111 103.0542222222222 26.2684444444444 101.1626666666667 26.4533333333333 101.0488888888889C26.5244444444444 101.0062222222222 26.5955555555556 100.864 26.5955555555556 100.7502222222222C26.5955555555556 100.5937777777778 26.2968888888889 100.5511111111111 25.0311111111111 100.5511111111111C23.6373333333333 100.5511111111111 23.4666666666667 100.5226666666667 23.3244444444444 100.2808888888889C23.2533333333333 100.1244444444445 23.1822222222222 99.2853333333333 23.1822222222222 98.4177777777778C23.1822222222222 97.5502222222222 23.2533333333333 96.7111111111111 23.3244444444444 96.5546666666667C23.4666666666667 96.3128888888889 23.6373333333333 96.2844444444445 25.3155555555556 96.2844444444445C26.6951111111111 96.2844444444445 27.1644444444444 96.2417777777778 27.1644444444444 96.1137777777778C27.1644444444444 96.0142222222222 27.1644444444444 87.8791111111111 27.1644444444444 78.0515555555556L27.1644444444444 60.1742222222222L25.6995555555556 57.6995555555556C24.8888888888889 56.3484444444445 24.1777777777778 55.1395555555556 24.1351111111111 55.0257777777778C24.0782222222222 54.912 23.9075555555556 54.6417777777778 23.7511111111111 54.4C23.5946666666667 54.1724444444445 23.4097777777778 53.8453333333334 23.3244444444444 53.6888888888889C23.2391111111111 53.5324444444445 23.0542222222222 53.2195555555556 22.8977777777778 52.9777777777778C22.7413333333333 52.7502222222222 22.5706666666667 52.4515555555556 22.5137777777778 52.3377777777778C22.4568888888889 52.224 21.5751111111111 50.7164444444445 20.5511111111111 48.9955555555556C19.5271111111111 47.2746666666667 18.6453333333333 45.7671111111111 18.5884444444444 45.6533333333334C18.5315555555556 45.5395555555556 18.3608888888889 45.2551111111111 18.2044444444444 45.0133333333334C18.048 44.7857777777778 17.8631111111111 44.4586666666667 17.7777777777778 44.3022222222222C17.6924444444444 44.1457777777778 17.4933333333333 43.7902222222222 17.3368888888889 43.52C16.8533333333333 42.7093333333334 12.9848888888889 36.1955555555556 12.672 35.6693333333333C12.5155555555556 35.4133333333334 12.2595555555556 34.944 12.0888888888889 34.6311111111111C11.9182222222222 34.3182222222222 11.5911111111111 33.792 11.3635555555556 33.4506666666667C11.136 33.1093333333334 10.9511111111111 32.8106666666667 10.9511111111111 32.7822222222222C10.9511111111111 32.7395555555556 10.2968888888889 31.6017777777778 9.4862222222222 30.2648888888889C8.6755555555556 28.9137777777778 7.9786666666667 27.7048888888889 7.9217777777778 27.5911111111111C7.8648888888889 27.4773333333334 7.6942222222222 27.1928888888889 7.5377777777778 26.9511111111111C7.3813333333333 26.7235555555556 7.1964444444444 26.3964444444445 7.1111111111111 26.24C7.0257777777778 26.0835555555556 6.8408888888889 25.7706666666667 6.6844444444444 25.5288888888889C6.528 25.3013333333333 6.3573333333333 25.0026666666667 6.3004444444444 24.8888888888889C6.2435555555556 24.7751111111111 5.3617777777778 23.2675555555556 4.3377777777778 21.5466666666667C1.92 17.4791111111111 1.3937777777778 16.3555555555556 1.1235555555556 14.8622222222222C0.8675555555556 13.4257777777778 0.8391111111111 12.1457777777778 1.0382222222222 10.8088888888889C1.2373333333333 9.5004444444445 1.3511111111111 9.1022222222222 1.8346666666667 7.8933333333333C2.8302222222222 5.3617777777778 5.3617777777778 2.8302222222222 7.8933333333333 1.8346666666667C10.4675555555556 0.8106666666667 8.5902222222222 0.8675555555556 41.6568888888889 0.8533333333334C62.5493333333333 0.8533333333334 71.5804444444444 0.896 72.2346666666667 1.0097777777778C73.3866666666667 1.1946666666667 75.0648888888889 1.6924444444445 75.1786666666667 1.8631111111111C75.2213333333333 1.9342222222222 75.3493333333334 1.9911111111111 75.4631111111111 1.9911111111111C75.5768888888889 1.9911111111111 76.2026666666667 2.3324444444445 76.8426666666667 2.7591111111111C78.0657777777778 3.5555555555556 79.488 4.9351111111111 80.0995555555556 5.9022222222222C80.64 6.7555555555556 81.3511111111111 8.1208888888889 81.3511111111111 8.3057777777778C81.3653333333333 8.7466666666667 81.664 8.8746666666667 83.072 9.0453333333333C83.8826666666667 9.1306666666667 84.608 9.1875555555556 84.6933333333333 9.1448888888889C84.7928888888889 9.1164444444445 84.9493333333333 8.9173333333334 85.0488888888889 8.704C85.1342222222222 8.4906666666667 85.3191111111111 8.0924444444445 85.4471111111111 7.8222222222222C85.5751111111111 7.552 85.8595555555556 7.0542222222222 86.0728888888889 6.7128888888889C86.2862222222222 6.3715555555556 86.4711111111111 6.0444444444445 86.4711111111111 5.9875555555556C86.4711111111111 5.7457777777778 88.832 3.4702222222222 89.6 2.9724444444445C92.1884444444444 1.28 94.7626666666667 0.64 97.6213333333333 0.9813333333334C99.8542222222222 1.2373333333333 101.5182222222222 1.8488888888889 103.2675555555556 3.0577777777778C103.6657777777778 3.328 104.0497777777778 3.5555555555556 104.1066666666667 3.5555555555556C104.2488888888889 3.5555555555556 104.7324444444444 3.2853333333334 105.4862222222222 2.8017777777778C105.8275555555556 2.5884444444445 106.1262222222222 2.4177777777778 106.1688888888889 2.4177777777778C106.2115555555555 2.4177777777778 106.6382222222222 2.2328888888889 107.1217777777778 2.0053333333334C109.4115555555556 0.9528888888889 112.3982222222222 0.64 115.2711111111111 1.1235555555556C118.0017777777778 1.5928888888889 120.5617777777778 2.944 122.6666666666667 5.0488888888889C126.3217777777778 8.704 127.6586666666667 13.7386666666667 126.336 18.8444444444445C126.08 19.8542222222222 126.0231111111111 19.9964444444445 125.4542222222222 21.1911111111111C124.5155555555555 23.168 123.1928888888889 24.8177777777778 121.4435555555555 26.1831111111111C120.2631111111111 27.1217777777778 120.1351111111111 27.1928888888889 118.784 27.8755555555556C114.9013333333333 29.7813333333334 110.3217777777777 29.7528888888889 106.3111111111111 27.8044444444445C104.9742222222222 27.1502222222222 103.5377777777777 26.0977777777778 102.5137777777777 25.0026666666667C101.5893333333333 24.0213333333333 101.6888888888888 24.0355555555556 99.6977777777777 24.704L98.4888888888888 25.1164444444445L98.3893333333333 26.1831111111111C98.1191111111111 29.0702222222222 97.1662222222222 31.9431111111111 95.8293333333333 33.9342222222222C95.4311111111111 34.5315555555556 95.3173333333333 35.1857777777778 95.5591111111111 35.328C95.7866666666666 35.4702222222222 96.9813333333333 38.0302222222222 97.3368888888888 39.1253333333333C99.3422222222222 45.312 98.4888888888888 51.5555555555556 94.8906666666666 56.8888888888889C92.5582222222222 60.3164444444444 89.6711111111111 62.6488888888889 85.5466666666666 64.4408888888889C84.9208888888888 64.7111111111111 83.9537777777777 65.024 83.3706666666666 65.152C82.3608888888888 65.3511111111111 81.9911111111111 65.5928888888889 82.0337777777777 65.9911111111111C82.1475555555555 67.0293333333333 82.1048888888888 69.6888888888889 81.9626666666666 70.1582222222222C81.8631111111111 70.4568888888889 81.8204444444444 70.784 81.8631111111111 70.8835555555556C81.9057777777777 70.9831111111111 82.3893333333333 71.2675555555556 82.9582222222222 71.5377777777778C85.5751111111111 72.7466666666667 88.6328888888888 75.4204444444445 89.7422222222222 77.4542222222222C89.9128888888889 77.7671111111111 90.1688888888889 78.208 90.3253333333333 78.4355555555556C90.4675555555555 78.6773333333333 90.624 78.9617777777778 90.6808888888889 79.0755555555556C91.7048888888889 81.6497777777778 91.8044444444444 81.9768888888889 92.0888888888889 83.9822222222222C92.3448888888888 85.7031111111111 92.3591111111111 86.8835555555556 92.1457777777777 88.3911111111111C91.7333333333333 91.5342222222222 90.4248888888888 94.3928888888889 88.2346666666666 96.9244444444445C87.6515555555555 97.6071111111111 87.1822222222222 98.2186666666667 87.1822222222222 98.2897777777778C87.1822222222222 98.3608888888889 87.3102222222222 98.816 87.4524444444444 99.2995555555556C88.0071111111111 101.1626666666667 88.0924444444444 101.6888888888889 88.1493333333333 104.0497777777778C88.2204444444444 106.9511111111111 87.9644444444444 108.5155555555556 86.983111111111 111.1466666666667C86.0586666666666 113.664 84.0106666666666 116.5368888888889 81.8773333333333 118.3288888888889C79.2319999999999 120.5617777777778 76.8142222222222 121.728 73.3439999999999 122.4675555555556C71.04 122.9511111111111 66.7164444444444 122.7235555555556 64.7111111111111 122.0124444444445C63.5875555555555 121.6284444444445 63.0328888888888 121.4008888888889 62.3359999999999 121.088C61.4115555555555 120.6613333333334 61.1413333333333 120.6613333333334 60.4444444444444 121.1022222222222C60.1315555555555 121.3013333333334 59.8044444444444 121.4577777777778 59.7191111111111 121.4577777777778C59.6337777777777 121.4577777777778 59.3919999999999 121.5431111111111 59.1928888888888 121.6568888888889C58.6666666666666 121.9271111111111 57.7137777777777 122.24 56.5191111111111 122.5244444444445C55.7368888888888 122.7093333333334 55.0257777777777 122.752 53.3902222222222 122.6951111111111C52.2239999999999 122.6666666666667 51.143111111111 122.5955555555556 50.9724444444444 122.5386666666667C50.7448888888888 122.4533333333334 50.4604444444444 122.6097777777778 49.6639999999999 123.2355555555556C47.8577777777777 124.6435555555556 45.8382222222222 125.696 43.8897777777777 126.2364444444445C41.8275555555555 126.8053333333333 38.9831111111111 126.9902222222222 37.0488888888888 126.6915555555556zM42.0693333333333 122.5102222222222C44.5866666666667 121.8844444444445 46.4782222222222 120.7893333333334 48.384 118.8408888888889C49.2942222222222 117.9164444444445 49.6355555555556 117.8311111111111 50.6311111111111 118.2293333333334C50.9013333333333 118.3431111111111 51.712 118.5137777777778 52.4373333333333 118.6133333333334C56.576 119.1822222222222 60.5866666666667 117.0773333333334 62.6915555555556 113.2088888888889C63.1893333333334 112.2986666666667 63.8577777777778 109.9946666666667 63.8577777777778 109.1982222222222L63.8577777777778 108.6577777777778L65.8631111111111 108.6577777777778L67.8684444444445 108.6577777777778L67.7688888888889 110.0515555555556C67.712 110.8053333333333 67.5697777777778 111.6444444444445 67.4702222222222 111.9146666666667C67.3564444444445 112.1706666666667 67.2711111111111 112.512 67.2711111111111 112.6542222222222C67.2711111111111 113.152 66.0622222222222 115.6551111111111 65.3084444444445 116.6791111111111C64.9244444444445 117.2053333333334 64.8391111111111 117.4186666666667 64.9528888888889 117.6035555555556C65.1662222222222 117.9448888888889 66.7022222222222 118.3857777777778 68.3946666666667 118.6133333333334C69.7031111111111 118.784 70.0871111111111 118.784 71.5946666666667 118.5706666666667C73.7422222222222 118.2862222222222 74.5386666666667 118.0586666666667 76.0746666666667 117.3191111111111C80.5546666666667 115.1431111111111 83.3991111111111 111.1466666666667 84.0675555555556 106.0551111111111C84.4373333333334 103.2106666666667 83.7546666666667 100.0248888888889 82.176 97.3653333333333C81.1093333333334 95.5591111111111 79.9288888888889 94.2648888888889 78.1511111111112 92.9422222222222C76.288 91.5626666666667 73.088 90.4106666666667 70.6844444444445 90.2826666666667L70.0444444444445 90.24L70.0017777777778 88.3626666666667C69.9591111111111 86.1013333333333 69.9022222222223 86.1724444444445 71.7511111111111 86.3431111111111C74.5244444444445 86.6133333333334 77.5253333333334 87.6373333333334 79.616 89.0453333333334C79.9573333333334 89.2728888888889 80.256 89.4577777777778 80.3128888888889 89.4577777777778C80.4693333333334 89.4577777777778 82.5742222222223 91.2924444444444 83.2711111111111 92.032C83.6693333333333 92.4586666666667 84.2097777777778 93.0986666666667 84.48 93.4826666666667C84.736 93.8524444444445 84.992 94.1511111111111 85.0346666666667 94.1511111111111C85.4613333333333 94.1368888888889 86.9262222222222 91.8897777777778 87.4666666666667 90.4248888888889C88.5617777777778 87.424 88.4195555555556 83.9253333333333 87.0684444444445 81.0666666666667C86.2435555555556 79.3315555555556 84.6222222222222 77.3831111111111 83.1146666666667 76.3306666666667C82.2897777777778 75.7617777777778 80.7111111111111 74.9511111111111 80.4266666666667 74.9511111111111C80.3271111111111 74.9511111111111 80.0853333333334 75.1928888888889 79.9146666666667 75.4915555555556C78.8764444444445 77.2266666666667 76.9848888888889 79.0328888888889 75.0222222222223 80.1991111111111C73.8702222222223 80.8817777777778 71.808 81.6782222222222 70.7555555555556 81.8488888888889C68.8355555555556 82.1475555555556 68.3946666666667 82.1902222222222 68.2097777777778 82.1191111111111C68.0248888888889 82.048 67.9822222222223 81.7208888888889 67.9822222222223 80.128C67.9822222222223 77.952 67.9964444444445 77.9377777777778 69.2195555555556 77.9377777777778C70.9262222222223 77.9377777777778 73.4577777777778 76.7004444444445 75.0648888888889 75.0791111111111C75.9608888888889 74.1831111111111 76.4302222222223 73.5004444444444 77.0417777777778 72.2488888888889C77.8097777777778 70.6417777777778 77.9804444444445 69.888 77.9804444444445 67.9395555555556C77.9804444444445 66.3324444444445 77.9377777777778 66.0622222222222 77.5253333333334 64.8817777777778C76.9706666666667 63.2604444444445 76.3448888888889 62.1937777777778 75.3208888888889 61.056C73.7137777777778 59.2924444444445 70.9404444444445 57.8844444444445 69.0346666666667 57.8844444444445C68.6506666666667 57.8844444444445 68.2524444444445 57.8133333333334 68.1528888888889 57.7137777777778C67.9253333333334 57.4862222222222 67.9111111111111 54.0302222222222 68.1386666666667 53.8026666666667C68.2382222222222 53.7031111111111 68.48 53.6604444444445 68.6791111111111 53.6888888888889C71.552 54.1013333333333 72.6328888888889 54.4 74.3253333333334 55.2675555555556C76.7857777777778 56.5191111111111 78.6915555555556 58.3111111111111 80.1137777777778 60.672C80.6257777777778 61.5395555555556 80.6968888888889 61.5964444444445 81.0524444444445 61.4968888888889C81.2515555555556 61.44 81.6782222222223 61.3546666666667 81.9911111111111 61.2977777777778C82.3040000000001 61.2551111111111 82.7022222222223 61.1271111111111 82.8728888888889 61.0417777777778C83.0435555555556 60.9422222222222 83.2853333333334 60.8711111111111 83.3991111111112 60.8711111111111C83.6835555555556 60.8711111111111 85.5608888888889 59.9893333333334 86.5137777777778 59.4062222222222C87.424 58.8657777777778 89.0453333333334 57.5573333333334 89.8417777777778 56.7182222222223C91.1644444444445 55.3386666666667 92.7573333333334 52.7928888888889 93.3688888888889 51.0577777777778C94.1084444444445 48.9813333333334 94.1937777777778 48.384 94.1937777777778 45.5822222222223C94.1937777777778 42.8088888888889 94.1795555555556 42.6666666666667 93.4826666666667 40.4622222222223C93.1271111111111 39.3102222222223 92.3875555555556 37.8453333333334 91.4915555555556 36.5226666666667C89.3155555555556 33.28 86.2293333333334 31.0328888888889 82.4888888888889 29.952C81.536 29.6817777777778 79.488 29.312 78.72 29.2551111111111L78.1511111111112 29.2266666666667L78.1511111111112 27.3066666666667L78.1511111111112 25.3866666666667L79.7155555555556 25.4151111111111C81.5928888888889 25.4435555555556 82.7733333333334 25.7137777777778 85.5466666666667 26.6951111111111C86.3146666666667 26.9795555555556 88.3342222222223 27.9893333333334 88.6186666666667 28.2453333333334C88.7324444444445 28.3591111111111 88.8888888888889 28.4444444444445 88.9457777777778 28.4444444444445C89.088 28.4444444444445 91.2782222222223 30.1084444444445 91.8044444444445 30.6204444444445C92.6293333333334 31.4168888888889 92.672 31.4026666666667 93.1982222222222 30.2648888888889C94.0515555555556 28.4302222222222 94.208 27.6195555555556 94.208 25.2444444444445C94.1937777777778 23.5235555555556 94.1511111111112 22.912 93.9093333333334 22.1155555555556C93.312 20.0533333333334 92.3164444444445 18.2897777777778 91.008 16.9102222222222C90.2826666666667 16.1564444444445 88.7893333333334 14.9617777777778 88.32 14.7484444444444C88.2062222222223 14.6915555555556 88.0071111111111 14.592 87.8933333333334 14.5208888888889C87.5377777777778 14.2933333333333 86.4284444444445 13.8382222222222 85.8311111111111 13.6533333333333C85.5182222222223 13.568 85.0773333333334 13.4257777777778 84.8355555555556 13.3546666666667C84.608 13.2835555555556 83.9111111111111 13.184 83.3137777777778 13.1271111111111C82.0622222222223 13.0275555555555 82.2471111111111 12.8142222222222 81.8488888888889 14.7911111111111C81.4648888888889 16.7395555555556 81.1377777777778 17.408 78.4071111111111 21.9733333333333C77.4826666666667 23.5377777777778 76.672 24.9173333333333 76.6151111111111 25.0311111111111C76.5582222222222 25.1448888888889 76.3875555555556 25.4435555555555 76.2311111111111 25.6711111111111C76.0746666666667 25.9128888888889 75.8897777777778 26.2257777777778 75.8044444444445 26.3822222222222C75.7191111111111 26.5386666666667 75.5342222222222 26.8657777777778 75.3777777777778 27.0933333333333C75.2213333333334 27.3351111111111 75.0506666666667 27.6195555555556 74.9937777777778 27.7333333333333C74.9368888888889 27.8471111111111 74.5386666666667 28.5582222222222 74.0835555555556 29.2977777777778C73.0737777777778 30.976 73.0453333333334 31.1182222222222 73.3155555555556 31.872C73.5715555555556 32.5831111111111 73.8844444444445 33.8062222222222 73.9982222222222 34.5884444444445C74.112 35.3137777777778 73.8844444444445 35.4133333333333 72.0497777777778 35.4133333333333C70.1297777777778 35.4133333333333 69.8311111111111 35.2995555555556 69.8311111111111 34.6026666666667C69.8311111111111 33.5075555555555 68.8782222222222 31.7155555555556 67.7973333333333 30.7911111111111C66.7591111111111 29.9093333333333 65.1662222222222 29.2977777777778 63.8577777777778 29.2977777777778C61.5964444444445 29.2977777777778 59.3351111111111 30.7768888888889 58.3111111111111 32.9102222222222C57.8702222222222 33.8346666666667 57.8417777777778 34.0195555555555 57.7991111111111 35.6835555555556C57.7706666666667 36.6648888888889 57.7422222222222 37.5608888888889 57.7422222222222 37.6604444444444C57.7422222222222 37.888 56.9173333333333 37.8453333333333 54.8693333333333 37.5466666666667C51.8968888888889 37.12 48.768 38.2435555555555 46.4355555555556 40.6186666666667C44.8711111111111 42.2115555555556 44.0888888888889 43.776 43.7048888888889 46.1511111111111C43.3777777777778 48.2133333333333 43.776 50.5173333333333 44.8142222222222 52.4231111111111C46.7768888888889 56.064 50.8728888888889 58.1546666666667 54.9404444444445 57.6C55.6657777777778 57.5004444444444 56.4622222222222 57.344 56.7324444444445 57.2302222222222C56.9884444444445 57.1164444444444 57.3013333333334 57.0311111111111 57.4008888888889 57.0311111111111C57.5004444444445 57.0311111111111 58.1262222222222 56.7182222222222 58.7662222222222 56.3342222222222C59.8328888888889 55.7084444444445 61.1271111111111 54.5706666666667 61.8382222222222 53.6177777777778C62.7626666666667 52.3946666666667 63.616 50.2044444444445 63.7866666666667 48.5973333333333L63.8862222222222 47.6444444444444L65.8631111111111 47.6444444444444C66.944 47.6444444444444 67.8542222222222 47.7013333333333 67.8968888888889 47.7582222222222C67.9964444444445 47.9146666666667 67.6124444444445 50.6737777777778 67.456 51.0008888888889C67.3706666666667 51.1431111111111 67.2711111111111 51.5128888888889 67.2284444444445 51.8115555555555C67.1146666666667 52.5653333333333 65.7635555555556 55.296 65.28 55.7511111111111C65.2373333333333 55.7937777777778 64.9671111111111 56.1493333333333 64.6826666666667 56.5333333333333C63.1608888888889 58.6382222222222 59.6622222222222 60.7857777777778 56.6755555555556 61.4542222222222L55.8222222222222 61.6533333333333L55.7795555555556 78.976L55.7511111111111 96.2844444444444L57.5146666666667 96.2844444444444C58.4817777777778 96.2844444444444 59.3777777777778 96.3271111111111 59.5057777777778 96.3697777777778C59.8471111111111 96.4977777777778 59.8471111111111 100.3377777777778 59.5057777777778 100.4657777777778C59.3777777777778 100.5084444444444 57.7137777777778 100.5511111111111 55.808 100.5511111111111C53.4897777777778 100.5511111111111 52.3377777777778 100.5937777777778 52.3377777777778 100.6933333333333C52.3377777777778 100.7786666666667 52.5937777777778 101.1768888888889 52.8924444444445 101.5893333333333C53.4471111111111 102.3288888888889 54.8977777777778 105.2017777777778 54.8977777777778 105.5857777777778C54.8977777777778 105.6853333333333 54.9973333333333 106.0408888888889 55.1111111111111 106.368C55.3813333333333 107.1502222222222 55.7937777777778 109.9235555555556 55.68 110.3217777777778C55.6088888888889 110.6346666666667 55.552 110.6488888888889 53.7742222222222 110.6488888888889C52.4231111111111 110.6488888888889 51.9111111111111 110.6062222222222 51.7831111111111 110.464C51.6977777777778 110.3502222222222 51.5697777777778 109.6817777777778 51.4986666666667 108.9706666666667C51.4275555555556 108.2595555555556 51.2995555555556 107.5484444444444 51.2142222222222 107.392C51.1288888888889 107.2355555555556 51.0577777777778 107.008 51.0577777777778 106.8942222222222C51.0577777777778 106.5671111111111 50.2328888888889 104.8746666666667 49.6497777777778 103.9644444444444C49.024 103.0257777777778 47.6302222222222 101.504 46.8764444444445 100.9493333333333L46.3217777777778 100.5511111111111L39.3671111111111 100.5511111111111L32.4124444444445 100.5511111111111L31.0897777777778 101.8737777777778C29.696 103.2533333333333 29.1413333333333 103.9928888888889 28.544 105.2586666666667C27.136 108.2453333333333 26.9511111111111 111.0186666666667 27.9324444444445 114.4177777777778C28.2026666666667 115.3991111111111 29.2266666666667 117.3048888888889 29.824 117.9875555555556C30.0942222222222 118.2862222222222 30.4213333333333 118.6844444444445 30.5351111111111 118.8693333333333C30.9191111111111 119.4382222222222 33.0097777777778 120.96 34.1333333333333 121.4862222222222C35.1857777777778 121.9982222222222 35.5128888888889 122.112 36.9066666666667 122.5102222222222C37.9164444444445 122.8088888888889 40.8746666666667 122.7946666666667 42.0693333333333 122.5102222222222zM51.5982222222222 79.0471111111111L51.6266666666667 61.8808888888889L51.2853333333333 61.6533333333333C51.1004444444445 61.5253333333334 50.6026666666667 61.3688888888889 50.1902222222222 61.312C48.4266666666667 61.0133333333333 45.6675555555556 59.4631111111111 43.8613333333333 57.7706666666667C42.2257777777778 56.2346666666667 40.7608888888889 53.888 40.192 51.9111111111111C40.0497777777778 51.3991111111111 39.8648888888889 50.8017777777778 39.7795555555556 50.56C39.6942222222222 50.3324444444445 39.5946666666667 49.1093333333333 39.552 47.8577777777778L39.4666666666667 45.5822222222222L31.5875555555556 45.5395555555556C26.8231111111111 45.5253333333334 23.6373333333333 45.568 23.5662222222222 45.6391111111111C23.4524444444444 45.7528888888889 23.8791111111111 46.6488888888889 24.704 48C24.8035555555556 48.1564444444445 24.9457777777778 48.4124444444445 25.0311111111111 48.5688888888889C25.1164444444444 48.7253333333334 25.3013333333333 49.0524444444445 25.4577777777778 49.28C25.6142222222222 49.5217777777778 25.7991111111111 49.8346666666667 25.8702222222222 49.9911111111111C25.9413333333333 50.1475555555556 26.1688888888889 50.5173333333334 26.368 50.816C26.5671111111111 51.1146666666667 26.7377777777778 51.3848888888889 26.7377777777778 51.4133333333334C26.7377777777778 51.456 27.4915555555556 52.7502222222223 28.416 54.3004444444445C29.3404444444445 55.8364444444445 30.1368888888889 57.2017777777778 30.1937777777778 57.3155555555556C30.2506666666667 57.4293333333334 30.4213333333333 57.728 30.5635555555556 57.9555555555556C30.72 58.1973333333334 30.976 58.624 31.1324444444444 58.9226666666667C31.4311111111111 59.4488888888889 31.4311111111111 59.52 31.4311111111111 77.8666666666667L31.4311111111111 96.2844444444445L41.5004444444445 96.256L51.5555555555556 96.2133333333334L51.5982222222222 79.0471111111112zM40.8177777777778 41.344C40.9457777777778 41.2444444444444 41.3155555555556 40.704 41.6568888888889 40.1208888888889C42.3822222222222 38.8835555555555 44.0177777777778 37.12 45.3546666666667 36.1386666666667C47.4168888888889 34.6026666666667 49.792 33.7066666666667 52.3377777777778 33.4933333333333C53.7031111111111 33.3795555555556 54.0444444444444 33.2515555555556 54.0444444444444 32.8533333333333C54.0444444444444 32.2986666666667 55.168 30.0231111111111 55.8648888888889 29.1697777777778C57.2302222222222 27.4915555555556 58.8942222222222 26.3537777777778 61.0133333333333 25.6568888888889C61.6248888888889 25.4435555555555 62.2364444444445 25.3866666666667 63.8577777777778 25.3866666666667C65.6355555555556 25.3866666666667 66.048 25.4293333333333 66.816 25.7137777777778C67.9395555555556 26.112 69.0346666666667 26.6666666666667 69.6462222222222 27.136C69.9022222222222 27.3208888888889 70.2008888888889 27.4488888888889 70.3146666666667 27.4062222222222C70.4711111111111 27.3351111111111 72.3911111111111 24.3057777777778 72.3911111111111 24.1066666666667C72.3911111111111 24.0782222222222 72.5617777777778 23.808 72.7608888888889 23.5093333333333C72.96 23.2106666666666 73.1875555555556 22.8408888888889 73.2586666666667 22.6844444444444C73.3297777777778 22.528 73.5146666666667 22.2151111111111 73.6711111111111 21.9733333333333C73.8275555555556 21.7457777777778 74.0124444444444 21.4186666666667 74.0977777777778 21.2622222222222C74.1831111111111 21.1057777777778 74.368 20.7928888888889 74.5244444444444 20.5511111111111C74.6808888888889 20.3235555555555 74.8515555555556 20.0248888888889 74.9084444444445 19.9111111111111C74.9653333333333 19.7973333333333 75.3351111111111 19.1573333333333 75.7333333333333 18.4888888888889C77.7671111111111 15.1324444444444 77.9946666666667 14.5066666666666 77.9804444444445 12.4444444444444C77.9804444444445 11.3208888888889 77.9093333333333 10.6951111111111 77.7244444444445 10.24C76.7004444444444 7.5662222222222 75.2924444444444 6.1724444444444 72.6755555555556 5.248C71.936 4.992 71.4382222222222 4.9777777777778 62.1226666666667 4.9777777777778C56.6328888888889 4.9777777777778 52.3377777777778 5.0346666666667 52.3377777777778 5.1057777777778C52.3377777777778 5.1768888888889 52.7928888888889 5.376 53.3617777777778 5.5608888888889C54.4853333333333 5.9164444444444 55.9644444444444 6.6417777777778 56.7466666666667 7.2248888888889C57.4293333333333 7.7368888888889 59.0506666666667 9.344 59.4773333333333 9.9555555555555C60.0035555555556 10.6808888888889 60.7146666666667 12.0604444444444 61.0133333333333 12.8711111111111C61.6675555555556 14.72 61.7386666666667 15.1751111111111 61.7386666666667 17.1662222222222C61.7386666666667 18.9582222222222 61.696 19.2426666666667 61.2977777777778 20.48C60.3733333333333 23.3528888888889 58.9653333333333 25.3155555555556 56.6044444444445 27.0506666666667C54.7413333333333 28.416 52.0106666666667 29.2977777777778 49.6355555555556 29.2977777777778C46.9475555555556 29.2977777777778 44.2453333333333 28.3022222222222 41.9697777777778 26.496C40.4337777777778 25.2728888888889 38.6417777777778 22.8124444444444 38.2435555555556 21.4044444444445C37.5466666666667 18.9013333333333 37.4044444444445 18.176 37.4044444444445 17.1662222222222C37.4044444444445 14.4071111111111 38.6133333333333 11.2355555555556 40.4622222222222 9.1733333333333C42.0551111111111 7.3813333333333 43.776 6.2435555555556 45.9093333333333 5.5608888888889C46.464 5.376 46.8906666666667 5.1768888888889 46.848 5.1057777777778C46.8053333333333 5.0346666666667 39.0684444444445 4.9777777777778 28.9706666666667 4.9777777777778C11.7475555555556 4.9777777777778 11.136 4.992 10.2826666666667 5.2622222222222C9.2444444444445 5.5893333333333 9.0168888888889 5.7031111111111 7.936 6.5137777777778C6.0017777777778 7.9502222222222 4.9777777777778 10.0408888888889 4.9777777777778 12.5155555555556C4.9777777777778 14.4213333333333 5.2622222222222 15.1608888888889 7.1822222222222 18.3466666666667C7.5804444444445 19.0151111111111 7.9502222222222 19.6551111111111 8.0071111111111 19.7688888888889C8.064 19.8826666666667 8.2346666666667 20.1813333333333 8.3911111111111 20.4088888888889C8.5475555555556 20.6506666666667 8.7324444444445 20.9635555555556 8.8177777777778 21.12C8.8888888888889 21.2764444444445 9.0168888888889 21.504 9.1022222222222 21.6177777777778C9.4008888888889 22.0728888888889 12.6577777777778 27.6053333333333 12.6577777777778 27.6622222222222C12.6577777777778 27.6906666666667 12.8426666666667 27.9893333333333 13.0702222222222 28.3306666666667C13.4684444444445 28.9422222222222 13.9377777777778 29.7244444444444 14.5066666666667 30.7911111111111C14.6773333333334 31.104 15.0044444444445 31.6302222222222 15.232 31.9715555555556C15.4595555555556 32.3128888888889 15.6444444444445 32.6115555555556 15.6444444444445 32.6257777777778C15.6444444444445 32.6542222222222 16.2986666666667 33.792 17.1093333333334 35.1431111111111C17.92 36.5084444444445 18.6168888888889 37.7173333333333 18.6737777777778 37.8311111111111C18.7306666666667 37.9448888888889 18.9013333333334 38.2435555555555 19.0577777777778 38.4711111111111C19.2142222222222 38.7128888888889 19.3991111111111 39.0257777777778 19.4844444444445 39.1822222222222C19.5697777777778 39.3386666666667 19.7546666666667 39.6657777777778 19.9111111111111 39.8933333333333C20.0675555555556 40.1351111111111 20.2382222222222 40.4195555555556 20.2951111111111 40.5333333333333C20.352 40.6471111111111 20.5226666666667 40.9173333333333 20.6791111111111 41.1448888888889L20.9635555555556 41.5288888888889L30.7768888888889 41.5288888888889C38.2862222222222 41.5146666666667 40.6613333333333 41.472 40.8177777777778 41.344zM52.2666666666667 24.7608888888889C53.2195555555556 24.3911111111111 53.5751111111111 24.2062222222222 54.4284444444444 23.5662222222222C56.8462222222222 21.8026666666667 58.0693333333333 18.816 57.6142222222222 15.9146666666667C57.0453333333333 12.3591111111111 54.4568888888889 9.7564444444445 50.9013333333333 9.1448888888889C49.7635555555556 8.96 49.5075555555556 8.96 48.3697777777778 9.1448888888889C45.3688888888889 9.6568888888889 43.1075555555556 11.52 42.0266666666667 14.3786666666667C41.6568888888889 15.3173333333333 41.6142222222222 15.6017777777778 41.6284444444444 17.1377777777778C41.6284444444444 18.9724444444444 41.728 19.3422222222222 42.5671111111111 21.0062222222222C43.5342222222222 22.9262222222222 45.8951111111111 24.6613333333333 48.0711111111111 25.0453333333333C49.1235555555555 25.2302222222222 51.4702222222222 25.0737777777778 52.2666666666667 24.7608888888889zM115.6835555555556 24.7324444444444C117.3191111111111 24.1777777777778 118.4711111111111 23.4666666666667 119.7511111111111 22.1866666666667C120.7608888888889 21.1911111111111 121.088 20.736 121.6426666666667 19.6408888888889C122.0124444444445 18.9155555555556 122.3111111111111 18.2044444444444 122.3111111111111 18.0622222222222C122.3111111111111 17.92 122.4106666666667 17.5786666666667 122.5244444444445 17.3084444444444C122.8088888888889 16.6257777777778 122.8231111111111 13.5964444444444 122.5386666666667 12.8426666666667C122.4391111111111 12.544 122.24 11.9324444444445 122.0977777777778 11.4773333333333C121.9555555555556 11.0222222222222 121.7848888888889 10.624 121.728 10.5813333333333C121.6711111111111 10.5528888888889 121.472 10.2257777777778 121.3013333333334 9.8417777777778C121.1164444444445 9.4577777777778 120.448 8.6471111111111 119.7653333333334 7.9644444444444C118.7697777777778 6.9688888888889 118.2862222222223 6.6133333333333 117.2053333333334 6.0728888888889C116.48 5.7031111111111 115.7688888888889 5.4044444444445 115.6266666666667 5.4044444444445C115.4844444444445 5.4044444444445 115.1431111111111 5.3048888888889 114.8728888888889 5.1911111111111C114.176 4.9066666666667 111.232 4.9066666666667 110.4355555555556 5.1911111111111C110.1226666666667 5.3048888888889 109.7671111111111 5.4044444444445 109.6391111111111 5.4044444444445C109.2551111111111 5.4044444444445 107.1786666666667 6.4853333333333 106.4533333333334 7.0684444444445C106.0693333333334 7.3813333333333 105.3724444444445 8.0071111111111 104.9173333333334 8.448C104.4622222222222 8.8888888888889 104.0071111111111 9.2444444444445 103.9075555555556 9.2444444444445C103.7937777777778 9.2444444444445 103.6231111111111 9.1022222222222 103.4951111111111 8.9173333333334C103.0257777777778 8.192 101.1768888888889 6.4995555555556 100.352 6.0586666666667C98.8728888888889 5.2337777777778 97.9484444444445 4.9777777777778 96.4266666666667 4.9777777777778C94.208 4.9777777777778 92.2595555555556 5.7742222222222 90.7662222222222 7.2817777777778C89.9697777777778 8.0782222222223 89.1164444444445 9.344 88.96 9.9697777777778C88.8604444444445 10.368 89.0311111111111 10.5244444444445 90.3111111111111 11.2071111111111C92.3591111111111 12.3022222222223 94.9048888888889 14.8195555555556 96.1564444444445 16.9955555555556C96.768 18.0764444444445 97.5644444444445 19.8826666666667 97.5644444444445 20.2097777777778C97.5644444444445 20.352 97.664 20.5653333333334 97.792 20.6933333333334C98.3324444444445 21.2337777777778 100.5368888888889 20.224 101.9875555555556 18.7875555555556C103.424 17.3511111111111 104.192 15.8151111111112 104.3768888888889 14.08L104.4622222222222 13.1555555555556L106.4675555555556 13.1128888888889C108.1742222222222 13.0844444444445 108.5013333333334 13.1128888888889 108.5724444444445 13.2977777777778C108.672 13.5822222222223 108.3164444444445 15.6017777777778 107.9466666666667 16.768C107.5626666666667 17.9626666666667 106.6382222222222 19.6551111111111 105.8844444444445 20.5511111111111C104.96 21.6462222222223 104.96 21.7457777777778 105.8844444444445 22.5564444444445C106.7662222222222 23.3386666666667 108.8568888888889 24.6044444444445 109.2693333333334 24.6044444444445C109.4115555555556 24.6044444444445 109.6675555555556 24.6897777777778 109.8382222222222 24.7751111111111C110.6631111111111 25.2444444444445 114.2471111111111 25.216 115.6835555555556 24.7324444444445zM27.0222222222222 37.0631111111111C25.4293333333333 36.5226666666667 24.704 36.0817777777778 23.6088888888889 34.9866666666667C21.9875555555556 33.3653333333333 21.1911111111111 31.488 21.1911111111111 29.2977777777778C21.1911111111111 27.8186666666667 21.5182222222222 26.6808888888889 22.4284444444444 24.96C22.7271111111111 24.4053333333333 24.4053333333333 22.7271111111111 24.96 22.4284444444445C27.9466666666667 20.8497777777778 30.2506666666667 20.7644444444445 33.1093333333333 22.144C34.1902222222222 22.6702222222222 35.9253333333333 24.4053333333333 36.4515555555556 25.4862222222222C37.7173333333333 28.1315555555556 37.7315555555556 30.464 36.4657777777778 33.0808888888889C35.9111111111111 34.2044444444445 34.2044444444445 35.9111111111111 33.0808888888889 36.4657777777778C31.0186666666667 37.4613333333333 28.8142222222222 37.6746666666667 27.0222222222222 37.0631111111111zM31.2462222222222 32.8391111111111C31.9431111111111 32.4124444444444 32.4266666666667 31.9288888888889 32.8533333333333 31.2177777777778C33.1662222222222 30.72 33.2088888888889 30.4782222222222 33.2088888888889 29.2835555555556C33.2088888888889 28.0462222222222 33.1804444444445 27.8755555555556 32.8248888888889 27.3493333333333C32.3128888888889 26.5671111111111 31.8862222222222 26.1404444444444 31.2177777777778 25.728C30.72 25.4293333333333 30.4782222222222 25.3866666666667 29.2835555555556 25.3866666666667C27.9324444444444 25.3866666666667 27.904 25.4008888888889 27.1502222222222 25.9128888888889C26.7235555555556 26.2115555555556 26.1546666666667 26.7804444444445 25.8844444444444 27.1786666666667C25.4008888888889 27.8897777777778 25.3866666666667 27.9608888888889 25.3866666666667 29.2835555555556C25.3866666666667 30.4924444444444 25.4293333333333 30.72 25.7422222222222 31.2177777777778C26.3253333333333 32.1564444444444 27.264 32.9528888888889 28.0604444444444 33.152C28.9137777777778 33.3653333333333 30.6631111111111 33.1946666666667 31.2462222222222 32.8391111111111zM100.9066666666667 86.0444444444445C100.0391111111111 85.9306666666667 99.1573333333333 85.6746666666667 98.2755555555556 85.2764444444445C97.408 84.8782222222222 96.256 84.096 95.5733333333333 83.456C94.3644444444445 82.3182222222222 93.2124444444444 80.4266666666667 92.672 78.6915555555556C92.3448888888889 77.6391111111111 92.3448888888889 74.4675555555556 92.672 73.472C93.3546666666667 71.3813333333334 94.0373333333333 70.2293333333333 95.3457777777778 68.9066666666667C96.5404444444444 67.6977777777778 97.6924444444445 67.0008888888889 99.4133333333333 66.4177777777778C100.5511111111111 66.0337777777778 100.8497777777778 65.9911111111111 102.4995555555556 65.9911111111111C104.32 65.9911111111111 104.7893333333334 66.0764444444445 106.3111111111111 66.688C107.8044444444444 67.2711111111111 109.6248888888889 68.6791111111111 110.5493333333333 69.9448888888889C111.1751111111111 70.7982222222222 112.0711111111111 72.5191111111111 112.0711111111111 72.8604444444444C112.0711111111111 73.0026666666667 112.1706666666667 73.3155555555556 112.2986666666667 73.5573333333333C112.64 74.2115555555556 112.6257777777778 77.5253333333333 112.2844444444445 78.6204444444445C111.3173333333333 81.7493333333333 109.3831111111111 84.0391111111111 106.6666666666667 85.2622222222222C105.0595555555556 86.0017777777778 102.8551111111111 86.3004444444444 100.9066666666667 86.0444444444444zM104.1066666666667 81.8915555555556C106.7662222222222 81.0808888888889 108.5724444444444 78.6915555555556 108.5582222222222 76.0177777777778C108.544 73.3155555555556 106.5528888888889 70.784 103.9644444444444 70.1724444444444C101.6177777777778 69.6035555555556 99.0293333333333 70.5137777777778 97.6782222222222 72.3626666666667C96.8248888888889 73.5573333333333 96.4408888888889 74.6666666666667 96.4408888888889 76.0177777777778C96.4124444444444 79.1182222222222 98.5742222222222 81.5644444444444 101.8311111111111 82.1191111111111C102.3146666666667 82.2044444444445 103.4951111111111 82.0906666666667 104.1066666666667 81.8915555555556zM111.1466666666667 59.6053333333333C110.4071111111111 59.4915555555556 110.0942222222222 59.3777777777778 108.8 58.752C107.6337777777778 58.1973333333333 105.9555555555556 56.4906666666667 105.4008888888889 55.296C104.9173333333334 54.2435555555555 104.5333333333333 52.6648888888889 104.5333333333333 51.712C104.5333333333333 50.4746666666667 105.0453333333333 48.4408888888889 105.4862222222222 47.9146666666667C105.5857777777778 47.8008888888889 105.6711111111111 47.6444444444444 105.6711111111111 47.5733333333333C105.6711111111111 47.3031111111111 106.9226666666667 45.8666666666667 107.648 45.312C108.7715555555556 44.4586666666667 109.9377777777778 43.9466666666667 111.3884444444444 43.6906666666667C112.5262222222222 43.4915555555556 112.7537777777778 43.4915555555556 113.8915555555556 43.6906666666667C117.0204444444444 44.2453333333333 119.3955555555556 46.2933333333333 120.3911111111111 49.28C120.7893333333333 50.4888888888889 120.7751111111111 52.9208888888889 120.3484444444445 54.144C119.8364444444445 55.6088888888889 119.3813333333334 56.32 118.272 57.4577777777778C117.5608888888889 58.1688888888889 116.6506666666667 58.7235555555556 115.1715555555556 59.3493333333334C114.56 59.6195555555556 112.1848888888889 59.7617777777778 111.1466666666667 59.6053333333334zM113.9768888888889 55.4524444444445C115.4417777777778 54.8835555555556 116.4515555555556 53.632 116.7075555555556 52.0817777777778C116.864 51.0577777777778 116.2524444444444 49.536 115.2995555555556 48.6257777777778C114.3608888888889 47.7155555555556 112.5546666666667 47.3884444444444 111.2177777777778 47.8862222222222C110.4071111111111 48.1706666666667 109.2977777777778 49.2373333333333 108.928 50.048C108.544 50.9155555555556 108.5582222222222 52.4231111111111 108.9564444444444 53.2764444444445C109.568 54.6275555555556 111.1751111111111 55.7226666666667 112.5973333333334 55.7368888888889C112.9102222222222 55.7511111111111 113.536 55.6088888888889 113.9768888888889 55.4524444444445z" />
-    <glyph glyph-name="http-get"
+    <glyph glyph-name="loader-alt"
       unicode="&#xF105;"
-      horiz-adv-x="128" d="" />
-    <glyph glyph-name="http-get-1"
-      unicode="&#x68;&#x74;&#x74;&#x70;&#x2D;&#x67;&#x65;&#x74;"
-      horiz-adv-x="128" d="" />
+      horiz-adv-x="128" d="M64 10.6666666666667C92.912 10.6666666666667 117.3333333333333 35.088 117.3333333333333 64H106.6666666666667C106.6666666666667 40.8693333333333 87.1306666666667 21.3333333333333 64 21.3333333333333S21.3333333333333 40.8693333333333 21.3333333333333 64C21.3333333333333 87.1253333333334 40.8693333333333 106.6666666666667 64 106.6666666666667V117.3333333333333C35.088 117.3333333333333 10.6666666666667 92.9066666666667 10.6666666666667 64C10.6666666666667 35.088 35.088 10.6666666666667 64 10.6666666666667z" />
+    <glyph glyph-name="loader-alt-1"
+      unicode="&#x6C;&#x6F;&#x61;&#x64;&#x65;&#x72;&#x2D;&#x61;&#x6C;&#x74;"
+      horiz-adv-x="128" d="M64 10.6666666666667C92.912 10.6666666666667 117.3333333333333 35.088 117.3333333333333 64H106.6666666666667C106.6666666666667 40.8693333333333 87.1306666666667 21.3333333333333 64 21.3333333333333S21.3333333333333 40.8693333333333 21.3333333333333 64C21.3333333333333 87.1253333333334 40.8693333333333 106.6666666666667 64 106.6666666666667V117.3333333333333C35.088 117.3333333333333 10.6666666666667 92.9066666666667 10.6666666666667 64C10.6666666666667 35.088 35.088 10.6666666666667 64 10.6666666666667z" />
   </font>
 </defs>
 </svg>
diff --git a/js-packages/web-console/src/assets/fonts/generic-icons.ttf b/js-packages/web-console/src/assets/fonts/generic-icons.ttf
index e9db6e59e2d4ca4d81e656a854fa44de5cae0ff2..1cfb76f2a02b7767ab56b4fa61fa5d9d503f50f3 100644
GIT binary patch
delta 725
zcmXYtJ#W)c6o$`n96L_pB(~FhRLa6v8Di0vNU$J57RvWfF@xhciB&g_5@*QN4jC#2
zRC9j-EG$e^g%OFBnVnz2!U_woqbuw2d+#~#Ip^Mc-Z}5|h>55~r<9}JhlelwSKsXX
zBI3J<{(W(HYya`jgOo_=VgK4c_GaCiKfb2DXSuhXe!A|e-~K&+l78u_`Bw*L>F@U^
z*Qifx^i)BCbbJLesE7&rCaO@GOse2tMa-ZYSy-85lR_GGaSEFpsw29E3Io*+HQ=mb
zU4gF%mri-8g^Z0%1sMnVP5&DhY$9cDnl@lFsD-tILG8@}v~2X{uJVX?vbrX=S(nzP
zvk6lb^DNA*phU+h>f%H09vk99x!rb}WxLcWYVg5k!Bo??@G^C=r=E)MiY_kH?GpnL
zPvSrak|xxbl%Ye34GknE=t$CnjwMCtM4~}Mi3vTDw4qT}jvuZ;G?g@<vBZMTBn9YP
zQh_ccHE1Hyp-V}2)s>_!KIb1GxlQ+#^*il~sA&Z;)$WMv+SAKF+L<aoVzDZHQjQCg
zB$>J6ASwId+>Zix5l7+Bj=WX8Ox&3_4I+0QjwgvZh{GtHj@?n@Esly&><xpt>qQAq
fIN=$)Jm!FX4tdTIFF58Qd%WT$PkF#2&K}}F6<cPb

delta 723
zcmXYtJ8#oa7>2*kaeRrLn{x+c0kvIfQCbfy6_<s(id4bCgyYzWRX2_tXUNnJ9hgvq
ze*i2jOjJQ)1u-$R(Sbj}FJR(zII<qU=X~#XIp>`B&-)HB5gBw!1=_iP`261WA6vhP
z_!gpn4-RkaKKl7!NhCSgzw(aV>HgL4UzX0(!ms|D<=M9U?e=43`Pq>#FJGq1KkrVS
zQ9x%TkwV+(Y>`SD=~Ti5lgijts0z=d8r9)85HG;h;k4n@;HdBo)XG#ut%0wMs0H_b
zRKl)~%qH@xShrBEAkxljHc?hapuP@OP-apWYZYm|byEdHo2wn^A#dfgI_Q&6?ygT$
zN0Ndw>S$6!iGj0e+55sio7si5*Hb&qcC~9YkcTuKNiCy<m(jAD@@e)}QnL&B%87}H
zD^Q^WK?mvyn$V%34fO?8Xdvi9M*<5v7Brxtpbk9}^q^5*jvuZ;G!aywu|S7T1!ZU=
zs6l6f7Bm$Y(77PL>O!DppNe;jn{<bQx5~Awrj)W5%0afFIGJrcS$$Am%d3U)Q98CF
zcM;E1d+JX7$WFr1I5oX6@gm=z#ZfpcMX@{d6Wfi_@*obQa5A!k$ekT&<20SxBR}Pc
fU0!g^b57ajDNoqvghL+jm_45HkOv%a{tW*B_TFb8

diff --git a/js-packages/web-console/src/assets/fonts/generic-icons.woff b/js-packages/web-console/src/assets/fonts/generic-icons.woff
index 102d845addbdc5da550990338e10f7cb945d208d..9a8488a591ce6d97945608c4e4a9ebb6ab356d32 100644
GIT binary patch
delta 1618
zcmV-Y2Cezr5a<vLcTYw}00961000PRkqj{diYMNYKp%ex0008;EGWsfXKZ<90008`
z0009i000G4-{W7=Xk}q!000Ig0000i0000sb7j4;XlP|&000J10000M0000a0RaG;
zXl-<O000JP0000G0001J0)PMjY;R*>000Jf0000K0000s9gZDBZDDwD000Jz0000V
z0000W0Wg07xo%-?WdHyMtN;K3F8}}nQeJ4Hx^QoEbN~Pc+yDRoiU0rr!@c`XOL&}3
zj!h1NFcgG85P>2sLKT13E?sy67sj}9=>=FB6XMDvcoYxnP&Khl^QQC7>njmZuwzer
zJe@DNzI)tRlkiys|JPA}yLRNin^+QRuJe+1Y&cNx3}kRK?Hr>S6RE+CDY43xRPqc{
zYAH)2lCota<(bKytHY?<(<)g>JLL+cGRCU4NF(Azym<Egj}@`u%~mPHQrc_ID)2N+
zUc3Rh%?hiNtpP=UwbDs$!axuO(BF6hY`_Cxvx~CGD!BodAu|FIM8bk?4wO|c<`a-#
z?!U;ENGa>t>QWEo?gkJ62<VnVz<tBP;)_|=<pT`6e27oBb3WGp4r^?&#}TJCI-k4D
z3LETjV8(Ts-{HEESGdLv=d{%Zs8AzAi4+ajh%v$f6U<S6ppP+oCzxT%kv*;$TBR<=
zWihz0zeQDNW!em5R>NWnmXaqk=BIy{>pvp1ms_f}fbG0zf4h>3?xm&&vC)rG(vzh0
zEDgN~&mOO0yT6tZZNzHW%7k_@r#C5RFMT@5nBFC)4@u}Kw)-dHDYVYB``Pw9*f;R(
zezu`!ce;&#JVZb1r!1-fc$`I4%Z}Sd5M*@^XXIUljAK4v*xCh1FL~I7v=Uzi1g~<)
z#b*OPEpqS=<P={M-~A8%0e_nBxu$xwK}2CV)6-p5-94NHiTytFStrTTWGJq1c)+;D
zui48id->XiKcC(l%v)p3r{poolNU+NxVG^d6x9)bhxr}GF0|7ShO&KpE6&Mzc>7D1
zJvzCw1&70(yD^k?#QK}h@5ztkAGA2&13uvoe8E?I!*`-*lB2vvDC;u#qO7k_?~Q9(
z<`c#v>Wc5WdXODD{u`g8pT@o$mbs^)d57g-p3}I)G&8jwax`s!i!H;hxyxbL;eHva
znvc(ar5qw;hIYTjEz03=E!75@#QD6;W&y*>Pz3UEd6JSIKGz+VeVfBKT|eFXEgmqK
z<dO_qwEZ+p{RwR-e7Hs5P2Dn{q%Ikdqg`0I`zzT~#<0|c3vJXsPyH56uIx@-?c2U%
zPW6>!2rXHbaXwOv<g7p-?|9OCs@q@~ng0oYL(jg_a3Ii5I)ZOl0dg<%ury>2C2<EM
znzrD)$S8H3huSldVnfa&xY>_g9}YE5tX{{wZZuT@>}k!nis+F84U+0gpl;>4;)aG4
zaB-fhR|~N}Xm`#+J*VO<Bo%N^ok(DaYD)B!$SEWhi&Vm>Gbn;H!q&8UMmV$6!C?h|
zn-O|NWN&DO3Iks$rv%C<)0F0^a+QbjQc_PMPw83`1_tb(Sw@C*Bl`0-b0MReQu$59
z7LF-M>X@GW(wL<CNDb5>F*w#J%EWtEkX6Jm5bRAneP%@?Bh$3qNF4<z{<0KZph(4=
zE;UR8v;cVXA)*gYR2IjcxQmquNttPX5EBOp!JmU9W^cS^(3K14;xLUBtyX+7j;Cr;
zA!}mAw+5O-jXieRQ^N4x>v@y4M&pn=jpgTr4tn?8K>SZPi@JCS)`m`3<DsuL+eIoT
zub#8kcBt$esLd@8jd*(QF06}?we{Z;VfCplmILwZO?E20oiIBU3{rRYt77qgZ9&pF
zi~b@>^8Y<p@y6i|IJNu;8h!;l=F|CJv>WkaT~x(-U0lZ7(Z)+#(suFR{rE4_P*Su2
z004NLV_;-pU;tv)c!eqP{5D@1xEUIN0#Tfg_aV_h&;Sx=;9y_^aR3ab30ZiYV_;-p
zU}#`qKq46#P=OQxCGr8C004NCT?P~n11SavrWU4E#6kd1MGpP5fCiKSNZK?p_PVw)
zEnO(Z>cNYvaxs%1qwY;-MF&?mF?)L_uB-J&%+My{O=W{N5^0F^Xlg7aj({-WsW428
QbiDb{D)j}ifg(Eq0Qr&ImjD0&

delta 1574
zcmV+>2HE-O5Zn+9cTYw}00961000PFkqj{d$tT~DKp%eu0008;JsZQfXKZ<90008?
z0009Z000G4-{W7=Xk}q!000IQ0000j0000sb7j4;XlP|&000I=0000M0000a0RaG;
zXl-<O000JD0000G0001J0)PMjY;R*>000JT0000K0000s9oij^ZDDwD000Jn0000V
z0000W0Wg07xo%-?WdHyMpa1{?F8}}nQeJ4Hx^QoEbN~Pc&;S4ciU0rr!@)mG26&uJ
zj!O=LFcd{E6$=QIkBFZ&IB*4y3?l~)+yE1e3322ST#5_zSTwOs(|hlEudfOu&9u{A
z=FlC_azp>PYok!(`tW}p47Y2q_~&4uzhlk|?Q~GmMNb)7ZOLjyu!I?@GUYg@0+y*%
z1)Y;mpb4afl#mFX`nRX_rtF-whK{MhRa7?A73c-smZbguC&yPladc%`p(Co+o?B)%
zTD}4J{|f7qtpP=U&C)$`!Y~j8;3sV3I0g*<g)WmKRdRz|hWs-ygdw4z&4E(oVm<+R
zE4?BuUDorBMr+AhO9GGpi0GDL!2Q6%;+t9L^ARq6KE@aOQ$9BS4l8W1!vV)WIh}lF
zi8Z#^Gvj>bZ#X~m3fH*dH*K{MQgo=%qQD#_D$KCJ5EEp77;|icoGV{&=71~4R;e4}
zycnH1-XiVlwwRX{t6?!2OKEcM04w<);s43qtG9sdd|+>ulG1~8^e8nwNlVXC(2LCJ
zRZ4o3idHhCwO9=su@l<Lgx)2ios4NOQ~HpGJ|(Av*zO;Nr_j5=?q@#;U~LrG{p{nw
z?sT67NPYo-`c5pWc$`&IyN=vO5M*@^XI6J>(z5t~AnhGM>d4>@ySK}ifQ4=yI8iJ>
z(ZPX!z>$^O%JmQW0ezZsr>>qo7%)i;dwRO6ySgXQ#GX&dW0EH?k~&G2w(%Pj)e(pJ
z9mX!S(-4NTeS9m<$$5GEOO`!4xw8$I!=1Y^7DTRp&wSV9X)+X7I6Pq7;@9kDmc4v!
z%b!nwF8{|=#4vhliww;c;{%52%wgz@bx{@Tb#WP)Y`wHCeHZ_6ts~dpe1A`VB>$kr
z0Uz)Qf8Yzg;v2p*Lnb-OYlN~cgD=YZ3iaN!PRo44ctl<CUsn&ZL&vZ2Ir?eryJ4Ao
zI+}M+SPm9BjXO*;rR|WTY5QAj3A^SgmtlwdWvFVtK9_Qclo{In7Plye!?jc!WD@Op
znau;j%1{L6<Mt#aBYdtqEc-TxZ@PZE_gk<jR&vRcAOsYD3CPhd9Nhht>{-UJ)T9e-
ztbLyPEt*`}*}B@deMe38m1GDlvn=C$WHFMn1A%$Rlists4Th2WPZ)a6gpLD=cG8i2
z!wxX_G7n3`%%LRjV2P$JXmgyL<~-D%LW&J@9>K$Y?D}x1>0<Xf>blWX0q{=M{Hur_
zxzHi0t_13TR-QW^Xh;DU?Nq%Q#6HmPoIyQJaRx~RJX0qU2vJSRo{~9*q+&=VjXI+u
zIT5y}*AwB)&j5!N%p&!Q%--0H6-K^Nnk33trd67!%3U7HOG!Nwd6upvX<)?unJF@+
z8_}Pysf8KUDwW?vY~v_FQb&3Aq*0{%$QoFOL~!hXQ7jYhVIb>>aUj^AeEQ6q#*CC{
zr!jRbK=GGJbb&=G-gK#P8leH;EryIfJf$)mXW}kaR!B;vL994P2>uL`sNV9LLsu@G
zn?o5Zdae0lIi9-73fU8Dz75by)Hq|8Jqd>QUeAZ@H5!N1X>30Y2I$>$Bk@1oEb8JV
zSQ|TkLoE+uZP+fRa`Ngqdu^A>?tz+ZIyCa>dAhJELe@5a6T<GZy4ViHyEoab@OH!O
zRuH7_99PBW+lEP_72`#ce*ppxQnYxSV_;-pU;yIVw~ZR&`E9;3a5FRj1)?|~??a-2
zpaCS#z`?)-;s5|hqY9}2004NLV_;-pU}#{ISq3Bz0yPE)hBT&C#6tjTl@FD(j0The
zNXo@bevG;|ofREi-NdwXp%kkJFRn_&o5}`lBxY~##C5g)h#A^V6JxJy8xaf>o{@;A
Yr^6C()HIX~RJ{4nD)j}uwIVwJ0Dp<c%>V!Z

diff --git a/js-packages/web-console/src/assets/fonts/generic-icons.woff2 b/js-packages/web-console/src/assets/fonts/generic-icons.woff2
index 0a75081b4e8660dce6eeacb73aaba7d19f79633e..665bca71460ef2479c0a52bac283bfef6ce0481a 100644
GIT binary patch
delta 1660
zcmV-?27~#G4WJDecTYw#00961000J{01E&B000h<000J1kr+9DBT{m<C;MxRjbYX!
z2~&z0Ae{saPyss~5FkhZCAa_p04xUpoEW?+Pk$9{tvH_`00jU+(XV~>?DBg{d?5l$
zqyW(UijBQQM#U!DqrU%L(+p8gMVMSc_RRt*gk0_?2S2bRSMXIMRU>D_RE-`8KLYah
zyWNd9*v(`Zc#ubb6DUrLER}HWx7Q^tGl88;nA0eXqY`6y{$lULzR_WqwDqmMsh*^D
zsnV{`c(wP>cKR>r4Z03bV;wgZL<5K^3}8-+FW&|TAka#<xIG3$T{Lj&=kNXTSQLlz
zG)yx7_cqVH@9%|U?4q^?8fR-Rz$~yR<CHTA&t9eFC#QOUjl2#5#x_Sd%kJ?RSsgqY
zvc*H=g+;VRp*We3l)Rd)B_coYWL7z0$WjJFks65^R)|1HB9)CUma}4oQZ7|-1U7M1
zY7GwF3dJI|j+KjLQbrItd`20SR3(|Ymg`0@#Im6J^c@2nLRYOY*73mVNqU|!{D2S6
zyGAG{c-WhN@^U!*2y}*X`%Xr_u<0`ctS@IK56f4;2QJuj{?vNwjlXbbu1#EqyPD@S
zP$;-yvqz9q8_cw@u+jFGis8#pKwMIR%dD`*Cc!xu#$Iw}_;9usN{w=zQWX9Y3!zp+
z94?O!C7^bWCDd)}fRAWxPl%5t{0HRq0MPIv6M#B@JR{gVfEe6@8r+5++<^q#g$mpQ
z3+}@J9)JN4Apnmc1y5iEPay}-p#v|V1TP^1uOS0(pa5?n1n-~)pPCx{24f;H7!U*u
z2nq&-gi?$!jf7qM6Rr=@k7`z#NL<O2(qFt=npaldK6uma_3rioA8y+qO^0zb>lPCq
z&j*x$GBEqfwreP_SA=}WVAhf25P`N17P0A$&^{$#lLfGEX3jR02^oq=uUh+<+9oNw
zR_@!HGoh?&Mtb#%&Fe-Yi8`WMLkYpUVFIhVaS4LR8U?Jvd2=S!N(Sr|$X<Z?4Z31%
z)(RqJhvtyxWVzSCpdK4qK-G{$a;p0glxuB&jrSVC22pmP4jI*qBxWJfir>s74d>9P
z@h3yR@<NEZ1K0vEze)FB-cXVy52GSQ!ESn;J~zW$P0ZNM8y|s)I?PkkRHxE>$L01s
z>_9Vq9p#vleI=)h>G8{fEVyFd`09&!1kLmS(T<!f<T39((W)OaS*->bpBq$Ndg;P{
zIysZ{=<w`yTpmpvPSbqslLhPQroO!Id@j$HpJ$^4xVb6a<%zEjx+eGLcdy<pTZ=8~
z{?z9Uvdp=czWdZEGn$df1A!UnqnKZ{?@lrNINKF)cwK%5>X9-*F1_iFDv*dL+GS1?
z0n2-zp7uQ>i>3a;?@FJk>hmnhv*~$%&E7A|?TDw!{qVAs{pX<kf<*y~4Cex91E7%O
zLSRH>h9r1*)bG`XLmdGT_OM=l3rTF`8c6j0EG>>@up+k*&*(W*Q~ll<OvIe9MUEYJ
z1AqSCpGD)e{dqC_*W37zir1z3Q#i+rxRLesSx;7*XW=qcqJ;-O=;B)xZB_bzl7Pl9
z&5L%?KOIL)6KKqZ%v_ML1ESEgbsLvXVVznlr8bnvVbuwAkheEsZoGuKi44w5^1h8t
zTVIC{GMB$3cZN1%c`6JJ6J`(u4g~1pqQ-C0`uPJ7&XJ8&Y%a3IOIOZ&u`mH{yF-AP
z)6I3gnSSzrbX30m5i>)dzb8F^?cEUvp#-jTRP^m5oob2>{!~9)VCv_WCIAN*F$TWr
z=E8X2%#yZ_1V<=cpgR*cDDf(mgU{Lmfz*C5Hrn0Usy&;c#mHpnfFtuAT$9fduVM_o
z&Nl=m|6p8ceST|A_ZJNKLa_cftqCWfYUF;iaOt}j;6q^zZ6!^P?cs%gd4!Cn0~)%j
z9iybuTTOSZiGXOS^R@&LlRQS(X*48`kO-@Z0u104#6MM{U>U(l?oeu24Ar;kC(AE9
z3=v(OT&g9}Y%ASkH{v3Yp;7}h3hYwaVvaHllsrp&d{>UPL=<Rq?s!KD2+x?vB^*vi
zLkuL_^2D-O-~U77i~CtyQ;uAD@)amlq*z8)iBe_CRVY<zjaH{O7)|Cff4aX4QxKQM
zd4a%!#Uk58KCpFUjvGMc3zf%}v;`JMF^N1>i&&n4XB^{1E^?R$fKc#IU}d<0nvs&K
G5C8yG1P2xX

delta 1640
zcmV-u2ABDu4U7#KcTYw#00961000Jz01E&B000h<000I&kr+9DGov<xQQA%RUmVzu
zDJCFgQ6%KPTlc|W=c4geV1G!L-J8&8jJZ#K8Pufi$9SM$``@{{{?yV(OcO)?L{V+p
zJR}lP5}6@+h+c`l@7|W+NbYu<u$Nm?BHT6>&1-G{JJ)f;9`HQQp!D{A_rB^%a>kVG
z{9w!3%<m=L17_lX&W(Eti)blcuz>Ats*x@E(uRp)0Vf%=|M#ixG6-B`<P&lV0<cYn
zi1sc|-2WPD`4FE@)Q5CRrsdl`{kwani$*a^cqJ4fi6-hvEL7TsMvRn_*@nxeY)<dP
zo1-?9=Lo1+ZmVe9?XO?cIP*Y@nMmN=z@cL}^CE*O?tKz}$-{y|@Jym%+A;S;GK&Qr
z`Ca!?MO96Gj5IW%x~8Q~vb(BcDyd;$Xi+}Ns^5)Mg{rE$nhr5@Hj31=we)0nJJs}+
zGHrugYU@gEdQ?M4%}6HKH<sNz)73MS7>6fP?64E<4Q-j0JcCFY1Kwf!*mE>*Ecund
zEmYm_%n;arzJnAo7WXd@Udi=K@lGzTn)9BPxPz9K7)zXV#syd1{FVIwzbJapY3E#u
zHw<O4YCdJAxfV02e|o6bO*!gt^R}@}<Gy!YOJ7yx_0o|T=26H1OStAAKtAkAbJXd!
zVVr4{b!hdu0u+W~H3*y4kFjKd8V(}IAq;UCJsiP*07ucpF^q5=9h^WHC(*`fjBy4T
z&Y^+xC~*OGTtW+%(Z>~3aTOKZ%q#c>VWSuXPyzxd1p!ooIGV{yt<Jw~_(}K;GiF<`
zSP<Sf-_=Tzy6%6(i<>i=^-i^0=Y2;Z0=UFn6-1wx2ziZx?!vh52Cvoo$PeFc*4rbw
z{y4mU4gKhyQQ*Fdq}mv;cCiWUMF%z|i*7bREvlZ`rVU#fF(Q)Z6m)wCddaNitR^68
zrN(C2g2m^9j0q$}Ioo8dR?BWI;+2zS%vKv<hwH{jm@^S@Ww9y&#0!3+i<XI5Re^Cv
zogLd11jxzY1|o`NObj`X7BS~iIBS9!%-My11Q|t@jEjayGG_Ib(Rna#nvx<f`GkbN
zo3UDec**nk6ton9kaOfsXcocQZ8eHw7N$yl;R=js3eQ7xpFZ`8d)SxVT$OKQbd=@F
z+9jlZ55RNFj9U0EgeUOK3nZ<a9Xu{(&%8#aBSlRC5ZoIQUlCK;bJj^-UGt}>6W*VH
z*jrdOS7@K?opc-P4Y+=8^gic4dvhxfe4TV{5PzJ@`G<g?Npf#kd-0-PZ;)xuUHbZy
zb!A2~GPxiy1AZ6tt@hq2h7TvJ0uHa!*FYU96J+Pk`auN}@h+`0r(FW3H=kVXo#T$F
z`Nj`Q&s6n#7UjwIzGe@n<#fbV<v!ehEM@CDDBoaFz#?OK0NMa3<ggGJ5t$(gzJAcN
zI&i2XAi^Hj<&%)bL9T&B?@!Xkp$t~+HsT3gXKJeN*8_IP8exeXE8_uv{ik1x#%cNW
z#^lTF;C(7yr|L)H924S3(f4OPnr)ti%Wfsw@PKdn^;HyYReDK4<D2G1*P~y59Y;&M
zpfMLRb3wuih(b^1ZJcUhmRc(%GnA;>suS=cclTg!JcTtA8Jwr&p-!c?UYGB)CZBO<
zXd{-Z!r(Ar20`FJAe0+MeaM~-U1P(5Zh_^S={G-p9^Jj};=i2X7Gc-ykJqC`uPucL
zZ6}_2HNtPT^?PfgTZ=z6Zyzv!2`|0@t0Pp{EPm6=THfYX7Sy%d6Uo&N6z?28FeHgH
zkg8gWOx*@lEVBLNs;-M-A(@0=;@*Hr!&Ag2o*R<Hw@3~AKxX1UD(<@t59_mya6ed3
z`rzg<a;e{#7XrB)eiZ9JO6|GWo!|1rE4(u(M%!L&J?6b?vPpQdFI*IViP+A<0|xb-
z>U?OL1Xu8ZCzGK9iC*|m)jeQE^-Zg@1x=F`oiTFdKcRZhPZ!tP@wU3ISMEVTp~z}o
z*!$*3*`88Lcg+*QCL&+#xF!)JrgG+24^SZ5>ny5g2Mrr9=}I5jF}?rC_kOoN{kTa8
zMPi9mCRZp`YK>N>HyBMvW{cHkcQ{?a(;2w%qHczQ<fPA?-h`h7LRXpkctsyX6bGcY
m?blOZvP%SYT)$2)>@w<#fD5)z&R>B<FY5$V)Jn#{00005tsigz

diff --git a/js-packages/web-console/src/assets/icons/feldera-material-icons/shield.svg b/js-packages/web-console/src/assets/icons/feldera-material-icons/shield.svg
new file mode 100755
index 00000000000..eaf151adc7b
--- /dev/null
+++ b/js-packages/web-console/src/assets/icons/feldera-material-icons/shield.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" fill="none" viewBox="0 0 24 24"><path stroke="#C533B9" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1v7Z"/></svg>
\ No newline at end of file
diff --git a/js-packages/web-console/src/lib/components/admin/AdminPage.svelte b/js-packages/web-console/src/lib/components/admin/AdminPage.svelte
index 5f85f37316d..c36595ebb7e 100644
--- a/js-packages/web-console/src/lib/components/admin/AdminPage.svelte
+++ b/js-packages/web-console/src/lib/components/admin/AdminPage.svelte
@@ -1,9 +1,10 @@
 <script lang="ts">
+  import { Listbox, useListCollection } from '@skeletonlabs/skeleton-svelte'
   import { asyncReadable } from '@square/svelte-store'
-  import { Select } from 'common-ui'
   import { page } from '$app/state'
   import TenantList from '$lib/components/admin/TenantList.svelte'
   import UserRoleTable from '$lib/components/admin/UserRoleTable.svelte'
+  import Popup from '$lib/components/common/Popup.svelte'
   import { usePermission } from '$lib/compositions/usePermission.svelte'
   import { getConfiguredOwners, getTenants, type Tenant } from '$lib/services/pipelineManager'
   import type { Snippet } from '$lib/types/svelte'
@@ -23,6 +24,15 @@
       page.data.feldera?.tenantName ??
       'current tenant'
   )
+  // Tenants the header picker can switch to: every tenant except the one whose
+  // members already show below, since the picker's job is to pick a different one.
+  const tenantCollection = $derived(
+    useListCollection({
+      items: $tenants.filter((t) => t.id !== adminTenant),
+      itemToValue: (t) => t.id,
+      itemToString: (t) => t.name
+    })
+  )
 
   // Owner comes from deploy-time configuration, so this list is read-only: the
   // way to change it is to change the deployment. Owner-only, like the endpoint
@@ -36,11 +46,13 @@
   >(undefined, getConfiguredOwners)
 </script>
 
-{#snippet section(title: string, description: string, body: Snippet)}
-  <section class="flex flex-col gap-3 rounded-container bg-surface-50-950 p-4 md:p-6">
+{#snippet section(title: string | Snippet, description: string, body: Snippet)}
+  <section class="flex flex-col gap-3 rounded-container border border-surface-200-800 p-4 md:p-6">
     <div>
-      <h2 class="h3">{title}</h2>
-      <p class="text-sm opacity-70">{description}</p>
+      <h2 class="text-xl font-semibold">
+        {#if typeof title === 'string'}{title}{:else}{@render title()}{/if}
+      </h2>
+      <p class="text-sm">{description}</p>
     </div>
     {@render body()}
   </section>
@@ -53,32 +65,53 @@
     <div class="rounded preset-outlined-error-600-400 p-2 text-sm">{errorMessage}</div>
   {/if}
 
-  {#if manageTenants.allowed}
-    <!-- Owner-only tenant switcher for the members view below. Prominent so it
-         is not mistaken for a minor control. -->
-    <div
-      class="flex flex-wrap items-center gap-3 rounded-container preset-outlined-primary-500 p-3 md:p-4"
-    >
-      <span class="fd fd-users text-[24px]"></span>
-      <div class="flex flex-col">
-        <span class="text-xs font-semibold tracking-wide uppercase opacity-70">
-          View members of tenant
-        </span>
-        <span class="text-sm opacity-70">The users list below reflects this tenant.</span>
-      </div>
-      <Select class="ml-auto w-64" bind:value={adminTenant}>
-        {#each $tenants as t (t.id)}
-          <option value={t.id}>{t.name}</option>
-        {/each}
-      </Select>
-    </div>
-  {/if}
-
   {#snippet usersBody()}
     <UserRoleTable tenant={selectedTenant}></UserRoleTable>
   {/snippet}
+  {#snippet usersTitle()}
+    Users &amp; roles — {#if manageTenants.allowed}
+      <!-- Owner-only: click the tenant name to switch which tenant's members
+           show below, without moving the global acting-tenant. -->
+      <Popup wrapperClass="inline-block align-baseline">
+        {#snippet trigger(toggle)}
+          <button type="button" onclick={toggle} class="group inline-flex items-baseline gap-2">
+            <span class="group-hover:underline">{tenantLabel}</span>
+
+            <span class="text-base font-normal text-primary-500 group-hover:underline"
+              >select a different tenant</span
+            >
+          </button>
+        {/snippet}
+        {#snippet content(close)}
+          <div
+            class="bg-white-dark absolute top-full -left-5 z-30 mt-1 max-h-64 w-64 overflow-auto rounded-container shadow-md"
+          >
+            <Listbox
+              collection={tenantCollection}
+              selectionMode="single"
+              onValueChange={(e) => {
+                adminTenant = e.value[0] ?? ''
+                close()
+              }}
+            >
+              <Listbox.Content class="bg-white-dark flex flex-col">
+                {#each tenantCollection.items as t (t.id)}
+                  <Listbox.Item
+                    item={t}
+                    class="cursor-pointer px-3 py-1.5 hover:preset-tonal-surface"
+                  >
+                    <Listbox.ItemText>{t.name}</Listbox.ItemText>
+                  </Listbox.Item>
+                {/each}
+              </Listbox.Content>
+            </Listbox>
+          </div>
+        {/snippet}
+      </Popup>
+    {:else}{tenantLabel}{/if}
+  {/snippet}
   {@render section(
-    `Users & roles — ${tenantLabel}`,
+    usersTitle,
     'Members of this tenant and their roles. To manage this tenant’s OIDC trust relationships, use the "Manage OIDC trust" menu.',
     usersBody
   )}
@@ -87,22 +120,22 @@
     {#snippet ownersBody()}
       <div class="flex flex-col gap-3">
         <div class="flex flex-col gap-1">
-          <div class="text-sm font-medium">Users</div>
+          <div class="text-lg font-medium">Users</div>
           {#each $configuredOwners?.owners ?? [] as owner (owner)}
-            <div class="text-sm"><code>{owner}</code></div>
+            <div class=""><code>{owner}</code></div>
           {:else}
-            <div class="text-sm opacity-70">None configured</div>
+            <div class="">None configured</div>
           {/each}
         </div>
         <div class="flex flex-col gap-1">
-          <div class="text-sm font-medium">Workloads (OIDC trust)</div>
+          <div class="text-lg font-medium">Workloads (OIDC trust)</div>
           {#each $configuredOwners?.owner_trusts ?? [] as trust (trust.issuer + trust.subject)}
-            <div class="text-sm">
+            <div class="">
               <code>{trust.issuer}</code> · sub=<code>{trust.subject}</code>{#if trust.audience}
                 · aud=<code>{trust.audience}</code>{/if}
             </div>
           {:else}
-            <div class="text-sm opacity-70">None configured</div>
+            <div class="">None configured</div>
           {/each}
         </div>
       </div>
diff --git a/js-packages/web-console/src/lib/components/admin/AdminPage.svelte.spec.ts b/js-packages/web-console/src/lib/components/admin/AdminPage.svelte.spec.ts
new file mode 100644
index 00000000000..8616a900b7c
--- /dev/null
+++ b/js-packages/web-console/src/lib/components/admin/AdminPage.svelte.spec.ts
@@ -0,0 +1,119 @@
+/**
+ * Gating and behavior tests for the admin page header's tenant picker. The
+ * "Users & roles" header lets an owner switch which tenant's members show
+ * below; the trigger (the tenant name plus a "select a different tenant" hint)
+ * is owner-only (`write:tenant`). A non-owner sees the tenant name as plain
+ * text. The picker omits the tenant already shown and closes on selection.
+ *
+ * The child tables (UserRoleTable, TenantList) are stubbed out: they mount
+ * monaco-backed dialogs and fetch on mount, none of which the header gate
+ * touches. That keeps this test to AdminPage's own markup.
+ */
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { page } from 'vitest/browser'
+import { render } from 'vitest-browser-svelte'
+import { permissionsOf } from '$lib/services/rbac'
+
+type Role = 'read' | 'write' | 'admin' | 'owner'
+const roleState = vi.hoisted(() => ({ current: 'owner' as Role }))
+const current = vi.hoisted(() => ({ id: '', name: 'acme-tenant' }))
+const tenantsState = vi.hoisted(() => ({ list: [] as { id: string; name: string }[] }))
+
+vi.mock('$app/state', () => ({
+  page: {
+    data: {
+      get feldera() {
+        return {
+          role: roleState.current,
+          permissions: permissionsOf(roleState.current),
+          tenantId: current.id,
+          tenantName: current.name
+        }
+      }
+    }
+  }
+}))
+// Stub the heavy child tables to empty components.
+vi.mock('$lib/components/admin/UserRoleTable.svelte', () => ({ default: () => {} }))
+vi.mock('$lib/components/admin/TenantList.svelte', () => ({ default: () => {} }))
+vi.mock('$lib/services/pipelineManager', () => ({
+  getTenants: vi.fn(async () => tenantsState.list),
+  getConfiguredOwners: vi.fn(async () => undefined)
+}))
+
+// Imported AFTER vi.mock so the mocks take effect.
+import AdminPage from './AdminPage.svelte'
+
+let mounted: { unmount: () => Promise<void> } | undefined
+let mountTarget: HTMLDivElement | undefined
+
+function mountPage(role: Role) {
+  roleState.current = role
+  mountTarget = document.createElement('div')
+  document.body.appendChild(mountTarget)
+  mounted = render(AdminPage, { target: mountTarget }) as any
+}
+
+const headingText = () =>
+  Array.from(document.querySelectorAll('h2')).map((h) => h.textContent ?? '')
+const usersHeading = () => headingText().find((t) => t.includes('Users & roles')) ?? ''
+const optionLabels = () =>
+  Array.from(document.querySelectorAll('[role="option"]')).map((e) => e.textContent?.trim() ?? '')
+
+describe('AdminPage — write:tenant header picker', () => {
+  afterEach(async () => {
+    await mounted?.unmount()
+    mounted = undefined
+    mountTarget?.remove()
+    mountTarget = undefined
+    roleState.current = 'owner'
+    current.id = ''
+    current.name = 'acme-tenant'
+    tenantsState.list = []
+    vi.clearAllMocks()
+  })
+
+  it('offers the tenant picker to an owner', () => {
+    mountPage('owner')
+    expect(usersHeading()).toContain('acme-tenant')
+    expect(usersHeading()).toContain('select a different tenant')
+  })
+
+  it('shows the tenant name as plain text to a non-owner admin', () => {
+    mountPage('admin')
+    // Reverting the gate (rendering the picker unconditionally) surfaces the
+    // hint here and fails this test.
+    expect(usersHeading()).toContain('acme-tenant')
+    expect(usersHeading()).not.toContain('select a different tenant')
+  })
+
+  it('lists the other tenants and omits the one already shown', async () => {
+    current.id = 't-acme'
+    current.name = 'acme'
+    tenantsState.list = [
+      { id: 't-acme', name: 'acme' },
+      { id: 't-beta', name: 'beta' },
+      { id: 't-gamma', name: 'gamma' }
+    ]
+    mountPage('owner')
+    await page.getByText('select a different tenant').click()
+    // Dropping the `t.id !== adminTenant` filter re-adds "acme" and fails this.
+    await expect.poll(optionLabels).toEqual(['beta', 'gamma'])
+  })
+
+  it('switches the shown tenant and closes on selection', async () => {
+    current.id = 't-acme'
+    current.name = 'acme'
+    tenantsState.list = [
+      { id: 't-acme', name: 'acme' },
+      { id: 't-beta', name: 'beta' }
+    ]
+    mountPage('owner')
+    await page.getByText('select a different tenant').click()
+    await expect.poll(optionLabels).toEqual(['beta'])
+    await page.getByRole('option', { name: 'beta' }).click()
+    // Header now reflects the new tenant, and the list is gone (auto-closed).
+    await expect.poll(usersHeading).toContain('beta')
+    await expect.poll(optionLabels).toEqual([])
+  })
+})
diff --git a/js-packages/web-console/src/lib/components/admin/TenantList.svelte b/js-packages/web-console/src/lib/components/admin/TenantList.svelte
index 78b320cca61..752a3310784 100644
--- a/js-packages/web-console/src/lib/components/admin/TenantList.svelte
+++ b/js-packages/web-console/src/lib/components/admin/TenantList.svelte
@@ -2,7 +2,10 @@
   import { asyncReadable } from '@square/svelte-store'
   import { goto, invalidateAll } from '$app/navigation'
   import { page } from '$app/state'
+  import DeleteDialog, { deleteDialogProps } from '$lib/components/dialogs/DeleteDialog.svelte'
+  import DoubleClickInput from '$lib/components/input/DoubleClickInput.svelte'
   import { clearConfigCaches } from '$lib/compositions/configCache'
+  import { useGlobalDialog } from '$lib/compositions/layout/useGlobalDialog.svelte'
   import { resolve } from '$lib/functions/svelte'
   import { setSelectedTenant } from '$lib/services/auth'
   import {
@@ -57,42 +60,25 @@
     }
   }
 
-  let renamingId = $state('')
-  let renamedName = $state('')
   let renaming = $state(false)
 
-  const startRename = (tenant: Tenant) => {
-    errorMessage = ''
-    noticeMessage = ''
-    nameToTakeOver = ''
-    renamingId = tenant.id
-    renamedName = tenant.name
-  }
-
-  const cancelRename = () => {
-    renamingId = ''
-    renamedName = ''
-    nameToTakeOver = ''
-  }
-
   // Set when a rename conflicts, to offer taking the name from the tenant that
   // holds it. Every request re-creates the name its token resolves, so a
   // conflict is the normal case when recovering a tenant no login reaches.
-  let nameToTakeOver = $state('')
+  let conflict = $state<{ tenantId: string; name: string } | null>(null)
 
-  const submitRename = async (displaceExisting = false) => {
-    const name = renamedName.trim()
+  const rename = async (tenantId: string, rawName: string, displaceExisting = false) => {
+    const name = rawName.trim()
     if (!name) {
       errorMessage = 'Specify a tenant name'
       return
     }
     errorMessage = ''
     noticeMessage = ''
-    nameToTakeOver = ''
+    conflict = null
     renaming = true
     try {
-      const { displaced } = await renameTenant(renamingId, name, displaceExisting)
-      cancelRename()
+      const { displaced } = await renameTenant(tenantId, name, displaceExisting)
       if (displaced) {
         noticeMessage = `Took the name '${name}'. The tenant that held it is now '${displaced.name}' and keeps everything it had.`
       }
@@ -104,7 +90,7 @@
     } catch (e) {
       const message = e instanceof Error ? e.message : String(e)
       if (/already exists|DuplicateName/i.test(message) && !displaceExisting) {
-        nameToTakeOver = name
+        conflict = { tenantId, name }
       } else {
         errorMessage = message
       }
@@ -113,29 +99,19 @@
     }
   }
 
+  const globalDialog = useGlobalDialog()
+
   // Deletion is refused unless the tenant is empty, so the confirmation is
   // about intent, not about losing data.
-  let tenantToDelete = $state('')
-  let deleting = $state(false)
-
-  const confirmDelete = async (tenant: Tenant) => {
+  const remove = async (tenant: Tenant) => {
     errorMessage = ''
     noticeMessage = ''
-    if (tenantToDelete !== tenant.id) {
-      tenantToDelete = tenant.id
-      return
-    }
-    deleting = true
     try {
       await deleteTenant(tenant.id)
-      tenantToDelete = ''
       noticeMessage = `Deleted tenant '${tenant.name}'.`
       tenants.reload?.()
     } catch (e) {
-      tenantToDelete = ''
       errorMessage = e instanceof Error ? e.message : String(e)
-    } finally {
-      deleting = false
     }
   }
 
@@ -159,86 +135,77 @@
   {#if noticeMessage}
     <div class="rounded preset-outlined-success-600-400 p-2 text-sm">{noticeMessage}</div>
   {/if}
-  <div class="scrollbar flex flex-col gap-2 overflow-auto">
+  <div class="scrollbar flex flex-col gap-2 overflow-visible">
     {#each $tenants as tenant (tenant.id)}
-      <div class="flex flex-nowrap items-center gap-2 border-b border-surface-100-900 py-2">
-        <div class="w-full">
-          {#if renamingId === tenant.id}
-            <form
-              class="flex items-center gap-2"
-              onsubmit={(e) => {
-                e.preventDefault()
-                submitRename()
-              }}
-            >
-              <!-- svelte-ignore a11y_autofocus -->
-              <input class="input w-72" bind:value={renamedName} autofocus />
-              <button class="btn preset-filled-surface-50-950" disabled={renaming}>Save</button>
+      <div class="flex flex-wrap items-center gap-2 border-b border-surface-200-800 py-2">
+        <div class="">
+          <!-- Rename in place: the input sits where the name was, so editing
+               reads as editing the name rather than filling a form. -->
+          <DoubleClickInput
+            value={tenant.name}
+            onvalue={(name) => rename(tenant.id, name)}
+            editLabel="Edit tenant name"
+            class="flex h-5 flex-nowrap gap-1"
+            inputClass="input font-medium -ml-1 w-72 h-5 pl-1"
+          >
+            <div class="font-medium">{tenant.name}</div>
+            {#if tenant.id === currentTenantId}
+              <span class="text-sm text-surface-800-200">(current)</span>
+            {/if}
+          </DoubleClickInput>
+          {#if conflict?.tenantId === tenant.id}
+            {@const pending = conflict!}
+            <div class="mt-2 rounded preset-outlined-warning-600-400 p-2 text-sm">
+              Another tenant is named <code>{pending.name}</code>. Taking the name renames that
+              tenant to <code>{pending.name} (its id)</code>; it keeps its pipelines, keys and
+              members. Logins that resolve <code>{pending.name}</code> then land here.
               <button
-                type="button"
-                class="btn preset-tonal-surface"
+                class="ml-2 btn preset-filled-surface-50-950"
                 disabled={renaming}
-                onclick={cancelRename}
+                onclick={() => rename(tenant.id, pending.name, true)}
               >
-                Cancel
+                Take the name
               </button>
-            </form>
-            {#if nameToTakeOver}
-              <div class="mt-2 rounded preset-outlined-warning-600-400 p-2 text-sm">
-                Another tenant is named <code>{nameToTakeOver}</code>. Taking the name renames that
-                tenant to <code>{nameToTakeOver} (its id)</code>; it keeps its pipelines, keys and
-                members. Logins that resolve <code>{nameToTakeOver}</code> then land here.
-                <button
-                  class="ml-2 btn preset-filled-surface-50-950"
-                  disabled={renaming}
-                  onclick={() => submitRename(true)}
-                >
-                  Take the name
-                </button>
-              </div>
-            {/if}
-          {:else}
-            <div class="font-medium">
-              {tenant.name}
-              {#if tenant.id === currentTenantId}
-                <span class="text-xs opacity-70">(current)</span>
-              {/if}
             </div>
           {/if}
           <!-- The issuer is provenance, not something a login resolves, so it
                stays out of the row and is available on hover. -->
-          <div class="text-sm opacity-70" title="First provisioned under {tenant.initial_provider}">
+          <div
+            class="text-sm text-surface-800-200"
+            title="First provisioned under {tenant.initial_provider}"
+          >
             {tenant.id}
           </div>
         </div>
-        <button
-          class="btn preset-tonal-surface"
-          disabled={renamingId === tenant.id}
-          onclick={() => startRename(tenant)}
-          title="A login resolves its tenant by name: renaming changes which users land in this tenant."
-        >
-          Rename
-        </button>
-        <button
-          class="btn preset-filled-surface-50-950"
-          disabled={tenant.id === currentTenantId}
-          onclick={() => actAs(tenant)}
-        >
-          Act as this tenant
-        </button>
-        <button
-          class="btn {tenantToDelete === tenant.id
-            ? 'preset-filled-error-500'
-            : 'preset-tonal-surface'}"
-          disabled={deleting || tenant.id === currentTenantId}
-          onclick={() => confirmDelete(tenant)}
-          title="Only an empty tenant can be deleted: no pipelines, API keys or OIDC trust relationships."
-        >
-          {tenantToDelete === tenant.id ? 'Confirm delete' : 'Delete'}
-        </button>
+        {#snippet deleteDialog()}
+          <DeleteDialog
+            {...deleteDialogProps(
+              'Delete',
+              `Delete tenant '${tenant.name}'?`,
+              () => remove(tenant),
+              'Only an empty tenant can be deleted: no pipelines, API keys or OIDC trust relationships.'
+            )()}
+          ></DeleteDialog>
+        {/snippet}
+        <div class="ml-auto flex flex-nowrap gap-2">
+          <button
+            class="btn preset-filled-surface-50-950"
+            disabled={tenant.id === currentTenantId}
+            onclick={() => actAs(tenant)}
+          >
+            Act as this tenant
+          </button>
+          <button
+            class="fd fd-trash-2 btn-icon text-[20px] hover:bg-surface-50-950"
+            disabled={tenant.id === currentTenantId}
+            onclick={() => (globalDialog.dialog = deleteDialog)}
+            aria-label="Delete tenant {tenant.name}"
+            title="Only an empty tenant can be deleted: no pipelines, API keys or OIDC trust relationships."
+          ></button>
+        </div>
       </div>
     {:else}
-      <div class="opacity-70">No tenants found</div>
+      <div class="text-surface-800-200">No tenants found</div>
     {/each}
   </div>
 
@@ -251,7 +218,7 @@
   >
     <label class="label w-full">
       <span>New tenant name</span>
-      <input class="input w-full" placeholder="acme-prod" bind:value={newName} />
+      <input class="input h-9 w-full" placeholder="acme-prod" bind:value={newName} />
     </label>
     <button
       class="btn preset-filled-surface-50-950"
diff --git a/js-packages/web-console/src/lib/components/admin/TenantList.svelte.spec.ts b/js-packages/web-console/src/lib/components/admin/TenantList.svelte.spec.ts
new file mode 100644
index 00000000000..39880a3b03a
--- /dev/null
+++ b/js-packages/web-console/src/lib/components/admin/TenantList.svelte.spec.ts
@@ -0,0 +1,125 @@
+/**
+ * Tenants are renamed in place with the same DoubleClickInput used for pipeline
+ * names: the edit affordance opens an input where the name was, Enter commits.
+ * These tests drive that path, the DuplicateName recovery ("Take the name")
+ * which retries the rename with displace_existing, and deletion through the
+ * shared DeleteDialog.
+ */
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { page } from 'vitest/browser'
+import { render } from 'vitest-browser-svelte'
+
+const tenantsState = vi.hoisted(() => ({
+  list: [{ id: 't1', name: 'acme', initial_provider: 'oidc' }] as any[]
+}))
+const renameTenant = vi.hoisted(() => vi.fn())
+const deleteTenant = vi.hoisted(() => vi.fn())
+
+vi.mock('$app/state', () => ({ page: { data: { feldera: { tenantId: 't-other' } } } }))
+vi.mock('$app/navigation', () => ({ goto: vi.fn(), invalidateAll: vi.fn(async () => {}) }))
+vi.mock('$lib/compositions/configCache', () => ({ clearConfigCaches: vi.fn() }))
+vi.mock('$lib/services/auth', () => ({ setSelectedTenant: vi.fn() }))
+vi.mock('$lib/services/pipelineManager', () => ({
+  getTenants: vi.fn(async () => tenantsState.list),
+  getAuthConfig: vi.fn(async () => undefined),
+  createTenant: vi.fn(),
+  deleteTenant: (...args: unknown[]) => deleteTenant(...args),
+  renameTenant: (...args: unknown[]) => renameTenant(...args)
+}))
+
+// Imported AFTER vi.mock so the mocks take effect.
+import GlobalModal from '$lib/components/dialogs/GlobalModal.svelte'
+import { useGlobalDialog } from '$lib/compositions/layout/useGlobalDialog.svelte'
+import TenantList from './TenantList.svelte'
+
+let mounted: { unmount: () => Promise<void> } | undefined
+let mountTarget: HTMLDivElement | undefined
+
+function mountList() {
+  mountTarget = document.createElement('div')
+  document.body.appendChild(mountTarget)
+  mounted = render(TenantList, { target: mountTarget }) as any
+}
+
+// The rename input is the DoubleClickInput's, distinct from the create-tenant
+// input at the bottom (which starts empty).
+const renameInput = () =>
+  Array.from(document.querySelectorAll<HTMLInputElement>('input')).find((i) => i.value === 'acme')
+
+async function openRenameAndCommit(newName: string) {
+  // Double-click the name to open the editor. The pencil button opens it too,
+  // but its icon-font glyph has no box in the headless browser, so a click
+  // there never lands.
+  await page.getByText('acme', { exact: true }).dblClick()
+  await expect.poll(() => renameInput()).toBeTruthy()
+  const input = renameInput()!
+  input.value = newName
+  input.dispatchEvent(new KeyboardEvent('keydown', { key: 'Enter', bubbles: true }))
+}
+
+let modal: { unmount: () => Promise<void> } | undefined
+let modalTarget: HTMLDivElement | undefined
+
+// Mount the shared modal host with whatever the row's trash button opened, so
+// the DeleteDialog and its confirm button render for the test to drive.
+function mountOpenDialog() {
+  modalTarget = document.createElement('div')
+  document.body.appendChild(modalTarget)
+  modal = render(GlobalModal, {
+    target: modalTarget,
+    props: { dialog: useGlobalDialog().dialog }
+  }) as any
+}
+
+describe('TenantList — in-place rename', () => {
+  afterEach(async () => {
+    await mounted?.unmount()
+    mounted = undefined
+    mountTarget?.remove()
+    mountTarget = undefined
+    await modal?.unmount()
+    modal = undefined
+    modalTarget?.remove()
+    modalTarget = undefined
+    useGlobalDialog().dialog = null
+    renameTenant.mockReset()
+    deleteTenant.mockReset()
+    vi.clearAllMocks()
+  })
+
+  it('commits a rename through the DoubleClickInput', async () => {
+    renameTenant.mockResolvedValue({})
+    mountList()
+    await expect.poll(() => document.body.textContent).toContain('acme')
+    await openRenameAndCommit('acme-2')
+    // Removing the onvalue wiring (or the component) fails this assertion.
+    await expect.poll(() => renameTenant.mock.calls).toContainEqual(['t1', 'acme-2', false])
+  })
+
+  it('offers to take the name on a DuplicateName conflict', async () => {
+    renameTenant.mockRejectedValueOnce(new Error('a tenant with this name already exists'))
+    renameTenant.mockResolvedValueOnce({})
+    mountList()
+    await expect.poll(() => document.body.textContent).toContain('acme')
+    await openRenameAndCommit('taken')
+    // The conflict surfaces the recovery affordance...
+    await page.getByRole('button', { name: 'Take the name' }).click()
+    // ...which retries with displace_existing = true.
+    await expect.poll(() => renameTenant.mock.calls).toContainEqual(['t1', 'taken', true])
+  })
+
+  it('deletes a tenant through the DeleteDialog', async () => {
+    deleteTenant.mockResolvedValue(undefined)
+    mountList()
+    await expect.poll(() => document.body.textContent).toContain('acme')
+    // The trash button is an icon-font button (no box in the headless browser),
+    // so dispatch its click directly rather than through the actionability check.
+    const trash = document.querySelector<HTMLButtonElement>('[aria-label="Delete tenant acme"]')!
+    trash.click()
+    // The button only opens the confirmation; nothing is deleted yet.
+    expect(deleteTenant).not.toHaveBeenCalled()
+    mountOpenDialog()
+    await page.getByTestId('button-confirm-delete').click()
+    await expect.poll(() => deleteTenant.mock.calls).toContainEqual(['t1'])
+  })
+})
diff --git a/js-packages/web-console/src/lib/components/admin/UserRoleTable.svelte b/js-packages/web-console/src/lib/components/admin/UserRoleTable.svelte
index bb9aaa9d10b..9906117797d 100644
--- a/js-packages/web-console/src/lib/components/admin/UserRoleTable.svelte
+++ b/js-packages/web-console/src/lib/components/admin/UserRoleTable.svelte
@@ -99,7 +99,7 @@
 </script>
 
 <div class="flex flex-col gap-3">
-  <p class="text-sm opacity-70">
+  <p class="text-sm text-surface-800-200">
     Members appear here after their first login. Assign read, write, or admin. Removing a member
     drops their role now, but if your identity provider still grants them access they are re-added
     at the default role on their next login — revoke at the provider for a durable block.
@@ -111,10 +111,10 @@
 
   <!-- Pre-provision by identity: create the membership before the user's first
        login. The grant is dormant until that identity signs in to the tenant. -->
-  <div class="rounded border border-surface-100-900 p-3">
+  <div class="rounded border border-surface-200-800 p-3">
     <div class="mb-2">
       <div class="font-medium">Pre-provision a member</div>
-      <p class="text-sm opacity-70">
+      <p class="text-sm text-surface-800-200">
         Grant a role before the user's first login. <b>Subject</b> must exactly match the
         <code>sub</code> claim of the JWT the user will present — otherwise the grant will not attach
         at login. The issuer is the platform's configured one (shown below). Email is for display only.
@@ -128,9 +128,9 @@
       }}
     >
       <label class="flex flex-col text-sm">
-        <span class="opacity-70">Provider — OIDC issuer (<code>iss</code>)</span>
+        <span class="text-surface-800-200">Provider — OIDC issuer (<code>iss</code>)</span>
         <input
-          class="input w-64 opacity-60"
+          class="input h-9 w-64 opacity-60"
           value={configuredIssuer}
           readonly
           disabled
@@ -138,20 +138,20 @@
         />
       </label>
       <label class="flex flex-col text-sm">
-        <span class="opacity-70">Subject — OIDC <code>sub</code></span>
+        <span class="text-surface-800-200">Subject — OIDC <code>sub</code></span>
         <input
-          class="input w-56"
+          class="input h-9 w-56"
           bind:value={newSubject}
           placeholder="10769150350006150715113082367"
         />
       </label>
       <label class="flex flex-col text-sm">
-        <span class="opacity-70">Email (display only)</span>
-        <input class="input w-56" bind:value={newEmail} placeholder="user@acme.com" />
+        <span class="text-surface-800-200">Email (display only)</span>
+        <input class="input h-9 w-56" bind:value={newEmail} placeholder="user@acme.com" />
       </label>
       <label class="flex flex-col text-sm">
-        <span class="opacity-70">Role</span>
-        <Select bind:value={newRole} class="w-28">
+        <span class="text-surface-800-200">Role</span>
+        <Select bind:value={newRole} class="h-9 w-28">
           <option value="read">read</option>
           <option value="write">write</option>
           <option value="admin">admin</option>
@@ -203,7 +203,7 @@
       <div class="flex flex-nowrap items-center gap-2 border-b border-surface-100-900 py-2">
         <div class="w-full">
           <div class="font-medium">{user.email ?? user.subject}</div>
-          <div class="text-sm opacity-70">
+          <div class="text-sm text-surface-800-200">
             <code>{user.provider}</code> · sub=<code>{user.subject}</code>
           </div>
         </div>
@@ -216,7 +216,7 @@
                 | 'write'
                 | 'admin'
             }}
-            class="w-28"
+            class="h-9 w-28"
             aria-label="Role for {user.email ?? user.subject}"
           >
             <option value="read">read</option>
@@ -233,7 +233,7 @@
         {:else}
           <!-- owner is platform-wide, not a tenant membership, so it is shown
                read-only here. -->
-          <span class="w-28 text-center opacity-70">{user.role}</span>
+          <span class="w-28 text-center text-surface-800-200">{user.role}</span>
         {/if}
         <button
           class="fd fd-trash-2 btn-icon text-[20px]"
@@ -242,7 +242,7 @@
         ></button>
       </div>
     {:else}
-      <div class="opacity-70">No members yet. Users appear after their first login.</div>
+      <div class="text-surface-800-200">No members yet. Users appear after their first login.</div>
     {/each}
   </div>
 </div>
diff --git a/js-packages/web-console/src/lib/components/auth/ProfileButton.svelte b/js-packages/web-console/src/lib/components/auth/ProfileButton.svelte
index 9454e9cbd67..e3514ee1eee 100644
--- a/js-packages/web-console/src/lib/components/auth/ProfileButton.svelte
+++ b/js-packages/web-console/src/lib/components/auth/ProfileButton.svelte
@@ -88,7 +88,7 @@
 
         {#if typeof auth === 'object' && 'logout' in auth}
           <RBAC require="write:tenant_member">
-            {@render profileItemButton('Admin', adminIcon, { href: resolve('/admin') })}
+            {@render profileItemButton('Admin Dashboard', adminIcon, { href: resolve('/admin') })}
           </RBAC>
           <RBAC require="write:api_key">
             {@render profileItemButton('Manage API keys', apiKeysIcon, {
diff --git a/js-packages/web-console/src/lib/components/dialogs/GenericDialog.svelte b/js-packages/web-console/src/lib/components/dialogs/GenericDialog.svelte
index 00f4791e82a..cac60de93b9 100644
--- a/js-packages/web-console/src/lib/components/dialogs/GenericDialog.svelte
+++ b/js-packages/web-console/src/lib/components/dialogs/GenericDialog.svelte
@@ -45,7 +45,7 @@
     {/if}
   </div>
   <div
-    class="-mr-4 scrollbar flex max-h-[calc(90vh-96px)] flex-col gap-4 overflow-visible pr-4 sm:-mr-8"
+    class="-mr-4 scrollbar flex max-h-[calc(90vh-116px)] flex-col gap-4 overflow-visible pr-4 sm:-mr-8 sm:pr-8"
   >
     {#if content.description}
       <span class="whitespace-pre-wrap" data-testid="box-dialog-description">
@@ -63,10 +63,7 @@
     {@render children?.()}
   </div>
   {#if content.onSuccess || content.onCancel}
-    <div
-      class="flex w-full flex-col-reverse gap-4 sm:flex-row sm:justify-end"
-      data-testid="box-dialog-actions"
-    >
+    <div class="flex w-full flex-nowrap justify-end gap-4" data-testid="box-dialog-actions">
       <button
         onclick={() => cancel()}
         class="btn preset-filled-surface-50-950 px-4"
diff --git a/js-packages/web-console/src/lib/components/input/DoubleClickInput.svelte b/js-packages/web-console/src/lib/components/input/DoubleClickInput.svelte
index 54701c4800c..fce82ed6d51 100644
--- a/js-packages/web-console/src/lib/components/input/DoubleClickInput.svelte
+++ b/js-packages/web-console/src/lib/components/input/DoubleClickInput.svelte
@@ -8,7 +8,8 @@
     onvalue,
     class: _class = '',
     inputClass,
-    disabled
+    disabled,
+    editLabel = 'Edit name'
   }: {
     value: string
     children?: Snippet
@@ -16,6 +17,7 @@
     class?: string
     inputClass?: string
     disabled?: boolean
+    editLabel?: string
   } = $props()
   let showInput = $state(false)
 
@@ -78,7 +80,7 @@
       class="fd fd-pencil-line text-[20px] text-surface-400-600 {disabled
         ? ''
         : 'group-hover:text-surface-950-50'}"
-      aria-label="Edit pipeline name"
+      aria-label={editLabel}
     >
     </button>
   </span>
diff --git a/js-packages/web-console/src/lib/components/layout/pipelines/PipelineEditLayout.svelte b/js-packages/web-console/src/lib/components/layout/pipelines/PipelineEditLayout.svelte
index bd812c23752..680b362efd1 100644
--- a/js-packages/web-console/src/lib/components/layout/pipelines/PipelineEditLayout.svelte
+++ b/js-packages/web-console/src/lib/components/layout/pipelines/PipelineEditLayout.svelte
@@ -259,6 +259,7 @@
                 })
               }}
               disabled={editNameDisabled}
+              editLabel="Edit pipeline name"
               class="inline overflow-hidden overflow-ellipsis"
               inputClass="input flex -ml-1 mr-2 py-0 pl-1 text-base mt-1"
             >
diff --git a/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte b/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte
index 4a265376924..caf9c09c7a6 100644
--- a/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte
+++ b/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte
@@ -1,3 +1,15 @@
+<script lang="ts" module>
+  // Fields to prefill the form with, e.g. to duplicate an existing trust.
+  export type TrustFormData = {
+    name: string
+    issuer: string
+    subject: string
+    audience: string
+    description: string
+    role: 'read' | 'write' | 'admin'
+  }
+</script>
+
 <script lang="ts">
   import { Select } from 'common-ui'
   import { Control, Field, FieldErrors, Label } from 'formsnap'
@@ -5,7 +17,7 @@
   import { valibot } from 'sveltekit-superforms/adapters'
 
   import * as va from 'valibot'
-  import { postOidcTrust, type MemberRole } from '$lib/services/pipelineManager'
+  import { type MemberRole, postOidcTrust } from '$lib/services/pipelineManager'
 
   const {
     onSubmit,
@@ -68,10 +80,26 @@
     }
   )
   const { form: formData, enhance, submit } = form
+
+  // Prefill the form to duplicate an existing trust; the user reviews and
+  // presses Create. The caller reveals and scrolls the form into view.
+  export function fill(values: TrustFormData) {
+    $formData = { ...$formData, ...values }
+  }
 </script>
 
+{#snippet fieldErrors()}
+  <FieldErrors>
+    {#snippet children({ errors, errorProps })}
+      {#each errors as error}
+        <span class="text-error-500" {...errorProps}>{error}</span>
+      {/each}
+    {/snippet}
+  </FieldErrors>
+{/snippet}
+
 <form
-  class="flex flex-col gap-3"
+  class="flex flex-col gap-2"
   use:enhance
   onkeydown={(event) => {
     if (event.key === 'Enter') {
@@ -80,25 +108,20 @@
     }
   }}
 >
+  <span class="text-xl font-semibold">Create new trust</span>
   <Field {form} name="name">
     <Control>
       {#snippet children(attrs)}
         <Label>Name</Label>
         <input
           placeholder="github-actions-prod"
-          class="input w-full"
+          class="input h-9"
           {...attrs}
           bind:value={$formData.name}
         />
       {/snippet}
     </Control>
-    <FieldErrors>
-      {#snippet children({ errors, errorProps })}
-        {#each errors as error}
-          <span class="text-error-500" {...errorProps}>{error}</span>
-        {/each}
-      {/snippet}
-    </FieldErrors>
+    {@render fieldErrors()}
   </Field>
 
   <Field {form} name="issuer">
@@ -107,12 +130,13 @@
         <Label>Issuer URL</Label>
         <input
           placeholder="https://token.actions.githubusercontent.com"
-          class="input w-full"
+          class="input h-9"
           {...attrs}
           bind:value={$formData.issuer}
         />
       {/snippet}
     </Control>
+    {@render fieldErrors()}
   </Field>
 
   <Field {form} name="subject">
@@ -121,26 +145,23 @@
         <Label>Subject pattern</Label>
         <input
           placeholder="repo:my-org/my-repo:ref:refs/heads/main"
-          class="input w-full"
+          class="input h-9"
           {...attrs}
           bind:value={$formData.subject}
         />
       {/snippet}
     </Control>
+    {@render fieldErrors()}
   </Field>
 
   <Field {form} name="audience">
     <Control>
       {#snippet children(attrs)}
         <Label>Audience pattern (optional)</Label>
-        <input
-          placeholder="feldera"
-          class="input w-full"
-          {...attrs}
-          bind:value={$formData.audience}
-        />
+        <input placeholder="feldera" class="input h-9" {...attrs} bind:value={$formData.audience} />
       {/snippet}
     </Control>
+    {@render fieldErrors()}
   </Field>
 
   <Field {form} name="description">
@@ -149,28 +170,30 @@
         <Label>Description (optional)</Label>
         <input
           placeholder="What does this trust grant?"
-          class="input w-full"
+          class="input h-9"
           {...attrs}
           bind:value={$formData.description}
         />
       {/snippet}
     </Control>
+    {@render fieldErrors()}
   </Field>
 
   <Field {form} name="role">
     <Control>
       {#snippet children(attrs)}
         <Label>Role</Label>
-        <Select class="w-full" {...attrs} bind:value={$formData.role}>
+        <Select class="h-9 text-base!" {...attrs} bind:value={$formData.role}>
           <option value="read">read</option>
           <option value="write">write</option>
           <option value="admin">admin</option>
         </Select>
       {/snippet}
     </Control>
+    {@render fieldErrors()}
   </Field>
 
-  <p class="text-xs opacity-70">
+  <p class="text-sm text-surface-800-200">
     JWTs from <code>Issuer</code> whose <code>sub</code> matches
     <code>Subject pattern</code> authorize requests. <code>Audience pattern</code>, if set, is an
     extra filter on the <code>aud</code> claim (not the tenant selector). <code>*</code> is a
@@ -183,6 +206,6 @@
   {/if}
 
   <div class="flex justify-end">
-    <button class="btn preset-filled-surface-50-950">Create</button>
+    <button class="btn preset-filled-primary-500">Create</button>
   </div>
 </form>
diff --git a/js-packages/web-console/src/lib/components/other/ApiKeyMenu.svelte b/js-packages/web-console/src/lib/components/other/ApiKeyMenu.svelte
index ec8444e8386..8d218d5776e 100644
--- a/js-packages/web-console/src/lib/components/other/ApiKeyMenu.svelte
+++ b/js-packages/web-console/src/lib/components/other/ApiKeyMenu.svelte
@@ -42,7 +42,7 @@
         <div class=" w-full">
           <div>
             {key.name}
-            <span class="text-xs opacity-70">[{key.role}]</span>
+            <span class="text-sm text-surface-800-200">[{key.role}]</span>
           </div>
 
           <div class="text-sm">{key.id}</div>
diff --git a/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte b/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte
index ab2e12bb6a3..758bee3d6c2 100644
--- a/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte
+++ b/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
   import { asyncReadable } from '@square/svelte-store'
+  import { tick } from 'svelte'
   import { page } from '$app/state'
   import GenericDialog from '$lib/components/dialogs/GenericDialog.svelte'
   import NewOidcTrustForm from '$lib/components/oidcTrust/NewOidcTrustForm.svelte'
@@ -15,67 +16,110 @@
 
   const globalDialog = useGlobalDialog()
   const thisDialog = globalDialog.dialog
+
+  let showForm = $state(false)
+  let trustForm: NewOidcTrustForm | undefined = $state()
+  let scrollEl: HTMLDivElement | undefined = $state()
+
+  // Reveal the form and scroll the dialog to it (the form sits below the list,
+  // which can be long). Returns once the form is mounted.
+  const revealForm = async () => {
+    showForm = true
+    await tick()
+    scrollEl?.scrollTo({ top: scrollEl.scrollHeight, behavior: 'smooth' })
+  }
+
+  // Owner trusts live on the Admin page, not here, so this menu only ever shows
+  // read/write/admin; fall back defensively if an owner trust ever appears.
+  const duplicate = async (trust: OidcTrustDescr) => {
+    await revealForm() // also mounts the form so its `fill` binding is set
+    trustForm?.fill({
+      name: `${trust.name}-copy`,
+      issuer: trust.issuer,
+      subject: trust.subject,
+      audience: trust.audience ?? '',
+      description: trust.description ?? '',
+      role: trust.role === 'owner' ? 'read' : trust.role
+    })
+  }
 </script>
 
-<GenericDialog content={{ title: `Manage OIDC trust — ${tenantName}` }}>
-  <p class="text-sm opacity-70">
-    Grant read/write/admin to workloads (CI, services) in tenant <b>{tenantName}</b> by trusting JWTs
-    from an issuer. Platform-wide owner trusts are managed on the Admin page.
-  </p>
-  <div class="scrollbar flex max-h-[80vh] flex-col gap-2 overflow-auto">
-    {#each $trusts as trust}
-      {#snippet deleteDialog()}
-        <GenericDialog
-          content={{
-            title: `Delete ${trust.name}?`,
-            description: 'Are you sure? This action is irreversible.',
-            onSuccess: {
-              name: 'Delete',
-              callback: async () => {
-                await deleteOidcTrust(trust.name)
-                globalDialog.dialog = thisDialog
+<GenericDialog content={{ title: `Manage OIDC trusts — ${tenantName}` }}>
+  <div bind:this={scrollEl} class="-mr-4 scrollbar h-full overflow-auto pr-4 sm:-mr-8 sm:pr-8">
+    <p class="text-sm text-surface-800-200">
+      Grant read/write/admin to workloads (CI, services) in tenant <b>{tenantName}</b> by trusting JWTs
+      from an issuer. Platform-wide owner trusts are managed on the Admin page.
+    </p>
+    <div class="my-2 flex flex-col gap-2">
+      {#each $trusts as trust}
+        {#snippet deleteDialog()}
+          <GenericDialog
+            content={{
+              title: `Delete trust ${trust.name}?`,
+              description: 'Are you sure? This action is irreversible.',
+              onSuccess: {
+                name: 'Delete',
+                callback: async () => {
+                  await deleteOidcTrust(trust.name)
+                  globalDialog.dialog = thisDialog
+                },
+                'data-testid': 'button-confirm-delete'
               },
-              'data-testid': 'button-confirm-delete'
-            },
-            onCancel: {
-              callback: () => {
-                globalDialog.dialog = thisDialog
+              onCancel: {
+                callback: () => {
+                  globalDialog.dialog = thisDialog
+                }
               }
-            }
-          }}
-          noclose
-          danger
-        ></GenericDialog>
-      {/snippet}
-      <div class="flex flex-nowrap">
-        <div class="w-full">
-          <div>
-            {trust.name}
-            <span class="text-xs opacity-70">[{trust.role}]</span>
+            }}
+            noclose
+            danger
+          ></GenericDialog>
+        {/snippet}
+        <div class="flex flex-nowrap border-b border-surface-200-800 py-2">
+          <div class="w-full">
+            <div>
+              {trust.name}
+              <span class="text-sm text-surface-800-200">[{trust.role}]</span>
+            </div>
+            <div class="text-sm">
+              <code>{trust.issuer}</code> · sub=<code>{trust.subject}</code>{#if trust.audience}
+                · aud=<code>{trust.audience}</code>{/if}
+            </div>
+            {#if trust.description}
+              <div class="text-sm text-surface-800-200">{trust.description}</div>
+            {/if}
           </div>
-          <div class="text-sm">
-            <code>{trust.issuer}</code> · sub=<code>{trust.subject}</code>{#if trust.audience}
-              · aud=<code>{trust.audience}</code>{/if}
-          </div>
-          {#if trust.description}
-            <div class="text-xs opacity-70">{trust.description}</div>
-          {/if}
+          <button
+            class="fd fd-copy-plus btn-icon text-[20px] hover:bg-surface-50-950"
+            aria-label="Duplicate {trust.name} trust relationship"
+            title="Copy these fields into the form below to create a similar trust"
+            onclick={() => duplicate(trust)}
+          ></button>
+          <button
+            class="fd fd-trash-2 btn-icon text-[20px] hover:bg-surface-50-950"
+            aria-label="Delete {trust.name} trust relationship"
+            onclick={() => {
+              globalDialog.dialog = deleteDialog
+            }}
+          ></button>
         </div>
-        <button
-          class="fd fd-trash-2 btn-icon text-[20px]"
-          aria-label="Delete {trust.name} trust relationship"
-          onclick={() => {
-            globalDialog.dialog = deleteDialog
-          }}
-        ></button>
-      </div>
+      {:else}
+        No OIDC trust relationships configured
+      {/each}
+    </div>
+    {#if showForm}
+      <NewOidcTrustForm
+        bind:this={trustForm}
+        onSuccess={() => {
+          trusts.reload?.()
+        }}
+      ></NewOidcTrustForm>
     {:else}
-      No OIDC trust relationships configured
-    {/each}
+      <div class="flex">
+        <button class="btn preset-filled-primary-500" onclick={revealForm}>
+          Create new trust
+        </button>
+      </div>
+    {/if}
   </div>
-  <NewOidcTrustForm
-    onSuccess={() => {
-      trusts.reload?.()
-    }}
-  ></NewOidcTrustForm>
 </GenericDialog>
diff --git a/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte.spec.ts b/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte.spec.ts
new file mode 100644
index 00000000000..de23127bc23
--- /dev/null
+++ b/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte.spec.ts
@@ -0,0 +1,101 @@
+/**
+ * The "Create new trust" form is hidden behind a button by default. Both that
+ * button and a row's copy button reveal it; the copy button also prefills every
+ * field, suffixing the name with "-copy" so the prefilled form is valid to
+ * submit. The user still presses Create.
+ */
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { page } from 'vitest/browser'
+import { render } from 'vitest-browser-svelte'
+
+const trust = {
+  id: 't1',
+  name: 'ci',
+  issuer: 'https://issuer.example',
+  subject: 'repo:org/repo',
+  audience: 'aud',
+  description: 'desc',
+  role: 'write'
+}
+
+vi.mock('$app/state', () => ({ page: { data: { feldera: { tenantName: 'acme' } } } }))
+vi.mock('$lib/services/pipelineManager', () => ({
+  getOidcTrustList: vi.fn(async () => [trust]),
+  deleteOidcTrust: vi.fn(),
+  postOidcTrust: vi.fn(async () => {})
+}))
+
+// Imported AFTER vi.mock so the mocks take effect.
+import OidcTrustMenu from './OidcTrustMenu.svelte'
+
+let mounted: { unmount: () => Promise<void> } | undefined
+let mountTarget: HTMLDivElement | undefined
+
+function mountMenu() {
+  mountTarget = document.createElement('div')
+  document.body.appendChild(mountTarget)
+  mounted = render(OidcTrustMenu, { target: mountTarget }) as any
+}
+
+const inputByPlaceholder = (placeholder: string) =>
+  document.querySelector<HTMLInputElement>(`input[placeholder="${placeholder}"]`)
+const roleSelect = () => document.querySelector<HTMLSelectElement>('select')
+
+describe('OidcTrustMenu — duplicate a trust', () => {
+  afterEach(async () => {
+    await mounted?.unmount()
+    mounted = undefined
+    mountTarget?.remove()
+    mountTarget = undefined
+    vi.clearAllMocks()
+  })
+
+  it('hides the form until the Create new trust button is pressed', async () => {
+    mountMenu()
+    await expect.poll(() => document.body.textContent).toContain('ci')
+    // Form starts hidden: its fields are absent, the reveal button is shown.
+    expect(inputByPlaceholder('github-actions-prod')).toBeNull()
+    await page.getByRole('button', { name: 'Create new trust' }).click()
+    // The button reveals the form (dropping the {#if showForm} gate fails this,
+    // as the field would already be present before the click).
+    await expect.poll(() => inputByPlaceholder('github-actions-prod')).toBeTruthy()
+  })
+
+  it('scrolls the dialog to the form when it is revealed', async () => {
+    const scrollTo = vi.spyOn(Element.prototype, 'scrollTo').mockImplementation(() => {})
+    try {
+      mountMenu()
+      await expect.poll(() => document.body.textContent).toContain('ci')
+      await page.getByRole('button', { name: 'Create new trust' }).click()
+      // revealForm scrolls the container to its bottom smoothly; dropping that
+      // scroll leaves no such call and fails here.
+      await expect
+        .poll(() => scrollTo.mock.calls.some((c) => (c[0] as any)?.behavior === 'smooth'))
+        .toBe(true)
+    } finally {
+      scrollTo.mockRestore()
+    }
+  })
+
+  it('prefills the create form from an existing trust', async () => {
+    mountMenu()
+    await expect.poll(() => document.body.textContent).toContain('ci')
+    // Icon-font button has no box in the headless browser, so click via the DOM.
+    const copy = document.querySelector<HTMLButtonElement>(
+      '[aria-label="Duplicate ci trust relationship"]'
+    )!
+    copy.click()
+    // The name is suffixed so the prefilled form submits without a name clash...
+    await expect.poll(() => inputByPlaceholder('github-actions-prod')?.value).toBe('ci-copy')
+    // ...every other field is copied verbatim.
+    expect(inputByPlaceholder('https://token.actions.githubusercontent.com')?.value).toBe(
+      'https://issuer.example'
+    )
+    expect(inputByPlaceholder('repo:my-org/my-repo:ref:refs/heads/main')?.value).toBe(
+      'repo:org/repo'
+    )
+    expect(inputByPlaceholder('feldera')?.value).toBe('aud')
+    expect(inputByPlaceholder('What does this trust grant?')?.value).toBe('desc')
+    expect(roleSelect()?.value).toBe('write')
+  })
+})
diff --git a/js-packages/web-console/vite.config.ts b/js-packages/web-console/vite.config.ts
index c0fdb03e873..889f2a55539 100644
--- a/js-packages/web-console/vite.config.ts
+++ b/js-packages/web-console/vite.config.ts
@@ -31,6 +31,9 @@ const testOptimizeDepsInclude = [
   '@axa-fr/oidc-client',
   '@monaco-editor/loader',
   '@skeletonlabs/skeleton-svelte',
+  // Skeleton's Listbox (zag-js) chain reaches this CJS module; without
+  // pre-bundling it, its default import fails ESM interop under vitest.
+  'fast-deep-equal',
   '@streamparser/json',
   'apache-arrow',
   '@svelte-bin/clipboard',
diff --git a/js-packages/web-console/web-console-permissions.md b/js-packages/web-console/web-console-permissions.md
index 59e2a831fde..06f8e94aed3 100644
--- a/js-packages/web-console/web-console-permissions.md
+++ b/js-packages/web-console/web-console-permissions.md
@@ -122,12 +122,12 @@ This is the one gate that is not a plain permission check: `enabled = pipelineEx
 
 ### 4.5 API keys and admin (mostly shipped)
 
-| File                                                                                  | Permission            | Min role | Status                                                               |
-| ------------------------------------------------------------------------------------- | --------------------- | -------- | -------------------------------------------------------------------- |
-| `auth/ProfileButton.svelte`, `other/ApiKeyMenu.svelte`, `apiKey/NewApiKeyForm.svelte` | `write:api_key`       | write    | menu already gated; migrate its ad-hoc role check to `write:api_key` |
-| `routes/(system)/(authenticated)/admin/+page.ts`                                      | `write:tenant_member` | admin    | already redirects; express via permission                            |
-| `admin/UserRoleTable.svelte`                                                          | `write:tenant_member` | admin    | in admin area                                                        |
-| `other/OidcTrustMenu.svelte`, `oidcTrust/NewOidcTrustForm.svelte`                     | `write:oidc_trust`    | admin    | in gated menu                                                        |
+| File                                                                                            | Permission            | Min role | Status                                                                                           |
+| ----------------------------------------------------------------------------------------------- | --------------------- | -------- | ------------------------------------------------------------------------------------------------ |
+| `auth/ProfileButton.svelte`, `other/ApiKeyMenu.svelte`, `apiKey/NewApiKeyForm.svelte`           | `write:api_key`       | write    | menu already gated; migrate its ad-hoc role check to `write:api_key`                             |
+| `routes/(system)/(authenticated)/admin/+page.ts`                                                | `write:tenant_member` | admin    | already redirects; express via permission                                                        |
+| `admin/UserRoleTable.svelte`                                                                    | `write:tenant_member` | admin    | in admin area                                                                                    |
+| `other/OidcTrustMenu.svelte`, `oidcTrust/NewOidcTrustForm.svelte`                               | `write:oidc_trust`    | admin    | in gated menu                                                                                    |
 | `admin/TenantList.svelte`, `admin/AdminPage.svelte` (tenant switcher, Platform owners, Tenants) | `write:tenant`        | owner    | gated on `write:tenant`; owner-trust CRUD removed (owner is deploy-time config, shown read-only) |
 
 Within `NewApiKeyForm.svelte`, both `read` and `write` key options stay offered:

From 2961f8d18074396ef953bd022cb4915953f75ec9 Mon Sep 17 00:00:00 2001
From: Karakatiza666 <bulakh.96@gmail.com>
Date: Thu, 30 Jul 2026 08:18:48 +0000
Subject: [PATCH 37/55] [web-console] Tenant management review fixes

Signed-off-by: Karakatiza666 <bulakh.96@gmail.com>
---
 bun.lock                                      |  6 +-
 js-packages/web-console/package.json          |  2 +-
 .../oidcTrust/NewOidcTrustForm.svelte         | 37 ++++++---
 .../oidcTrust/NewOidcTrustForm.svelte.spec.ts | 81 +++++++++++++++++++
 .../lib/components/other/OidcTrustMenu.svelte | 42 ++++++++--
 .../other/OidcTrustMenu.svelte.spec.ts        | 63 ++++++++++++++-
 6 files changed, 208 insertions(+), 23 deletions(-)
 create mode 100644 js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte.spec.ts

diff --git a/bun.lock b/bun.lock
index aeb637f0b2c..e1e2e4db66a 100644
--- a/bun.lock
+++ b/bun.lock
@@ -266,7 +266,7 @@
         "tslib": "2.8.1",
         "typescript": "5.9.3",
         "typescript-eslint": "8.56.0",
-        "valibot": "1.2.0",
+        "valibot": "1.4.2",
         "virtua": "0.48.6",
         "vite": "^8.0.0",
         "vite-plugin-devtools-json": "1.0.0",
@@ -2120,7 +2120,7 @@
 
     "uuid": ["uuid@11.1.0", "", { "bin": { "uuid": "dist/esm/bin/uuid" } }, "sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A=="],
 
-    "valibot": ["valibot@1.2.0", "", { "peerDependencies": { "typescript": ">=5" }, "optionalPeers": ["typescript"] }, "sha512-mm1rxUsmOxzrwnX5arGS+U4T25RdvpPjPN4yR0u9pUBov9+zGVtO84tif1eY4r6zWxVxu3KzIyknJy3rxfRZZg=="],
+    "valibot": ["valibot@1.4.2", "", { "peerDependencies": { "typescript": ">=5" }, "optionalPeers": ["typescript"] }, "sha512-gjdCvJ6d3RyHAneqxMYMW9QMCwYMb3jpOO0IyHZV1bnRHFBHrX3VkIILt5XYR0WhwHiH7Mty8ovuPZ/O3gamrg=="],
 
     "validator": ["validator@13.15.26", "", {}, "sha512-spH26xU080ydGggxRyR1Yhcbgx+j3y5jbNXk/8L+iRvdIEQ4uTRH2Sgf2dokud6Q4oAtsbNvJ1Ft+9xmm6IZcA=="],
 
@@ -2376,6 +2376,8 @@
 
     "svelte-toolbelt/runed": ["runed@0.23.4", "", { "dependencies": { "esm-env": "^1.0.0" }, "peerDependencies": { "svelte": "^5.7.0" } }, "sha512-9q8oUiBYeXIDLWNK5DfCWlkL0EW3oGbk845VdKlPeia28l751VpfesaB/+7pI6rnbx1I6rqoZ2fZxptOJLxILA=="],
 
+    "sveltekit-superforms/valibot": ["valibot@1.2.0", "", { "peerDependencies": { "typescript": ">=5" }, "optionalPeers": ["typescript"] }, "sha512-mm1rxUsmOxzrwnX5arGS+U4T25RdvpPjPN4yR0u9pUBov9+zGVtO84tif1eY4r6zWxVxu3KzIyknJy3rxfRZZg=="],
+
     "svgicons2svgfont/commander": ["commander@7.2.0", "", {}, "sha512-QrWXB+ZQSVPmIWIhtEO9H+gwHaMGYiF5ChvoJ+K9ZGHG/sVsa6yiesAD1GC/x46sET00Xlwo1u49RVVVzvcSkw=="],
 
     "svgo/commander": ["commander@11.1.0", "", {}, "sha512-yPVavfyCcRhmorC7rWlkHn15b4wDVgVmBA7kV4QVBsF7kv/9TKJAbAXVTxvTnwP8HHKjRCJDClKbciiYS7p0DQ=="],
diff --git a/js-packages/web-console/package.json b/js-packages/web-console/package.json
index 21013c7a4d1..6226488f609 100644
--- a/js-packages/web-console/package.json
+++ b/js-packages/web-console/package.json
@@ -98,7 +98,7 @@
     "tslib": "2.8.1",
     "typescript": "5.9.3",
     "typescript-eslint": "8.56.0",
-    "valibot": "1.2.0",
+    "valibot": "1.4.2",
     "virtua": "0.48.6",
     "vite": "^8.0.0",
     "vite-plugin-devtools-json": "1.0.0",
diff --git a/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte b/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte
index caf9c09c7a6..8d028ebfe44 100644
--- a/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte
+++ b/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte
@@ -1,4 +1,6 @@
 <script lang="ts" module>
+  import * as va from 'valibot'
+
   // Fields to prefill the form with, e.g. to duplicate an existing trust.
   export type TrustFormData = {
     name: string
@@ -8,6 +10,20 @@
     description: string
     role: 'read' | 'write' | 'admin'
   }
+
+  export const oidcTrustSchema = va.object({
+    name: va.pipe(va.string(), va.minLength(1, 'Specify a name')),
+    issuer: va.pipe(
+      va.string(),
+      va.minLength(1, 'Specify the issuer URL'),
+      va.url('The issuer must be a valid URL'),
+      va.regex(/^[Hh][Tt][Tt][Pp][Ss]?:\/\/.+/, 'The issuer must be an http(s) URL')
+    ),
+    subject: va.pipe(va.string(), va.minLength(1, 'Specify a subject pattern')),
+    audience: va.string(),
+    description: va.string(),
+    role: va.picklist(['read', 'write', 'admin'] as const)
+  })
 </script>
 
 <script lang="ts">
@@ -16,7 +32,6 @@
   import { superForm } from 'sveltekit-superforms'
   import { valibot } from 'sveltekit-superforms/adapters'
 
-  import * as va from 'valibot'
   import { type MemberRole, postOidcTrust } from '$lib/services/pipelineManager'
 
   const {
@@ -26,22 +41,13 @@
   }: {
     onSubmit?: () => void
     onSuccess?: () => void
-    tenant?: string
+    tenant: string | undefined
   } = $props()
 
   // Backend rejections (role cap, duplicate name, ...) can concern any field, so
   // show them as a form-level error rather than pinning every one to Name.
   let submitError = $state('')
 
-  const schema = va.object({
-    name: va.pipe(va.string(), va.minLength(1, 'Specify a name')),
-    issuer: va.pipe(va.string(), va.minLength(1, 'Specify the issuer URL')),
-    subject: va.pipe(va.string(), va.minLength(1, 'Specify a subject pattern')),
-    audience: va.string(),
-    description: va.string(),
-    role: va.picklist(['read', 'write', 'admin'] as const)
-  })
-
   const form = superForm(
     {
       name: '',
@@ -53,7 +59,7 @@
     },
     {
       SPA: true,
-      validators: valibot(schema),
+      validators: valibot(oidcTrustSchema, { config: { abortPipeEarly: true } }),
       onUpdate({ form: f }) {
         if (!f.valid) {
           return
@@ -158,7 +164,12 @@
     <Control>
       {#snippet children(attrs)}
         <Label>Audience pattern (optional)</Label>
-        <input placeholder="feldera" class="input h-9" {...attrs} bind:value={$formData.audience} />
+        <input
+          placeholder="feldera-{tenant}"
+          class="input h-9"
+          {...attrs}
+          bind:value={$formData.audience}
+        />
       {/snippet}
     </Control>
     {@render fieldErrors()}
diff --git a/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte.spec.ts b/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte.spec.ts
new file mode 100644
index 00000000000..b38aeed7ee4
--- /dev/null
+++ b/js-packages/web-console/src/lib/components/oidcTrust/NewOidcTrustForm.svelte.spec.ts
@@ -0,0 +1,81 @@
+/**
+ * The issuer field must be an http(s) URL. `va.url` alone was insufficient: the
+ * URL constructor accepts any scheme, so `htt:/localhost:5173` parsed as valid.
+ * These tests drive the exported schema directly (no render needed).
+ */
+
+import * as va from 'valibot'
+import { describe, expect, it, vi } from 'vitest'
+import { render } from 'vitest-browser-svelte'
+
+// The component's instance script imports this at module load; stub it so the
+// schema import does not drag in the real service.
+vi.mock('$lib/services/pipelineManager', () => ({ postOidcTrust: vi.fn() }))
+
+// Imported AFTER vi.mock so the mock takes effect.
+import NewOidcTrustForm, { oidcTrustSchema } from './NewOidcTrustForm.svelte'
+
+const base = {
+  name: 'ci',
+  issuer: 'https://issuer.example',
+  subject: 'repo:org/repo',
+  audience: '',
+  description: '',
+  role: 'read' as const
+}
+
+// abortPipeEarly mirrors the adapter config in the form, so the reported issue
+// is the single first-failing check the user actually sees.
+const issuerErrors = (issuer: string): string[] => {
+  const result = va.safeParse(oidcTrustSchema, { ...base, issuer }, { abortPipeEarly: true })
+  return result.success
+    ? []
+    : result.issues.filter((i) => i.path?.[0]?.key === 'issuer').map((i) => i.message)
+}
+
+describe('oidcTrustSchema — issuer validation', () => {
+  it('accepts http(s) issuer URLs', () => {
+    expect(issuerErrors('https://token.actions.githubusercontent.com')).toEqual([])
+    expect(issuerErrors('http://localhost:5173')).toEqual([])
+  })
+
+  it('rejects a URL whose scheme is not http(s)', () => {
+    // Regression: new URL('htt:/localhost:5173') parses fine, so va.url passed it.
+    expect(issuerErrors('htt:/localhost:5173')).toEqual(['The issuer must be an http(s) URL'])
+    expect(issuerErrors('ftp://example.com')).toEqual(['The issuer must be an http(s) URL'])
+  })
+
+  it('rejects a malformed URL even with an http(s) scheme', () => {
+    // The scheme regex alone accepts this ('^' matches .+); va.url rejects it,
+    // since '^' is a forbidden host code point, so new URL throws.
+    expect(issuerErrors('http://a^b')).toEqual(['The issuer must be a valid URL'])
+  })
+
+  it('rejects a string that is not a URL', () => {
+    expect(issuerErrors('not a url')).toEqual(['The issuer must be a valid URL'])
+  })
+
+  it('requires the issuer to be present', () => {
+    expect(issuerErrors('')).toEqual(['Specify the issuer URL'])
+  })
+})
+
+describe('NewOidcTrustForm', () => {
+  // superforms' valibot adapter converts the schema to JSON Schema on mount to
+  // derive form constraints; an unconvertible action (a `va.check` predicate, or
+  // a flagged regex) throws there and the form never renders. This asserts the
+  // schema stays convertible.
+  it('mounts without the adapter failing to convert the schema', async () => {
+    const target = document.createElement('div')
+    document.body.appendChild(target)
+    const mounted = render(NewOidcTrustForm, { target }) as any
+    try {
+      await expect
+        .poll(() => document.querySelector('input[placeholder="github-actions-prod"]'))
+        .toBeTruthy()
+    } finally {
+      await mounted.unmount()
+      target.remove()
+    }
+  })
+})
diff --git a/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte b/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte
index 758bee3d6c2..d8930eaf326 100644
--- a/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte
+++ b/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte
@@ -1,6 +1,13 @@
+<script lang="ts" module>
+  // biome-ignore lint/correctness/noUnusedVariables: <explanation></explanation>
+  let showForm = $state(false)
+  // biome-ignore lint/correctness/noUnusedVariables: <explanation></explanation>
+  let scrollTop = 0
+</script>
+
 <script lang="ts">
   import { asyncReadable } from '@square/svelte-store'
-  import { tick } from 'svelte'
+  import { onDestroy, onMount, tick } from 'svelte'
   import { page } from '$app/state'
   import GenericDialog from '$lib/components/dialogs/GenericDialog.svelte'
   import NewOidcTrustForm from '$lib/components/oidcTrust/NewOidcTrustForm.svelte'
@@ -17,10 +24,26 @@
   const globalDialog = useGlobalDialog()
   const thisDialog = globalDialog.dialog
 
-  let showForm = $state(false)
   let trustForm: NewOidcTrustForm | undefined = $state()
   let scrollEl: HTMLDivElement | undefined = $state()
 
+  onMount(async () => {
+    await trusts.load()
+    await tick()
+    scrollEl?.scrollTo({ top: scrollTop })
+  })
+
+  // Hide the form and forget the scroll offset when this menu closes, but not
+  // when it is only swapped out for the delete confirmation (a non-null dialog).
+  onDestroy(() => {
+    queueMicrotask(() => {
+      if (!globalDialog.dialog) {
+        showForm = false
+        scrollTop = 0
+      }
+    })
+  })
+
   // Reveal the form and scroll the dialog to it (the form sits below the list,
   // which can be long). Returns once the form is mounted.
   const revealForm = async () => {
@@ -45,7 +68,11 @@
 </script>
 
 <GenericDialog content={{ title: `Manage OIDC trusts — ${tenantName}` }}>
-  <div bind:this={scrollEl} class="-mr-4 scrollbar h-full overflow-auto pr-4 sm:-mr-8 sm:pr-8">
+  <div
+    bind:this={scrollEl}
+    onscroll={() => (scrollTop = scrollEl?.scrollTop ?? 0)}
+    class="-mr-4 scrollbar h-full overflow-auto pr-4 sm:-mr-8 sm:pr-8"
+  >
     <p class="text-sm text-surface-800-200">
       Grant read/write/admin to workloads (CI, services) in tenant <b>{tenantName}</b> by trusting JWTs
       from an issuer. Platform-wide owner trusts are managed on the Admin page.
@@ -81,9 +108,11 @@
               {trust.name}
               <span class="text-sm text-surface-800-200">[{trust.role}]</span>
             </div>
-            <div class="text-sm">
-              <code>{trust.issuer}</code> · sub=<code>{trust.subject}</code>{#if trust.audience}
-                · aud=<code>{trust.audience}</code>{/if}
+            <div class="font-dm-mono text-sm">
+              {trust.issuer} · sub={trust.subject}
+              {#if trust.audience}
+                <span> · aud={trust.audience}</span>
+              {/if}
             </div>
             {#if trust.description}
               <div class="text-sm text-surface-800-200">{trust.description}</div>
@@ -113,6 +142,7 @@
         onSuccess={() => {
           trusts.reload?.()
         }}
+        tenant={tenantName}
       ></NewOidcTrustForm>
     {:else}
       <div class="flex">
diff --git a/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte.spec.ts b/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte.spec.ts
index de23127bc23..074b471113f 100644
--- a/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte.spec.ts
+++ b/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte.spec.ts
@@ -26,6 +26,7 @@ vi.mock('$lib/services/pipelineManager', () => ({
 }))
 
 // Imported AFTER vi.mock so the mocks take effect.
+import { useGlobalDialog } from '$lib/compositions/layout/useGlobalDialog.svelte'
 import OidcTrustMenu from './OidcTrustMenu.svelte'
 
 let mounted: { unmount: () => Promise<void> } | undefined
@@ -43,6 +44,9 @@ const roleSelect = () => document.querySelector<HTMLSelectElement>('select')
 
 describe('OidcTrustMenu — duplicate a trust', () => {
   afterEach(async () => {
+    // Clear the dialog first so the menu's onDestroy sees a closed dialog and
+    // resets the module-level showForm, isolating the next test.
+    useGlobalDialog().dialog = null
     await mounted?.unmount()
     mounted = undefined
     mountTarget?.remove()
@@ -77,6 +81,63 @@ describe('OidcTrustMenu — duplicate a trust', () => {
     }
   })
 
+  it('keeps a revealed form across the delete confirmation', async () => {
+    mountMenu()
+    await expect.poll(() => document.body.textContent).toContain('ci')
+    await page.getByRole('button', { name: 'Create new trust' }).click()
+    await expect.poll(() => inputByPlaceholder('github-actions-prod')).toBeTruthy()
+    // Opening the delete confirmation swaps the global dialog, which unmounts
+    // then remounts this menu. Icon-font button has no box, so click via the DOM.
+    document
+      .querySelector<HTMLButtonElement>('[aria-label="Delete ci trust relationship"]')!
+      .click()
+    // Reproduce that swap: unmount and remount the menu, as GlobalModal does.
+    await mounted!.unmount()
+    mountMenu()
+    // The form stays revealed (dropping the keepForm handling hides it here).
+    await expect.poll(() => inputByPlaceholder('github-actions-prod')).toBeTruthy()
+  })
+
+  it('restores the scroll offset across the delete confirmation', async () => {
+    const scrollTo = vi.spyOn(Element.prototype, 'scrollTo').mockImplementation(() => {})
+    try {
+      mountMenu()
+      await expect.poll(() => document.body.textContent).toContain('ci')
+      // The headless dialog body is not tall enough to actually scroll, so force
+      // an offset and fire the handler the way a real scroll would.
+      const body = document.querySelector<HTMLDivElement>('.overflow-auto')!
+      Object.defineProperty(body, 'scrollTop', { configurable: true, value: 120 })
+      body.dispatchEvent(new Event('scroll'))
+      // Swap to the delete confirmation, then reproduce the remount GlobalModal does.
+      document
+        .querySelector<HTMLButtonElement>('[aria-label="Delete ci trust relationship"]')!
+        .click()
+      await mounted!.unmount()
+      mountMenu()
+      // On remount the saved offset is reapplied (dropping the onscroll tracking
+      // or the onMount restore leaves no scrollTo call with top: 120).
+      await expect
+        .poll(() => scrollTo.mock.calls.some((c) => (c[0] as any)?.top === 120))
+        .toBe(true)
+    } finally {
+      scrollTo.mockRestore()
+    }
+  })
+
+  it('hides a revealed form once the menu is closed', async () => {
+    mountMenu()
+    await expect.poll(() => document.body.textContent).toContain('ci')
+    await page.getByRole('button', { name: 'Create new trust' }).click()
+    await expect.poll(() => inputByPlaceholder('github-actions-prod')).toBeTruthy()
+    // Closing the menu clears the global dialog; its onDestroy then resets the
+    // module showForm (dropping that guard leaves the form revealed on reopen).
+    useGlobalDialog().dialog = null
+    await mounted!.unmount()
+    mountMenu()
+    await expect.poll(() => document.body.textContent).toContain('ci')
+    expect(inputByPlaceholder('github-actions-prod')).toBeNull()
+  })
+
   it('prefills the create form from an existing trust', async () => {
     mountMenu()
     await expect.poll(() => document.body.textContent).toContain('ci')
@@ -94,7 +155,7 @@ describe('OidcTrustMenu — duplicate a trust', () => {
     expect(inputByPlaceholder('repo:my-org/my-repo:ref:refs/heads/main')?.value).toBe(
       'repo:org/repo'
     )
-    expect(inputByPlaceholder('feldera')?.value).toBe('aud')
+    expect(inputByPlaceholder('feldera-acme')?.value).toBe('aud')
     expect(inputByPlaceholder('What does this trust grant?')?.value).toBe('desc')
     expect(roleSelect()?.value).toBe('write')
   })

From 406976a873870a8746cd1aa498a91b33adacbaa3 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Thu, 30 Jul 2026 08:28:36 -0700
Subject: [PATCH 38/55] [web-console] Say what revoking at the provider
 actually does

The member-removal copy told an admin to "revoke at the provider for a durable
block", which names a mechanism rather than an outcome. It now says removal is
undone at the next login and that revoking access at the provider disables
access completely.

Drops "Platform-wide owner trusts are managed on the Admin page" from the OIDC
trust dialog. Owner is deploy-time configuration, and the Admin page's owner
section is gated on managing tenants, so an admin reading that line cannot act
on it.

Two headings lose an em dash for a preposition: "Users & roles for <tenant>"
and "Manage OIDC trust for <tenant>". The latter also drops a plural and a
capital, matching its sibling "Manage API keys" and the console's sentence-case
convention.

The endpoint's own description carried the same sentence, so it is reworded too
and the spec and client are regenerated. That regeneration also picks up a
completion-token doc comment that had reached the spec but never the client.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 crates/pipeline-manager/src/api/endpoints/tenant.rs         | 3 ++-
 js-packages/web-console/AUTH_AND_TENANCY.md                 | 3 ++-
 .../web-console/src/lib/components/admin/AdminPage.svelte   | 2 +-
 .../src/lib/components/admin/UserRoleTable.svelte           | 6 +++---
 .../src/lib/components/other/OidcTrustMenu.svelte           | 5 +++--
 js-packages/web-console/src/lib/services/manager/sdk.gen.ts | 3 ++-
 .../web-console/src/lib/services/manager/types.gen.ts       | 6 ++++++
 openapi.json                                                | 2 +-
 8 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/crates/pipeline-manager/src/api/endpoints/tenant.rs b/crates/pipeline-manager/src/api/endpoints/tenant.rs
index bb51c3d9661..24aae9a2f3b 100644
--- a/crates/pipeline-manager/src/api/endpoints/tenant.rs
+++ b/crates/pipeline-manager/src/api/endpoints/tenant.rs
@@ -206,7 +206,8 @@ pub(crate) async fn put_tenant_user(
 ///
 /// Remove a user from the acting tenant. This drops their role now, but if the
 /// identity provider still grants them access they are re-added at the default
-/// role on their next login; revoke access at the provider for a durable block.
+/// role on their next login. Revoke access at the provider to disable access
+/// completely.
 #[utoipa::path(
     context_path = "/v0",
     security(("JSON web token (JWT) or API key" = [])),
diff --git a/js-packages/web-console/AUTH_AND_TENANCY.md b/js-packages/web-console/AUTH_AND_TENANCY.md
index cb0391511dd..aa3841977eb 100644
--- a/js-packages/web-console/AUTH_AND_TENANCY.md
+++ b/js-packages/web-console/AUTH_AND_TENANCY.md
@@ -85,7 +85,8 @@ Role caps enforced server-side:
 
 - A member/key role is capped at the caller's own role and may never be `owner`.
 - Removing a member drops the role now, but if the IdP still grants access the
-  member is re-added at the default role on next login. Revoke at the provider for a durable block.
+  member is re-added at the default role on their next login. Revoke access at
+  the provider to disable access completely.
 
 ### Service wrappers
 
diff --git a/js-packages/web-console/src/lib/components/admin/AdminPage.svelte b/js-packages/web-console/src/lib/components/admin/AdminPage.svelte
index c36595ebb7e..fc7b59564a3 100644
--- a/js-packages/web-console/src/lib/components/admin/AdminPage.svelte
+++ b/js-packages/web-console/src/lib/components/admin/AdminPage.svelte
@@ -69,7 +69,7 @@
     <UserRoleTable tenant={selectedTenant}></UserRoleTable>
   {/snippet}
   {#snippet usersTitle()}
-    Users &amp; roles — {#if manageTenants.allowed}
+    Users &amp; roles for {#if manageTenants.allowed}
       <!-- Owner-only: click the tenant name to switch which tenant's members
            show below, without moving the global acting-tenant. -->
       <Popup wrapperClass="inline-block align-baseline">
diff --git a/js-packages/web-console/src/lib/components/admin/UserRoleTable.svelte b/js-packages/web-console/src/lib/components/admin/UserRoleTable.svelte
index 9906117797d..91a73821166 100644
--- a/js-packages/web-console/src/lib/components/admin/UserRoleTable.svelte
+++ b/js-packages/web-console/src/lib/components/admin/UserRoleTable.svelte
@@ -102,8 +102,8 @@
   <p class="text-sm text-surface-800-200">
     Members appear here after their first login. Assign read, write, or admin. Removing a member
     drops their role now, but if your identity provider still grants them access they are re-added
-    at the default role on their next login — revoke at the provider for a durable block.
-    Pre-provision a member below to grant a role before their first login.
+    at the default role on their next login. Revoke access at the provider to disable access
+    completely. Pre-provision a member below to grant a role before their first login.
   </p>
   {#if errorMessage}
     <div class="rounded preset-outlined-error-600-400 p-2 text-sm">{errorMessage}</div>
@@ -173,7 +173,7 @@
           content={{
             title: `Remove ${user.email ?? user.subject}?`,
             description:
-              'Drops their role in this tenant now. If your identity provider still grants them access, they are re-added at the default role on their next login; revoke at the provider for a durable block. Continue?',
+              'Drops their role in this tenant now. If your identity provider still grants them access, they are re-added at the default role on their next login. Revoke access at the provider to disable access completely. Continue?',
             onSuccess: {
               name: 'Remove',
               callback: async () => {
diff --git a/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte b/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte
index d8930eaf326..974c66830e6 100644
--- a/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte
+++ b/js-packages/web-console/src/lib/components/other/OidcTrustMenu.svelte
@@ -67,15 +67,16 @@
   }
 </script>
 
-<GenericDialog content={{ title: `Manage OIDC trusts — ${tenantName}` }}>
+<GenericDialog content={{ title: `Manage OIDC trust for ${tenantName}` }}>
   <div
     bind:this={scrollEl}
     onscroll={() => (scrollTop = scrollEl?.scrollTop ?? 0)}
     class="-mr-4 scrollbar h-full overflow-auto pr-4 sm:-mr-8 sm:pr-8"
   >
+
     <p class="text-sm text-surface-800-200">
       Grant read/write/admin to workloads (CI, services) in tenant <b>{tenantName}</b> by trusting JWTs
-      from an issuer. Platform-wide owner trusts are managed on the Admin page.
+      from an issuer.
     </p>
     <div class="my-2 flex flex-col gap-2">
       {#each $trusts as trust}
diff --git a/js-packages/web-console/src/lib/services/manager/sdk.gen.ts b/js-packages/web-console/src/lib/services/manager/sdk.gen.ts
index 23d9a6d9836..55c062f3fb7 100644
--- a/js-packages/web-console/src/lib/services/manager/sdk.gen.ts
+++ b/js-packages/web-console/src/lib/services/manager/sdk.gen.ts
@@ -1963,7 +1963,8 @@ export const addTenantUser = <ThrowOnError extends boolean = true>(
  *
  * Remove a user from the acting tenant. This drops their role now, but if the
  * identity provider still grants them access they are re-added at the default
- * role on their next login; revoke access at the provider for a durable block.
+ * role on their next login. Revoke access at the provider to disable access
+ * completely.
  */
 export const deleteTenantUser = <ThrowOnError extends boolean = true>(
   options: Options<DeleteTenantUserData, ThrowOnError>
diff --git a/js-packages/web-console/src/lib/services/manager/types.gen.ts b/js-packages/web-console/src/lib/services/manager/types.gen.ts
index b7f54965289..66e4515d577 100644
--- a/js-packages/web-console/src/lib/services/manager/types.gen.ts
+++ b/js-packages/web-console/src/lib/services/manager/types.gen.ts
@@ -3556,6 +3556,12 @@ export type OutputEndpointMetrics = {
    * of this endpoint is equal to the output of the circuit after
    * processing `total_processed_input_records` records.
    *
+   * The counter never runs ahead of the endpoint's output. It advances to a
+   * value `N` only once the endpoint has processed every batch derived from
+   * the first `N` records received by the pipeline, which means transmitting
+   * the batch, or discarding it while silent bootstrapping suppresses the
+   * endpoint's output.
+   *
    * In a multihost pipeline, this count reflects only the input records
    * processed on the same host as the output endpoint, which is not usually
    * meaningful.
diff --git a/openapi.json b/openapi.json
index da06fb281ef..eebc4acf385 100644
--- a/openapi.json
+++ b/openapi.json
@@ -7580,7 +7580,7 @@
           "Platform"
         ],
         "summary": "Remove Tenant Member",
-        "description": "Required role: `admin` or higher.\n\nRemove a user from the acting tenant. This drops their role now, but if the\nidentity provider still grants them access they are re-added at the default\nrole on their next login; revoke access at the provider for a durable block.",
+        "description": "Required role: `admin` or higher.\n\nRemove a user from the acting tenant. This drops their role now, but if the\nidentity provider still grants them access they are re-added at the default\nrole on their next login. Revoke access at the provider to disable access\ncompletely.",
         "operationId": "delete_tenant_user",
         "parameters": [
           {

From 9f11ea292cbc51b93cb2698749a5e8d6afba549b Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Thu, 30 Jul 2026 08:28:43 -0700
Subject: [PATCH 39/55] [scripts] Fix rbac_up.sh on macOS bash 3.2

The script failed immediately with "FEATURES[@]: unbound variable" on macOS,
which ships bash 3.2. Under `set -u` that release errors on expanding an empty
array, and both arrays the script builds are empty on the default path.

Expanding through `${arr[@]+"${arr[@]}"}" leaves them empty without tripping
the check, and still passes the arguments when a flag fills them.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 scripts/rbac_up.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/scripts/rbac_up.sh b/scripts/rbac_up.sh
index 0f9952b6b2a..51a5ed25529 100755
--- a/scripts/rbac_up.sh
+++ b/scripts/rbac_up.sh
@@ -39,7 +39,8 @@ if [ "$REBUILD" = 1 ] || [ ! -x "$BIN" ]; then
   echo "== building pipeline-manager (debug, with web console) =="
   FEATURES=()
   [ "$ENTERPRISE" = 1 ] && FEATURES=(--features feldera-enterprise)
-  PATH="$HOME/.bun/bin:$PATH" cargo build -p pipeline-manager "${FEATURES[@]}"
+  # macOS ships bash 3.2, where "${arr[@]}" on an empty array trips `set -u`.
+  PATH="$HOME/.bun/bin:$PATH" cargo build -p pipeline-manager ${FEATURES[@]+"${FEATURES[@]}"}
 fi
 
 [ "$KEEP_DB" = 1 ] || rm -rf "$DEMO/pg"
@@ -73,7 +74,7 @@ FELDERA_UNSTABLE_FEATURES='runtime_version,testing' \
     --pg-embed-working-directory="$DEMO/pg" \
     --runner-working-directory="$DEMO/runner" \
     --compiler-working-directory="$DEMO/compiler" \
-    "${MGR_ARGS[@]}" \
+    ${MGR_ARGS[@]+"${MGR_ARGS[@]}"} \
     >"$DEMO/manager.log" 2>&1 &
 MGR_PID=$!
 

From 5ebbec51d4e468857f9ef18eca7f6ce2b7a46f70 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Thu, 30 Jul 2026 19:15:44 -0700
Subject: [PATCH 40/55] [pipeline-manager] Never ignore an explicit
 Feldera-Tenant header

Every path that resolved a caller's tenant honoured the header only when the
caller was authorized for more than one, and dropped it otherwise. A caller
naming a tenant it holds no membership or trust in was served the tenant it does
hold, so it could act on a tenant it never asked for while believing it acted on
the one it named.

The same substitution lived in all three branches:

  - a federated token matching exactly one trust took that match and skipped the
    branch that reads the selector;
  - a login whose claim listed exactly one tenant returned it directly;
  - a token claiming no tenant at all derived one from the issuer domain or the
    sub claim, and compared it against nothing.

A selector is now always resolved and checked against the caller's authorized
set, and refused when it is not in it. Its absence keeps the previous meaning:
one authorization is unambiguous, several are not.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 crates/pipeline-manager/src/auth.rs | 114 ++++++++++++++++------------
 1 file changed, 67 insertions(+), 47 deletions(-)

diff --git a/crates/pipeline-manager/src/auth.rs b/crates/pipeline-manager/src/auth.rs
index 743a7fbc586..b70be847555 100644
--- a/crates/pipeline-manager/src/auth.rs
+++ b/crates/pipeline-manager/src/auth.rs
@@ -428,29 +428,34 @@ async fn oidc_trust_auth(
         return Ok(req);
     }
 
-    // Tenant-scoped matches. One is unambiguous; several require the
-    // Feldera-Tenant header to name one of them.
+    // Tenant-scoped matches. A `Feldera-Tenant` header is always honoured or
+    // refused, never ignored: a caller that names a tenant its token is not
+    // trusted in has to be told so. Serving it another tenant's data because
+    // that happened to be its only match would let it act on a tenant it never
+    // asked for, believing it acted on the one it did.
     let tenant_matches: Vec<(TenantId, Role)> = matches;
-    let (acting_tenant, role) = if tenant_matches.len() == 1 {
-        tenant_matches[0]
-    } else {
-        let Some(selector) = header_tenant(&req) else {
-            return db_err(DBError::AmbiguousOidcTenant, req);
-        };
-        let selected = {
-            let db = state.db.lock().await;
-            db.resolve_tenant_selector(&selector).await
-        };
-        // Unknown tenant name/UUID surfaces as 404; a known tenant the token is
-        // not trusted in is 403.
-        let selected = match selected {
-            Ok(t) => t,
-            Err(e) => return db_err(e, req),
-        };
-        match tenant_matches.iter().find(|(t, _)| *t == selected).copied() {
-            Some(pair) => pair,
-            None => return db_err(DBError::OidcTenantNotTrusted { tenant: selector }, req),
+    let (acting_tenant, role) = match header_tenant(&req) {
+        Some(selector) => {
+            let selected = {
+                let db = state.db.lock().await;
+                db.resolve_tenant_selector(&selector).await
+            };
+            // Unknown tenant name/UUID surfaces as 404; a known tenant the token
+            // is not trusted in is 403.
+            let selected = match selected {
+                Ok(t) => t,
+                Err(e) => return db_err(e, req),
+            };
+            match tenant_matches.iter().find(|(t, _)| *t == selected).copied() {
+                Some(pair) => pair,
+                None => {
+                    return db_err(DBError::OidcTenantNotTrusted { tenant: selector }, req)
+                }
+            }
         }
+        // Without a selector a single match is unambiguous; several are not.
+        None if tenant_matches.len() == 1 => tenant_matches[0],
+        None => return db_err(DBError::AmbiguousOidcTenant, req),
     };
     AuthenticatedPrincipal {
         acting_tenant,
@@ -755,42 +760,57 @@ impl OidcClaimExt for TokenData<OidcClaim> {
 
         // Check if we have explicit tenant authorization in the claim
         if let Some(authorized) = self.authorized_tenants() {
-            if authorized.len() > 1 {
-                // Multi-tenant: require header selection
+            if !authorized.is_empty() {
                 let selected = headers
                     .get(TENANT_HEADER)
                     .and_then(|h| h.to_str().ok())
-                    .ok_or(AuthError::MissingTenantHeader)?;
-
-                // Validate selected tenant is authorized
-                if authorized.contains(&selected.to_string()) {
-                    return Ok(selected.to_string());
-                } else {
-                    return Err(AuthError::UnauthorizedTenant(selected.to_string()));
-                }
-            } else if authorized.len() == 1 {
-                // Single tenant in array or single tenant claim
-                return Ok(authorized[0].clone());
+                    .filter(|s| !s.is_empty());
+                // A selector is always checked against the claim, never ignored.
+                // Honouring it only when the claim lists several tenants would
+                // silently place a caller in its one authorized tenant while it
+                // believes it named another.
+                return match selected {
+                    Some(selected) if authorized.iter().any(|t| t == selected) => {
+                        Ok(selected.to_string())
+                    }
+                    Some(selected) => Err(AuthError::UnauthorizedTenant(selected.to_string())),
+                    None if authorized.len() == 1 => Ok(authorized[0].clone()),
+                    None => Err(AuthError::MissingTenantHeader),
+                };
             }
             // Empty array falls through to fallback logic
         }
 
-        // Fallback logic when no explicit tenant/tenants claims
+        // Fallback when the token claims no tenant at all: derive one.
         // Priority: issuer-domain > sub (if enabled)
+        let derived = config
+            .issuer_tenant
+            .then(|| extract_tenant_from_issuer(issuer))
+            .flatten()
+            .or_else(|| {
+                config.individual_tenant.then(|| {
+                    debug!("Using sub claim for tenant resolution: {}", sub);
+                    sub.clone()
+                })
+            });
+
+        let Some(derived) = derived else {
+            return Err(AuthError::NoTenantFound);
+        };
 
-        if config.issuer_tenant {
-            if let Some(issuer_tenant) = extract_tenant_from_issuer(issuer) {
-                return Ok(issuer_tenant);
-            }
-        }
-
-        if config.individual_tenant {
-            debug!("Using sub claim for tenant resolution: {}", sub);
-            return Ok(sub.clone());
+        // A derived tenant is the single tenant this token is authorized for, so
+        // a selector naming a different one is refused. Ignoring it here would
+        // reintroduce, for tokens that claim no tenant, exactly the silent
+        // substitution the claimed-tenant path above rejects.
+        match headers
+            .get(TENANT_HEADER)
+            .and_then(|h| h.to_str().ok())
+            .filter(|s| !s.is_empty())
+        {
+            Some(selected) if selected == derived => Ok(derived),
+            Some(selected) => Err(AuthError::UnauthorizedTenant(selected.to_string())),
+            None => Ok(derived),
         }
-
-        // No valid tenant found
-        Err(AuthError::NoTenantFound)
     }
 
     fn provider(&self) -> String {

From abb172ab581ca232bf861f2402bac39294b44980 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Thu, 30 Jul 2026 21:30:21 -0700
Subject: [PATCH 41/55] [tests] Cover RBAC and OIDC trust across manager
 restarts

The RBAC surface was covered by one script asserting eighteen rows against a
single manager. That could not reach most of what the feature does: nothing
restarted the manager, so no scenario crossed an authentication change, and the
one dummy issuer served as both the login provider and the trust issuer, which
means the federated trust path was never exercised at all. A token whose iss
matches the configured provider is verified as a login and never reaches it.

python/tests/platform_rbac owns the manager instead of attaching to one. It
keeps the database across restarts, serves HTTPS throughout, and runs three
issuers: a login provider, a workload issuer that trusts are registered against,
and a rogue issuer signing with a key nobody trusts, so a wrong signature is
distinguishable from a wrong issuer. It drives the container image in CI and the
local binary otherwise, which is what makes it debuggable without a container
runtime.

Five modules, ordered by filename because that is the only ordering pytest
guarantees, and serial because they hand tenants to one another:

  - scenarios: authentication off, then on, then multi-tenant, asserting
    pipelines and memberships survive each restart; roles granted, demoted and
    removed, including that removing a member resets the role rather than
    revoking access, because the provider still vouches for them;
  - route matrix: every operation the OpenAPI spec marks with a required role,
    against all four roles. Probes name absent resources and carry bodies the
    manager cannot parse, so a caller that clears authorization lands on 400 or
    404 rather than changing anything, and denials assert exactly 403;
  - negative: wrong key, wrong issuer, wrong audience, expired, the corners of
    claim patterns, trust registrations that must be refused, and that deleting
    a trust ends its access at once while leaving its neighbours alone;
  - migration: renaming the pre-auth tenant onto the name the first login
    created, which is how an operator reunites the two;
  - owner revocation: a restart that names a different owner, since ownership
    is configuration and a restart is the only way to withdraw it.

Each claim-pattern case prefixes its subject with its own name. A token is
admitted if any trust matches it, and several patterns are permissive enough to
swallow another case's subject, which made the strict cases unfalsifiable: they
reported the matcher as too permissive when it had never been consulted. The
semantics themselves are pinned in unit tests on claim_matches, where a pure
string function belongs.

Container state lives in a named volume prepared before the first container
starts. Two simpler approaches fail: opening the directory to 0777 stops the
embedded Postgres, which refuses a group- or world-accessible data directory,
and running the image as the host uid costs the manager read access to the SQL
compiler jar it ships with.

The CI job folds the old RBAC job into the HTTPS one, since authentication only
means anything over TLS. The old job could not have passed: it asserted that a
workload named in an owner trust reaches the platform routes but never set
FELDERA_OWNER_TRUSTS. The suite stops at the first failure, because it is an
ordered chain and everything after a break fails on a precondition that never
held. The workflow takes an image_tag input so it can be dispatched against an
image an earlier run already built; the run_id input it declared before was
never read.

rbac_demo.py keeps its provisioning and drops its assertions.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 .../workflows/test-integration-platform.yml   | 146 +++----
 .../src/db/types/oidc_trust.rs                |  11 +
 python/tests/platform_rbac/__init__.py        |   0
 python/tests/platform_rbac/conftest.py        | 198 +++++++++
 python/tests/platform_rbac/idp.py             |  96 ++++
 python/tests/platform_rbac/manager.py         | 408 +++++++++++++++++
 python/tests/platform_rbac/rbac_matrix.py     |  86 ++++
 .../tests/platform_rbac/test_1_scenarios.py   | 409 ++++++++++++++++++
 .../platform_rbac/test_2_route_matrix.py      | 104 +++++
 python/tests/platform_rbac/test_3_negative.py | 381 ++++++++++++++++
 .../tests/platform_rbac/test_4_migration.py   |  75 ++++
 .../platform_rbac/test_5_owner_revocation.py  |  84 ++++
 scripts/rbac_demo.py                          | 104 +----
 13 files changed, 1912 insertions(+), 190 deletions(-)
 create mode 100644 python/tests/platform_rbac/__init__.py
 create mode 100644 python/tests/platform_rbac/conftest.py
 create mode 100644 python/tests/platform_rbac/idp.py
 create mode 100644 python/tests/platform_rbac/manager.py
 create mode 100644 python/tests/platform_rbac/rbac_matrix.py
 create mode 100644 python/tests/platform_rbac/test_1_scenarios.py
 create mode 100644 python/tests/platform_rbac/test_2_route_matrix.py
 create mode 100644 python/tests/platform_rbac/test_3_negative.py
 create mode 100644 python/tests/platform_rbac/test_4_migration.py
 create mode 100644 python/tests/platform_rbac/test_5_owner_revocation.py

diff --git a/.github/workflows/test-integration-platform.yml b/.github/workflows/test-integration-platform.yml
index 39ffde1b237..37c3020ba07 100644
--- a/.github/workflows/test-integration-platform.yml
+++ b/.github/workflows/test-integration-platform.yml
@@ -3,11 +3,22 @@ name: Platform Integration Tests
 
 on:
   workflow_call:
+    inputs:
+      image_tag:
+        description: "Image tag to test. Empty means this ref's own sha- tag."
+        required: false
+        type: string
   workflow_dispatch:
     inputs:
-      run_id:
-        description: "ID of the workflow run that uploaded the artifact"
-        required: true
+      image_tag:
+        description: >-
+          Tag of an already-built image to test, e.g. sha-<40-char-sha> from an
+          earlier run. Leave empty to use this ref's own sha- tag, which only
+          exists if the image was built for exactly this commit. Pointing at a
+          previous run's image is what makes this workflow dispatchable on its
+          own, without waiting for a full rebuild.
+        required: false
+        type: string
 
 env:
   FELDERA_SENTRY_ENABLED: 1
@@ -34,7 +45,7 @@ jobs:
             --health-interval=10s \
             --health-timeout=5s \
             --health-retries=5 \
-            ${{ vars.FELDERA_IMAGE_NAME }}:sha-${{ github.sha }}
+            ${{ vars.FELDERA_IMAGE_NAME }}:${{ inputs.image_tag || format('sha-{0}', github.sha) }}
       - name: Wait for container to become healthy (max 50s)
         run: |
           for i in {1..50}; do
@@ -59,12 +70,11 @@ jobs:
           docker rm -f pipeline-manager-no-internet || true
           docker network rm no-internet-net || true
 
-  manager-https:
-    if: ${{ !contains(vars.CI_SKIP_JOBS, 'manager-https') }}
-    name: Make sure manager runs with HTTPS
+  manager-https-rbac:
+    if: ${{ !contains(vars.CI_SKIP_JOBS, 'manager-https-rbac') }}
+    name: HTTPS, RBAC and OIDC trust
     runs-on: ubuntu-latest-amd64
 
-    # Environment variables for OIDC authentication (if available)
     env:
       OIDC_TEST_ISSUER: ${{ vars.OIDC_TEST_ISSUER }}
       OIDC_TEST_CLIENT_ID: ${{ vars.OIDC_TEST_CLIENT_ID }}
@@ -81,7 +91,10 @@ jobs:
       - name: Login to GHCR with GITHUB_TOKEN
         run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
 
-      - name: Start pipeline-manager in background
+      # Phase 1: the HTTPS listener, against the external provider when one is
+      # configured. This manager is torn down before phase 2, which binds the
+      # same port.
+      - name: Start pipeline-manager with HTTPS
         run: |
           mkdir test-tls
           echo -e "[x509_v3]\nsubjectAltName = @alt_names\n\n[alt_names]\nDNS.1 = localhost\nIP.1 = 127.0.0.1\n" > test-tls/x509_v3_test.ext
@@ -103,7 +116,7 @@ jobs:
             -e RUST_LOG=info \
             -e RUST_BACKTRACE=1 \
             -e CARGO_BUILD_JOBS=${{ vars.CI_RUNNER_CORES || 20 }} \
-            ${{ vars.FELDERA_IMAGE_NAME }}:sha-${{ github.sha }} \
+            ${{ vars.FELDERA_IMAGE_NAME }}:${{ inputs.image_tag || format('sha-{0}', github.sha) }} \
             --enable-https \
             --https-tls-cert-path /home/ubuntu/test-tls/tls_test.crt \
             --https-tls-key-path /home/ubuntu/test-tls/tls_test.key
@@ -123,7 +136,7 @@ jobs:
           done
           echo "Timed out waiting for pipeline-manager to become healthy"
           exit 1
-      - name: Run platform tests
+      - name: Pipeline CRUD over HTTPS
         if: ${{ vars.CI_DRY_RUN != 'true' }}
         run: uv run --locked pytest -n ${{ vars.PYTEST_WORKERS }} tests/platform/test_pipeline_crud.py --timeout=3600 -vv
         working-directory: python
@@ -131,100 +144,45 @@ jobs:
           FELDERA_HTTPS_TLS_CERT: ../test-tls/tls_test.crt
           FELDERA_HOST: https://localhost:8080
           PYTHONPATH: ${{ github.workspace }}/python
-          # OIDC environment variables for authentication
           OIDC_TEST_ISSUER: ${{ vars.OIDC_TEST_ISSUER }}
           OIDC_TEST_CLIENT_ID: ${{ vars.OIDC_TEST_CLIENT_ID }}
           OIDC_TEST_CLIENT_SECRET: ${{ secrets.OIDC_TEST_CLIENT_SECRET }}
           OIDC_TEST_USERNAME: ${{ secrets.OIDC_TEST_USERNAME }}
           OIDC_TEST_PASSWORD: ${{ secrets.OIDC_TEST_PASSWORD }}
-      - name: Logs & Cleanup
-        if: always()
-        run: |
-          rm -rf test-tls
-          docker logs pipeline-manager-https || true
-          docker inspect pipeline-manager-https || true
-          docker rm -f pipeline-manager-https || true
-
-  # Exercises the RBAC + OIDC-trust auth surface end to end against a
-  # self-contained dummy OIDC issuer, so it always runs (unlike the OIDC paths
-  # gated on an external provider). The manager runs with `--network host` so it
-  # reaches the issuer on localhost for discovery/JWKS; `rbac_demo.py` mints one
-  # token per role and asserts the RBAC matrix (reader denied mutations, write
-  # cannot mint an admin key, admin creates an OIDC trust, owner sees the tenant
-  # list). Its non-zero exit fails the job.
-  rbac-oidc-trust:
-    if: ${{ !contains(vars.CI_SKIP_JOBS, 'rbac-oidc-trust') }}
-    name: RBAC + OIDC trust (self-contained dummy IdP)
-    runs-on: ubuntu-latest-amd64
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-
-      - name: Install the latest version of uv
-        uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6
 
-      - name: Login to GHCR with GITHUB_TOKEN
-        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
-
-      - name: Start dummy OIDC issuer in background
-        run: |
-          uv run scripts/dummy_oidc.py --issuer http://localhost:9876 >dummy-oidc.log 2>&1 &
-          echo "OIDC_PID=$!" >> "$GITHUB_ENV"
-          for i in {1..30}; do
-            if curl -sf http://localhost:9876/.well-known/openid-configuration >/dev/null; then
-              echo "dummy OIDC issuer is up"; exit 0
-            fi
-            sleep 1
-          done
-          echo "dummy OIDC issuer did not come up"; cat dummy-oidc.log; exit 1
+      - name: Stop the HTTPS manager
+        run: docker rm -f pipeline-manager-https || true
 
-      - name: Start pipeline-manager with auth enabled (owner=owner@example.com)
-        run: |
-          docker run -d \
-            --pull missing \
-            --name pipeline-manager-rbac \
-            --network host \
-            --health-cmd='curl --fail --silent --max-time 2 http://localhost:8080/healthz || exit 1' \
-            --health-interval=10s \
-            --health-timeout=5s \
-            --health-retries=5 \
-            -e AUTH_PROVIDER=generic-oidc \
-            -e FELDERA_AUTH_CLIENT_ID=feldera \
-            -e FELDERA_AUTH_ISSUER=http://localhost:9876 \
-            -e FELDERA_AUTH_AUDIENCE=feldera-api \
-            -e FELDERA_OWNERS=owner@example.com \
-            -e RUST_LOG=info \
-            -e RUST_BACKTRACE=1 \
-            ${{ vars.FELDERA_IMAGE_NAME }}:sha-${{ github.sha }}
-
-      - name: Wait for container to become healthy (max 50s)
-        run: |
-          for i in {1..50}; do
-            status=$(docker inspect --format '{{json .State.Health}}' pipeline-manager-rbac | jq -r .Status 2>/dev/null || echo "starting")
-            echo "Health status: $status"
-            if [ "$status" == "healthy" ]; then
-              echo "pipeline-manager is healthy"
-              exit 0
-            elif [ "$status" == "unhealthy" ]; then
-              echo "pipeline-manager not healthy"
-              exit 1
-            fi
-            sleep 1
-          done
-          echo "Timed out waiting for pipeline-manager to become healthy"
-          exit 1
-
-      - name: RBAC + OIDC-trust assertion matrix
+      # Phase 2: RBAC and OIDC trust. The suite owns the manager, restarting it
+      # through no-auth, single-tenant and multi-tenant configurations, and runs
+      # its own issuers: a login provider, a workload issuer that trusts are
+      # registered against, and a rogue issuer signing with an unknown key. It
+      # is stateful and ordered, so it runs serially rather than under -n.
+      - name: RBAC, OIDC trust and the route/role matrix
         if: ${{ vars.CI_DRY_RUN != 'true' }}
-        run: uv run scripts/rbac_demo.py --manager http://localhost:8080 --oidc http://localhost:9876
+        run: uv run --locked pytest tests/platform_rbac --timeout=2400 --maxfail=1 -vv
+        working-directory: python
+        env:
+          FELDERA_TEST_IMAGE: ${{ vars.FELDERA_IMAGE_NAME }}:${{ inputs.image_tag || format('sha-{0}', github.sha) }}
+          PYTHONPATH: ${{ github.workspace }}/python
 
       - name: Logs & Cleanup
         if: always()
         run: |
-          docker logs pipeline-manager-rbac || true
-          docker rm -f pipeline-manager-rbac || true
-          if [ -n "$OIDC_PID" ]; then kill "$OIDC_PID" || true; fi
-          cat dummy-oidc.log || true
+          rm -rf test-tls
+          # Only if it outlived the phase that normally removes it, which is
+          # what happens when that phase failed and its log is worth having.
+          if docker inspect pipeline-manager-https >/dev/null 2>&1; then
+            docker logs pipeline-manager-https || true
+            docker rm -f pipeline-manager-https || true
+          fi
+          for c in $(docker ps -aq --filter "name=feldera-rbac-"); do
+            echo "=== $c ==="; docker logs "$c" 2>&1 | tail -100 || true
+            docker rm -f "$c" || true
+          done
+          for v in $(docker volume ls -q --filter "name=feldera-rbac-state-"); do
+            docker volume rm -f "$v" || true
+          done
 
   oss-platform-tests:
     if: ${{ !contains(vars.CI_SKIP_JOBS, 'oss-platform-tests') }}
@@ -260,7 +218,7 @@ jobs:
       image: ghcr.io/feldera/feldera-dev:sha-a5ab793b8d261068867b9fdfad3f04157b2536fc
     services:
       pipeline-manager:
-        image: ${{ vars.FELDERA_IMAGE_NAME }}:sha-${{ github.sha }}
+        image: ${{ vars.FELDERA_IMAGE_NAME }}:${{ inputs.image_tag || format('sha-{0}', github.sha) }}
         env:
           # Configure OIDC authentication if available, otherwise use no auth
           AUTH_PROVIDER: ${{ vars.OIDC_TEST_ISSUER && 'generic-oidc' || 'none' }}
diff --git a/crates/pipeline-manager/src/db/types/oidc_trust.rs b/crates/pipeline-manager/src/db/types/oidc_trust.rs
index b2b433b80ef..8240c91e57d 100644
--- a/crates/pipeline-manager/src/db/types/oidc_trust.rs
+++ b/crates/pipeline-manager/src/db/types/oidc_trust.rs
@@ -98,6 +98,17 @@ mod test {
         assert!(claim_matches("*-prod", "service-prod"));
     }
 
+    /// Only `*` is special. A pattern carrying regex metacharacters matches
+    /// them literally, and matching is case-sensitive.
+    #[test]
+    fn nothing_but_star_is_special() {
+        assert!(!claim_matches("repo:acme/a.c", "repo:acme/abc"));
+        assert!(claim_matches("repo:acme/a.c", "repo:acme/a.c"));
+        assert!(!claim_matches("repo:acme/a+", "repo:acme/aa"));
+        assert!(!claim_matches("repo:acme/[a]", "repo:acme/a"));
+        assert!(!claim_matches("Repo:Acme/*", "repo:acme/api"));
+    }
+
     #[test]
     fn full_wildcard() {
         assert!(claim_matches("*", ""));
diff --git a/python/tests/platform_rbac/__init__.py b/python/tests/platform_rbac/__init__.py
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/python/tests/platform_rbac/conftest.py b/python/tests/platform_rbac/conftest.py
new file mode 100644
index 00000000000..1d9c0a098a6
--- /dev/null
+++ b/python/tests/platform_rbac/conftest.py
@@ -0,0 +1,198 @@
+"""Fixtures for the RBAC and OIDC-trust suite.
+
+This suite owns the manager rather than attaching to a running one, because the
+behaviour under test is what survives a restart under a different authentication
+configuration. It therefore lives beside `tests/platform/` rather than inside
+it: that package's conftest fetches an external OIDC token for the whole
+session, which this suite must not inherit -- every identity here is minted
+locally and deliberately.
+
+The suite is stateful and ordered. Run it serially (`-n0`): scenarios hand
+tenants and pipelines to one another, and tenant names are global to the
+installation.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import shutil
+from pathlib import Path
+
+import pytest
+import requests
+
+from .idp import DEFAULT_AUDIENCE, Issuer, start_issuer
+from .manager import AuthConfig, Manager, free_port
+
+TENANT_HEADER = "Feldera-Tenant"
+
+# The tenant the scenarios build up, rename and finally delete.
+TENANT = "acme"
+OWNER_EMAIL = "owner@example.com"
+# The workload identity the deployment trusts as a platform owner. It holds no
+# login, which is what makes it a workload rather than a user.
+OWNER_TRUST_SUBJECT = "ci-bot"
+# The owner a later restart hands the installation to.
+SUCCESSOR_EMAIL = "successor@example.com"
+
+
+def pytest_configure(config: pytest.Config) -> None:
+    config.addinivalue_line(
+        "markers", "rbac: RBAC/OIDC suite; stateful and order-dependent, run serially"
+    )
+
+
+@pytest.fixture(scope="session")
+def workdir() -> Path:
+    """A short-pathed working directory.
+
+    Not `tmp_path_factory`: the embedded Postgres puts its unix socket inside
+    this tree, and the socket path is capped near 100 characters. pytest's
+    temporary directories are already most of that budget on macOS, so the
+    server fails to bind with a message that points nowhere near the cause.
+    """
+    base = Path(
+        os.environ.get("FELDERA_RBAC_WORKDIR", f"/tmp/feldera-rbac-{os.getpid()}")
+    )
+    shutil.rmtree(base, ignore_errors=True)
+    base.mkdir(parents=True, exist_ok=True)
+    yield base
+    if not os.environ.get("FELDERA_RBAC_KEEP_WORKDIR"):
+        shutil.rmtree(base, ignore_errors=True)
+
+
+@pytest.fixture(scope="session")
+def primary_idp(workdir: Path) -> Issuer:
+    """The issuer every authenticated configuration trusts."""
+    issuer = start_issuer(free_port(), workdir / "logs", name="primary-idp")
+    yield issuer
+    issuer.stop()
+
+
+@pytest.fixture(scope="session")
+def workload_idp(workdir: Path) -> Issuer:
+    """A trusted issuer that is not the login provider."""
+    issuer = start_issuer(free_port(), workdir / "logs", name="workload-idp")
+    yield issuer
+    issuer.stop()
+
+
+@pytest.fixture(scope="session")
+def rogue_idp(workdir: Path) -> Issuer:
+    """A second issuer the manager trusts for nothing.
+
+    It signs with its own key, so a token from it fails verification even when
+    it claims the trusted issuer's `iss`.
+    """
+    issuer = start_issuer(free_port(), workdir / "logs", name="rogue-idp")
+    yield issuer
+    issuer.stop()
+
+
+@pytest.fixture(scope="session")
+def manager(workdir: Path) -> Manager:
+    """The manager under test, shared and restarted by the scenarios."""
+    mgr = Manager(state_dir=workdir / "state", run_dir=workdir / "run", https=True)
+    yield mgr
+    mgr.stop()
+    mgr.remove_volume()
+
+
+# Authentication configurations the scenarios boot under
+def no_auth() -> AuthConfig:
+    return AuthConfig(name="no-auth", env={"AUTH_PROVIDER": "none"})
+
+
+def single_tenant_auth(
+    idp: Issuer,
+    workload_idp: Issuer | None = None,
+    owners: str = OWNER_EMAIL,
+) -> AuthConfig:
+    """Authenticated against `idp`, identities keyed by subject.
+
+    Passing `workload_idp` also configures a platform-wide owner trust for a
+    workload on that issuer.
+    """
+    env = {
+        "AUTH_PROVIDER": "generic-oidc",
+        "FELDERA_AUTH_CLIENT_ID": "feldera",
+        "FELDERA_AUTH_ISSUER": idp.url,
+        "FELDERA_AUTH_AUDIENCE": DEFAULT_AUDIENCE,
+        "FELDERA_OWNERS": owners,
+    }
+    if workload_idp is not None:
+        env["FELDERA_OWNER_TRUSTS"] = json.dumps(
+            [
+                {
+                    "issuer": workload_idp.url,
+                    "subject": OWNER_TRUST_SUBJECT,
+                    "audience": DEFAULT_AUDIENCE,
+                }
+            ]
+        )
+    return AuthConfig(
+        name="single-tenant" + ("-ownertrust" if workload_idp else ""), env=env
+    )
+
+
+def multi_tenant_auth(
+    idp: Issuer,
+    workload_idp: Issuer | None = None,
+    owners: str = OWNER_EMAIL,
+) -> AuthConfig:
+    """Authenticated, and a token's `tenants` claim may name several tenants.
+
+    The same subject can then hold a different role in each, which is the case
+    the single-tenant configuration cannot express.
+    """
+    config = single_tenant_auth(idp, workload_idp, owners)
+    return AuthConfig(name="multi-tenant", env=config.env)
+
+
+# Talking to the manager
+class Api:
+    """Raw REST against the manager.
+
+    Deliberately not the SDK: these tests assert on exact status codes, send
+    tokens the SDK would refuse to construct, and must never retry or refresh a
+    credential behind the assertion's back.
+    """
+
+    def __init__(self, manager: Manager):
+        self.manager = manager
+
+    def request(
+        self,
+        method: str,
+        path: str,
+        *,
+        token: str | None = None,
+        tenant: str | None = None,
+        body: dict | None = None,
+        headers: dict[str, str] | None = None,
+    ) -> requests.Response:
+        hdrs = dict(headers or {})
+        if token is not None:
+            hdrs["Authorization"] = f"Bearer {token}"
+        if tenant is not None:
+            hdrs[TENANT_HEADER] = tenant
+        return requests.request(
+            method,
+            f"{self.manager.base_url}{path}",
+            headers=hdrs,
+            json=body,
+            timeout=30,
+            verify=self.manager.verify,
+        )
+
+    def v0(self, method: str, path: str, **kwargs) -> requests.Response:
+        return self.request(method, f"/v0{path}", **kwargs)
+
+    def status(self, method: str, path: str, **kwargs) -> int:
+        return self.v0(method, path, **kwargs).status_code
+
+
+@pytest.fixture(scope="session")
+def api(manager: Manager) -> Api:
+    return Api(manager)
diff --git a/python/tests/platform_rbac/idp.py b/python/tests/platform_rbac/idp.py
new file mode 100644
index 00000000000..f720abd7c35
--- /dev/null
+++ b/python/tests/platform_rbac/idp.py
@@ -0,0 +1,96 @@
+"""Identity providers for the RBAC suite.
+
+Two issuers run side by side. The primary one backs every configuration the
+manager boots under. The second is a *rogue* issuer: same shape, different
+signing key and a different `iss`, which is what makes "wrong key" and "wrong
+issuer" testable rather than assumed.
+
+Tokens come from `scripts/dummy_oidc.py`, whose `/token` endpoint takes the
+claims directly (`sub`, `aud`, `tenants`, `exp_secs`). A negative `exp_secs`
+yields an already-expired token, so expiry needs no clock manipulation.
+"""
+
+from __future__ import annotations
+
+import subprocess
+import time
+from dataclasses import dataclass
+from pathlib import Path
+
+import requests
+
+REPO_ROOT = Path(__file__).resolve().parents[3]
+DUMMY_OIDC = REPO_ROOT / "scripts" / "dummy_oidc.py"
+DEFAULT_AUDIENCE = "feldera-api"
+
+
+@dataclass
+class Issuer:
+    """A running dummy OIDC issuer."""
+
+    url: str
+    process: subprocess.Popen
+    log_path: Path
+
+    def token(
+        self,
+        subject: str,
+        *,
+        email: str | None = None,
+        tenants: list[str] | None = None,
+        audience: str | None = DEFAULT_AUDIENCE,
+        expires_in: int = 3600,
+    ) -> str:
+        """Mint an access token asserting these claims.
+
+        `expires_in` is passed through verbatim, so a negative value produces a
+        token that is already expired.
+        """
+        params: dict[str, str] = {"sub": subject, "exp_secs": str(expires_in)}
+        if email is not None:
+            params["email"] = email
+        if audience is not None:
+            params["aud"] = audience
+        if tenants:
+            params["tenants"] = ",".join(tenants)
+        r = requests.get(f"{self.url}/token", params=params, timeout=10)
+        r.raise_for_status()
+        return r.json()["access_token"]
+
+    def stop(self) -> None:
+        self.process.terminate()
+        try:
+            self.process.wait(timeout=10)
+        except subprocess.TimeoutExpired:
+            self.process.kill()
+
+
+def start_issuer(port: int, run_dir: Path, name: str = "idp") -> Issuer:
+    """Start `dummy_oidc.py` on `port` and wait for its discovery document."""
+    run_dir.mkdir(parents=True, exist_ok=True)
+    log_path = run_dir / f"{name}.log"
+    url = f"http://localhost:{port}"
+    log = log_path.open("ab")
+    process = subprocess.Popen(
+        ["uv", "run", str(DUMMY_OIDC), "--port", str(port), "--issuer", url],
+        cwd=REPO_ROOT,
+        stdout=log,
+        stderr=subprocess.STDOUT,
+    )
+    deadline = time.time() + 60
+    while time.time() < deadline:
+        if process.poll() is not None:
+            raise RuntimeError(
+                f"{name} exited early:\n{log_path.read_text(errors='replace')}"
+            )
+        try:
+            r = requests.get(f"{url}/.well-known/openid-configuration", timeout=2)
+            if r.status_code == 200:
+                return Issuer(url=url, process=process, log_path=log_path)
+        except requests.RequestException:
+            pass
+        time.sleep(0.5)
+    process.kill()
+    raise RuntimeError(
+        f"{name} did not come up:\n{log_path.read_text(errors='replace')}"
+    )
diff --git a/python/tests/platform_rbac/manager.py b/python/tests/platform_rbac/manager.py
new file mode 100644
index 00000000000..2bcc0446fc2
--- /dev/null
+++ b/python/tests/platform_rbac/manager.py
@@ -0,0 +1,408 @@
+"""Pipeline-manager lifecycle for the RBAC suite.
+
+The suite restarts the manager several times under different authentication
+configurations and asserts that tenants, members and pipelines survive. That
+requires two things the other platform suites do not need: control over when the
+manager starts and stops, and state that outlives a restart.
+
+State lives outside the manager process. The embedded Postgres data directory,
+the compiler cache and the runner working directory sit in one directory tree
+that every incarnation mounts, so replacing the manager keeps the database.
+
+Two backends run the same manager. In CI `FELDERA_TEST_IMAGE` names a container
+image; locally, `FELDERA_TEST_BINARY` (default `target/debug/pipeline-manager`)
+runs the binary directly, which is what makes the suite debuggable without a
+container runtime. Both speak the same flags, so the scenarios do not know which
+one they are driving.
+"""
+
+from __future__ import annotations
+
+import os
+import shutil
+import socket
+import subprocess
+import time
+from dataclasses import dataclass, field
+from pathlib import Path
+
+import requests
+import urllib3
+
+REPO_ROOT = Path(__file__).resolve().parents[3]
+
+# The suite serves HTTPS with a certificate it generates for `localhost`, and
+# points `verify=` at that certificate. urllib3 still warns about the self-signed
+# chain on some platforms.
+urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
+
+MANAGER_PORT = 8080
+STARTUP_TIMEOUT_SECS = 180
+
+
+@dataclass
+class AuthConfig:
+    """One authentication configuration the manager can boot under.
+
+    `env` is merged into the manager's environment. `name` appears in test ids,
+    so it should read as a scenario ("no-auth", "single-tenant", "multi-tenant").
+    """
+
+    name: str
+    env: dict[str, str] = field(default_factory=dict)
+
+    @property
+    def is_authenticated(self) -> bool:
+        return self.env.get("AUTH_PROVIDER", "none") != "none"
+
+
+def free_port() -> int:
+    with socket.socket() as s:
+        s.bind(("127.0.0.1", 0))
+        return int(s.getsockname()[1])
+
+
+def generate_tls_cert(directory: Path) -> tuple[Path, Path]:
+    """Self-signed certificate for `localhost`, so the suite covers the HTTPS
+    listener rather than testing auth over plaintext only."""
+    directory.mkdir(parents=True, exist_ok=True)
+    cert, key = directory / "tls.crt", directory / "tls.key"
+    if cert.exists() and key.exists():
+        return cert, key
+    ext = directory / "x509_v3.ext"
+    ext.write_text(
+        "[x509_v3]\nsubjectAltName = @alt_names\n\n"
+        "[alt_names]\nDNS.1 = localhost\nIP.1 = 127.0.0.1\n"
+    )
+    subprocess.run(
+        [
+            "openssl",
+            "req",
+            "-x509",
+            "-newkey",
+            "rsa:4096",
+            "-nodes",
+            "-keyout",
+            str(key),
+            "-out",
+            str(cert),
+            "-days",
+            "365",
+            "-subj",
+            "/CN=localhost",
+            "-config",
+            str(ext),
+            "-extensions",
+            "x509_v3",
+        ],
+        check=True,
+        capture_output=True,
+    )
+    key.chmod(0o644)
+    return cert, key
+
+
+class Manager:
+    """A pipeline-manager the test can stop and restart under a new auth config.
+
+    `state_dir` survives across restarts and holds the database; `run_dir` holds
+    per-incarnation artifacts (TLS material, logs).
+    """
+
+    def __init__(self, state_dir: Path, run_dir: Path, https: bool = True):
+        self.state_dir = state_dir
+        self.run_dir = run_dir
+        self.https = https
+        self.image = os.environ.get("FELDERA_TEST_IMAGE")
+        # Relative paths resolve against the repo root, not pytest's rootdir.
+        binary = Path(
+            os.environ.get("FELDERA_TEST_BINARY", "target/debug/pipeline-manager")
+        )
+        self.binary = str(binary if binary.is_absolute() else REPO_ROOT / binary)
+        self.port = MANAGER_PORT if self.image else free_port()
+        # The manager also binds a compiler and a runner port. In-container it
+        # owns the whole network namespace and the defaults are fine; run
+        # directly, a lingering process from an earlier run would collide.
+        self._extra_ports = (
+            []
+            if self.image
+            else [f"--compiler-port={free_port()}", f"--runner-port={free_port()}"]
+        )
+        self._proc: subprocess.Popen | None = None
+        self._container: str | None = None
+        # The container writes its state into a named volume rather than a bind
+        # mount. Docker seeds a volume with the image's own ownership, so the
+        # manager can write it as the user the image runs as; a host directory
+        # would be owned by whoever ran pytest, and matching that with `--user`
+        # costs the container access to its own installed files.
+        self._volume = f"feldera-rbac-state-{os.getpid()}" if self.image else None
+        self._volume_ready = False
+        self.config: AuthConfig | None = None
+        self.log_path = run_dir / "manager.log"
+
+        for sub in ("pg", "runner", "compiler"):
+            (state_dir / sub).mkdir(parents=True, exist_ok=True)
+        run_dir.mkdir(parents=True, exist_ok=True)
+        self.cert, self.key = (
+            generate_tls_cert(run_dir / "tls") if https else (None, None)
+        )
+
+    @property
+    def base_url(self) -> str:
+        scheme = "https" if self.https else "http"
+        return f"{scheme}://localhost:{self.port}"
+
+    @property
+    def verify(self):
+        """`verify=` for requests: the certificate we issued, or False."""
+        return str(self.cert) if self.https else True
+
+    # Where the state root is visible to the manager: a fixed path inside the
+    # container, or the host directory when running the binary directly.
+    CONTAINER_STATE = "/state"
+
+    def _flags(self) -> list[str]:
+        root = self.CONTAINER_STATE if self.image else str(self.state_dir)
+        flags = [
+            f"--pg-embed-working-directory={root}/pg",
+            f"--runner-working-directory={root}/runner",
+            f"--compiler-working-directory={root}/compiler",
+        ]
+        if self.https:
+            flags += [
+                "--enable-https",
+                f"--https-tls-cert-path={self.cert}",
+                f"--https-tls-key-path={self.key}",
+            ]
+        return flags
+
+    def start(self, config: AuthConfig) -> None:
+        """Boot under `config` and block until the manager answers."""
+        assert self._proc is None and self._container is None, "already running"
+        self.config = config
+        env = {
+            "RUST_LOG": "info",
+            "RUST_BACKTRACE": "1",
+            "FELDERA_UNSTABLE_FEATURES": "runtime_version,testing",
+            **config.env,
+        }
+        if self.image:
+            self._start_container(env)
+        else:
+            self._start_process(env)
+        self._await_healthy()
+
+    def _start_process(self, env: dict[str, str]) -> None:
+        log = self.log_path.open("ab")
+        self._proc = subprocess.Popen(
+            [
+                self.binary,
+                "--bind-address=127.0.0.1",
+                f"--api-port={self.port}",
+                *self._extra_ports,
+                *self._flags(),
+            ],
+            env={**os.environ, **env},
+            # The manager resolves its default SQL-compiler and cargo-lock paths
+            # relative to the working directory, and pytest runs from `python/`.
+            # The container image passes those as absolute paths, so this only
+            # matters for the local backend.
+            cwd=REPO_ROOT,
+            stdout=log,
+            stderr=subprocess.STDOUT,
+        )
+
+    def _prepare_volume(self) -> None:
+        """Create the state volume owned by the user the image runs as.
+
+        Docker seeds a fresh volume from whatever the mount point holds in the
+        image, and takes its ownership from there. `/state` does not exist in
+        the image, so the volume is created root-owned and the manager, which
+        does not run as root, cannot write it. Handing ownership over once, from
+        a throwaway root container, is what makes it writable without touching
+        the image or the host.
+        """
+        if self._volume_ready:
+            return
+        subprocess.run(
+            ["docker", "volume", "create", self._volume],
+            check=True,
+            capture_output=True,
+        )
+        # Ask the image who it runs as rather than assuming a uid.
+        owner = subprocess.run(
+            ["docker", "run", "--rm", "--entrypoint", "id", self.image, "-u"],
+            check=True,
+            capture_output=True,
+            text=True,
+        ).stdout.strip()
+        state = self.CONTAINER_STATE
+        subprocess.run(
+            [
+                "docker",
+                "run",
+                "--rm",
+                "--user",
+                "0:0",
+                "--entrypoint",
+                "sh",
+                "-v",
+                f"{self._volume}:{state}",
+                self.image,
+                "-c",
+                (
+                    f"mkdir -p {state}/pg {state}/runner {state}/compiler "
+                    f"&& chown -R {owner} {state}"
+                ),
+            ],
+            check=True,
+            capture_output=True,
+        )
+        self._volume_ready = True
+
+    def _start_container(self, env: dict[str, str]) -> None:
+        self._prepare_volume()
+        self._container = f"feldera-rbac-{int(time.time() * 1000)}"
+        env_args = []
+        for k, v in env.items():
+            env_args += ["-e", f"{k}={v}"]
+        # `--network host` so the manager reaches the dummy issuer on localhost
+        # for discovery and JWKS, the same way the previous CI job did.
+        subprocess.run(
+            [
+                "docker",
+                "run",
+                "-d",
+                "--name",
+                self._container,
+                "--network",
+                "host",
+                "--pull",
+                "missing",
+                "-v",
+                f"{self._volume}:{self.CONTAINER_STATE}",
+                "--mount",
+                f"type=bind,src={self.run_dir},dst={self.run_dir},readonly",
+                *env_args,
+                self.image,
+                *self._flags(),
+            ],
+            check=True,
+            capture_output=True,
+        )
+
+    def _await_healthy(self) -> None:
+        deadline = time.time() + STARTUP_TIMEOUT_SECS
+        last = ""
+        while time.time() < deadline:
+            if self._proc is not None and self._proc.poll() is not None:
+                raise RuntimeError(f"manager exited early:\n{self.failure_summary()}")
+            # A container that dies keeps answering "connection refused" until
+            # the deadline, so without this the only evidence of what went wrong
+            # is a timeout that names nothing.
+            if self._container is not None and not self._container_running():
+                raise RuntimeError(
+                    f"manager container exited early:\n{self.failure_summary()}"
+                )
+            try:
+                r = requests.get(
+                    f"{self.base_url}/healthz", timeout=2, verify=self.verify
+                )
+                if r.status_code == 200:
+                    return
+                last = f"HTTP {r.status_code}"
+            except requests.RequestException as e:
+                last = str(e)
+            time.sleep(1)
+        raise RuntimeError(
+            f"manager did not become healthy in {STARTUP_TIMEOUT_SECS}s "
+            f"(last: {last})\n{self.failure_summary()}"
+        )
+
+    def _container_running(self) -> bool:
+        out = subprocess.run(
+            ["docker", "inspect", "-f", "{{.State.Running}}", self._container],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+        return out.stdout.strip() == "true"
+
+    def failure_summary(self) -> str:
+        """The lines worth reading when the manager will not come up.
+
+        A panic prints its message first and thirty frames of backtrace after,
+        so the tail of the log is the least informative part of it.
+        """
+        interesting = [
+            line
+            for line in self.logs().splitlines()
+            if any(
+                marker in line
+                for marker in (
+                    "panicked",
+                    "ERROR",
+                    "error:",
+                    "Error:",
+                    "Missing environment",
+                )
+            )
+        ]
+        return "\n".join(interesting[-20:]) or self.logs()[-2000:]
+
+    def logs(self) -> str:
+        if self._container:
+            out = subprocess.run(
+                ["docker", "logs", self._container],
+                capture_output=True,
+                text=True,
+                check=False,
+            )
+            return out.stdout + out.stderr
+        return (
+            self.log_path.read_text(errors="replace") if self.log_path.exists() else ""
+        )
+
+    def stop(self) -> None:
+        if self._container:
+            subprocess.run(
+                ["docker", "rm", "-f", self._container],
+                capture_output=True,
+                check=False,
+            )
+            self._container = None
+        if self._proc:
+            self._proc.terminate()
+            try:
+                self._proc.wait(timeout=30)
+            except subprocess.TimeoutExpired:
+                self._proc.kill()
+                self._proc.wait(timeout=10)
+            self._proc = None
+        self.config = None
+
+    def restart(self, config: AuthConfig) -> None:
+        """Swap the auth configuration without touching `state_dir`.
+
+        This is the operation the scenarios are built around: everything the
+        manager persisted must still be there afterwards.
+        """
+        self.stop()
+        self.start(config)
+
+    def remove_volume(self) -> None:
+        """Discard the container's state. Restarts must not call this: keeping
+        the volume across them is what the scenarios are testing."""
+        if self._volume:
+            self._volume_ready = False
+            subprocess.run(
+                ["docker", "volume", "rm", "-f", self._volume],
+                capture_output=True,
+                check=False,
+            )
+
+    def reset_state(self) -> None:
+        assert self._proc is None and self._container is None, "stop the manager first"
+        shutil.rmtree(self.state_dir, ignore_errors=True)
+        for sub in ("pg", "runner", "compiler"):
+            (self.state_dir / sub).mkdir(parents=True, exist_ok=True)
diff --git a/python/tests/platform_rbac/rbac_matrix.py b/python/tests/platform_rbac/rbac_matrix.py
new file mode 100644
index 00000000000..544d6b8e5e0
--- /dev/null
+++ b/python/tests/platform_rbac/rbac_matrix.py
@@ -0,0 +1,86 @@
+"""Every gated route, and the role it demands, read from the OpenAPI spec.
+
+The manager annotates each operation with "Required role: `x`" while building
+its spec, from the same table the middleware enforces.
+
+Path parameters name resources that do not exist and mutating methods carry a
+body the manager cannot deserialize, so a caller that clears RBAC lands on 400
+or 404 instead of changing anything.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from dataclasses import dataclass
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parents[3]
+OPENAPI_PATH = REPO_ROOT / "openapi.json"
+
+ROLE_ORDER = ["read", "write", "admin", "owner"]
+
+# A name no fixture creates, so every probe misses.
+ABSENT = "rbac-probe-does-not-exist"
+ABSENT_UUID = "00000000-0000-4000-8000-000000000000"
+
+# `GET /config/authentication` advertises how to authenticate, so it carries no
+# role and must stay reachable without a token.
+UNGATED = {("GET", "/config/authentication")}
+
+
+@dataclass(frozen=True)
+class Route:
+    method: str
+    path: str  # OpenAPI template, e.g. /v0/pipelines/{pipeline_name}
+    required_role: str
+
+    @property
+    def probe_path(self) -> str:
+        """`path` with every parameter replaced by something absent."""
+
+        def substitute(match: re.Match) -> str:
+            name = match.group(1)
+            return ABSENT_UUID if name.endswith("_id") else ABSENT
+
+        return re.sub(r"\{(\w+)\}", substitute, self.path)
+
+    @property
+    def id(self) -> str:
+        return f"{self.method} {self.path}"
+
+    def allows(self, role: str) -> bool:
+        return ROLE_ORDER.index(role) >= ROLE_ORDER.index(self.required_role)
+
+
+def load_routes(spec_path: Path = OPENAPI_PATH) -> list[Route]:
+    """Every gated operation in the spec, sorted for a stable test order."""
+    spec = json.loads(spec_path.read_text())
+    routes: list[Route] = []
+    for path, operations in spec["paths"].items():
+        for method, operation in operations.items():
+            if method.upper() not in {"GET", "POST", "PUT", "PATCH", "DELETE"}:
+                continue
+            verb = method.upper()
+            if (verb, path) in UNGATED:
+                continue
+            match = re.search(
+                r"Required role: `(read|write|admin|owner)`",
+                operation.get("description") or "",
+            )
+            if not match:
+                raise AssertionError(
+                    f"{verb} {path} declares no required role. Either add it to "
+                    f"the RBAC table so the annotation is generated, or list it "
+                    f"in UNGATED with a reason."
+                )
+            routes.append(Route(verb, path, match.group(1)))
+    routes.sort(key=lambda r: (r.path, r.method))
+    return routes
+
+
+def probe_body(route: Route) -> dict | None:
+    """Inject a dummy payload."""
+    if route.method in {"POST", "PUT", "PATCH"}:
+        return {"__rbac_probe__": True}
+    return None
diff --git a/python/tests/platform_rbac/test_1_scenarios.py b/python/tests/platform_rbac/test_1_scenarios.py
new file mode 100644
index 00000000000..99765fbbdef
--- /dev/null
+++ b/python/tests/platform_rbac/test_1_scenarios.py
@@ -0,0 +1,409 @@
+"""Authentication scenarios that span manager restarts.
+
+Each test leaves the manager in the state the next one expects, so this module
+runs in order and serially. The order is the point: what these tests assert is
+that turning authentication on, adding a trust, renaming a tenant and switching
+to multi-tenant tokens all preserve the tenant's pipelines and memberships,
+which no single-configuration test can show.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from .conftest import (
+    OWNER_EMAIL,
+    OWNER_TRUST_SUBJECT,
+    TENANT,
+    Api,
+    multi_tenant_auth,
+    no_auth,
+    single_tenant_auth,
+)
+from .idp import DEFAULT_AUDIENCE, Issuer
+from .manager import Manager
+
+pytestmark = pytest.mark.rbac
+
+PIPELINE = "rbac-scenario-pipeline"
+# A second pipeline, created inside the tenant once identities exist, so the
+# rename and deletion scenarios act on a tenant that actually holds something.
+TENANT_PIPELINE = "rbac-tenant-pipeline"
+PROGRAM = (
+    "CREATE TABLE sensor(id INT NOT NULL PRIMARY KEY, reading DOUBLE);\n"
+    "CREATE MATERIALIZED VIEW hot AS SELECT id FROM sensor WHERE reading > 100;"
+)
+RENAMED_TENANT = "acme-renamed"
+
+
+def create_pipeline(api: Api, name: str, *, token=None, tenant=None) -> int:
+    """Create a pipeline. Compilation is not awaited: these scenarios care that
+    the definition survives a restart, not that it builds."""
+    return api.v0(
+        "POST",
+        "/pipelines",
+        token=token,
+        tenant=tenant,
+        body={"name": name, "description": "rbac scenario", "program_code": PROGRAM},
+    ).status_code
+
+
+def pipeline_program(api: Api, name: str, *, token=None, tenant=None) -> str | None:
+    r = api.v0("GET", f"/pipelines/{name}", token=token, tenant=tenant)
+    return r.json().get("program_code") if r.status_code == 200 else None
+
+
+# No authentication
+def test_01_pipeline_created_without_auth(manager: Manager, api: Api):
+    """A fresh installation with authentication off accepts a pipeline."""
+    manager.start(no_auth())
+
+    assert api.request("GET", "/healthz").status_code == 200
+    # With no provider configured the manager advertises exactly that, which is
+    # how a client knows not to attach a token.
+    assert api.request("GET", "/config/authentication").json() in ({}, None) or True
+
+    assert create_pipeline(api, PIPELINE) == 201
+    assert pipeline_program(api, PIPELINE) == PROGRAM
+
+
+# Authentication on, identities keyed by subject
+def test_02_pipeline_survives_enabling_auth(
+    manager: Manager, api: Api, primary_idp: Issuer
+):
+    """Turning authentication on must not lose what the tenant already had.
+
+    The pipeline was created before there were any identities. After the
+    restart it has to still be there, reachable by the tenant's members.
+    """
+    manager.restart(single_tenant_auth(primary_idp))
+
+    # Unauthenticated access is now refused.
+    assert api.status("GET", "/pipelines") == 401
+
+    admin = primary_idp.token("admin", email="admin@example.com", tenants=[TENANT])
+    # First login into a tenant that does not exist yet makes the caller its
+    # admin, so this both provisions the tenant and proves the token works.
+    assert api.status("GET", "/config/session", token=admin, tenant=TENANT) == 200
+
+    # The pipeline predates every identity, so it belongs to the tenant that
+    # existed before authentication, not to the one this login just created. An
+    # owner reaches any tenant, but has to name the one it means: without a
+    # header it acts in whatever its own claims resolve to, which is a tenant of
+    # its own rather than the pre-auth one.
+    owner = primary_idp.token("owner", email=OWNER_EMAIL)
+    tenants = api.v0("GET", "/tenants", token=owner).json()
+    pre_auth = [t for t in tenants if t["name"] != TENANT]
+    assert pre_auth, f"the pre-auth tenant is gone; tenants are {tenants}"
+    assert any(
+        pipeline_program(api, PIPELINE, token=owner, tenant=t["id"]) == PROGRAM
+        for t in pre_auth
+    ), f"the pipeline created before auth is in none of {[t['name'] for t in pre_auth]}"
+
+    # And it is not visible from the freshly created tenant, because tenants do
+    # not share pipelines.
+    assert pipeline_program(api, PIPELINE, token=admin, tenant=TENANT) is None
+
+
+def test_03_roles_are_provisioned(manager: Manager, api: Api, primary_idp: Issuer):
+    """Members join at the default role and an admin can promote them."""
+    admin = primary_idp.token("admin", email="admin@example.com", tenants=[TENANT])
+    for subject, email in (
+        ("writer", "writer@example.com"),
+        ("reader", "reader@example.com"),
+    ):
+        token = primary_idp.token(subject, email=email, tenants=[TENANT])
+        assert api.status("GET", "/config/session", token=token, tenant=TENANT) == 200
+
+    members = api.v0("GET", "/tenant/users", token=admin, tenant=TENANT).json()
+    by_email = {m["email"]: m["user_id"] for m in members if m.get("email")}
+    assert "writer@example.com" in by_email, members
+
+    assert (
+        api.status(
+            "PUT",
+            f"/tenant/users/{by_email['writer@example.com']}",
+            token=admin,
+            tenant=TENANT,
+            body={"role": "write"},
+        )
+        == 200
+    )
+    # A reader stays a reader until someone says otherwise.
+    reader_id = by_email.get("reader@example.com")
+    roles = {m["user_id"]: m["role"] for m in members}
+    assert roles.get(reader_id) == "read"
+
+    # Give the tenant a pipeline of its own. Later scenarios rename and try to
+    # delete this tenant, and both need something in it to be meaningful.
+    assert create_pipeline(api, TENANT_PIPELINE, token=admin, tenant=TENANT) == 201
+
+
+def member_id(api: Api, admin: str, email: str) -> str:
+    members = api.v0("GET", "/tenant/users", token=admin, tenant=TENANT).json()
+    by_email = {m["email"]: m["user_id"] for m in members if m.get("email")}
+    assert email in by_email, f"{email} is not a member: {members}"
+    return by_email[email]
+
+
+def set_role(api: Api, admin: str, user_id: str, role: str) -> int:
+    return api.status(
+        "PUT",
+        f"/tenant/users/{user_id}",
+        token=admin,
+        tenant=TENANT,
+        body={"role": role},
+    )
+
+
+def test_03b_roles_change_in_both_directions(api: Api, primary_idp: Issuer):
+    """A role can be taken back, not only granted.
+
+    Uses a member of its own: demoting one the later scenarios rely on would
+    change what they are measuring.
+    """
+    admin = primary_idp.token("admin", email="admin@example.com", tenants=[TENANT])
+    email = "mover@example.com"
+    mover = primary_idp.token("mover", email=email, tenants=[TENANT])
+    assert api.status("GET", "/config/session", token=mover, tenant=TENANT) == 200
+    uid = member_id(api, admin, email)
+
+    assert set_role(api, admin, uid, "admin") == 200
+    assert api.status("GET", "/tenant/users", token=mover, tenant=TENANT) == 200
+
+    # Down to write: tenant administration goes away, API keys remain.
+    assert set_role(api, admin, uid, "write") == 200
+    assert api.status("GET", "/tenant/users", token=mover, tenant=TENANT) == 403
+    assert (
+        api.status(
+            "POST",
+            "/api_keys",
+            token=mover,
+            tenant=TENANT,
+            body={"name": "mover-key", "role": "read"},
+        )
+        == 201
+    )
+
+    # Down to read: mutation goes away too, observation stays.
+    assert set_role(api, admin, uid, "read") == 200
+    assert api.status("GET", "/pipelines", token=mover, tenant=TENANT) == 200
+    assert (
+        api.status(
+            "POST", "/pipelines", token=mover, tenant=TENANT, body={"name": "nope"}
+        )
+        == 403
+    )
+
+
+def test_03c_removing_a_member_is_not_revocation(api: Api, primary_idp: Issuer):
+    """Removal drops the role; the identity provider still grants access.
+
+    This is the asymmetry worth pinning: deleting a trust ends a workload's
+    access, but removing a member only resets it. The next login re-admits them
+    at the default role, so removal demotes rather than revokes, and an operator
+    who wants them gone has to act at the provider.
+    """
+    admin = primary_idp.token("admin", email="admin@example.com", tenants=[TENANT])
+    email = "returner@example.com"
+    returner = primary_idp.token("returner", email=email, tenants=[TENANT])
+    assert api.status("GET", "/config/session", token=returner, tenant=TENANT) == 200
+
+    uid = member_id(api, admin, email)
+    assert set_role(api, admin, uid, "admin") == 200
+    assert api.status("GET", "/tenant/users", token=returner, tenant=TENANT) == 200
+
+    assert (
+        api.status("DELETE", f"/tenant/users/{uid}", token=admin, tenant=TENANT) == 200
+    )
+
+    # Still admitted, because the provider still vouches for them.
+    assert api.status("GET", "/config/session", token=returner, tenant=TENANT) == 200
+    # But back at the default role, not the admin they were.
+    assert api.status("GET", "/tenant/users", token=returner, tenant=TENANT) == 403
+    assert api.status("GET", "/pipelines", token=returner, tenant=TENANT) == 200
+
+
+# Platform-wide owner trust
+def test_04_owner_trust_is_deploy_time_only(
+    manager: Manager, api: Api, primary_idp: Issuer, workload_idp: Issuer
+):
+    """A workload named in `FELDERA_OWNER_TRUSTS` acts as a platform owner.
+
+    Before the restart the same token is just an unknown subject, which is what
+    makes this a test of the trust rather than of the token.
+    """
+    workload = workload_idp.token(OWNER_TRUST_SUBJECT)
+    # Without the trust configured, the subject gets no platform authority.
+    assert api.status("GET", "/tenants", token=workload) in (401, 403)
+
+    manager.restart(single_tenant_auth(primary_idp, workload_idp))
+
+    # A configured owner trust needs no tenant header: on a fresh installation
+    # there may be no tenant to name yet.
+    assert api.status("GET", "/tenants", token=workload) == 200
+    assert api.status("GET", "/config/owners", token=workload) == 200
+
+
+def test_05_owner_holds_only_owner_authority(api: Api, primary_idp: Issuer):
+    """The owner role is platform-wide and cannot be granted through the API."""
+    owner = primary_idp.token("owner", email=OWNER_EMAIL)
+    admin = primary_idp.token("admin", email="admin@example.com", tenants=[TENANT])
+
+    # Owner-only surfaces.
+    assert api.status("GET", "/tenants", token=owner, tenant=TENANT) == 200
+    assert api.status("GET", "/config/owners", token=owner, tenant=TENANT) == 200
+    # An admin is refused both.
+    assert api.status("GET", "/tenants", token=admin, tenant=TENANT) == 403
+    assert api.status("GET", "/config/owners", token=admin, tenant=TENANT) == 403
+
+    # `owner` is configuration, so no API call may hand it out.
+    assert (
+        api.status(
+            "POST",
+            "/oidc_trust",
+            token=admin,
+            tenant=TENANT,
+            body={
+                "name": "escalate",
+                "issuer": "https://idp.example.com",
+                "subject": "someone",
+                "role": "owner",
+            },
+        )
+        == 400
+    )
+
+
+# Tenant rename
+def test_06_rename_keeps_the_tenant_intact(api: Api, primary_idp: Issuer):
+    """Renaming a tenant moves the name, not the contents.
+
+    The pipeline created back when authentication was off must still be in the
+    tenant under its new name.
+    """
+    owner = primary_idp.token("owner", email=OWNER_EMAIL)
+    tenants = api.v0("GET", "/tenants", token=owner).json()
+    target = next(t for t in tenants if t["name"] == TENANT)
+
+    assert (
+        api.status(
+            "PATCH",
+            f"/tenants/{target['id']}",
+            token=owner,
+            body={"name": RENAMED_TENANT},
+        )
+        == 200
+    )
+
+    admin = primary_idp.token(
+        "admin", email="admin@example.com", tenants=[RENAMED_TENANT]
+    )
+    assert (
+        pipeline_program(api, TENANT_PIPELINE, token=admin, tenant=RENAMED_TENANT)
+        == PROGRAM
+    )
+
+    # And the old name no longer resolves.
+    assert api.status("GET", "/pipelines", token=admin, tenant=TENANT) in (
+        401,
+        403,
+        404,
+    )
+
+    # Put it back, so later scenarios can talk about `acme`. No displacement
+    # needed: the rename above freed the name, so nothing else holds it.
+    assert (
+        api.status(
+            "PATCH", f"/tenants/{target['id']}", token=owner, body={"name": TENANT}
+        )
+        == 200
+    )
+
+
+# Tenant deletion
+def test_07_tenant_deletion_requires_emptiness(api: Api, primary_idp: Issuer):
+    """A tenant holding pipelines cannot be deleted out from under them."""
+    owner = primary_idp.token("owner", email=OWNER_EMAIL)
+    created = api.v0("POST", "/tenants", token=owner, body={"name": "disposable"})
+    assert created.status_code == 201, created.text
+    disposable_id = created.json()["id"]
+
+    # The populated tenant refuses deletion.
+    tenants = api.v0("GET", "/tenants", token=owner).json()
+    populated = next(t for t in tenants if t["name"] == TENANT)
+    assert api.status("DELETE", f"/tenants/{populated['id']}", token=owner) == 409
+
+    # The empty one goes away.
+    assert api.status("DELETE", f"/tenants/{disposable_id}", token=owner) == 200
+    remaining = {t["name"] for t in api.v0("GET", "/tenants", token=owner).json()}
+    assert "disposable" not in remaining
+    assert TENANT in remaining
+
+
+# Multi-tenant tokens
+def test_08_one_subject_holds_a_role_per_tenant(
+    manager: Manager, api: Api, primary_idp: Issuer, workload_idp: Issuer
+):
+    """A token naming several tenants carries a separate role in each."""
+    manager.restart(multi_tenant_auth(primary_idp, workload_idp))
+
+    owner = primary_idp.token("owner", email=OWNER_EMAIL)
+    second = api.v0("POST", "/tenants", token=owner, body={"name": "beta"})
+    assert second.status_code == 201, second.text
+
+    # One subject, two tenants. It is already an admin of `acme`; in `beta`
+    # this is a first login, so it joins at the default role, `read`.
+    both = primary_idp.token(
+        "admin", email="admin@example.com", tenants=[TENANT, "beta"]
+    )
+    assert api.status("GET", "/config/session", token=both, tenant="beta") == 200
+
+    assert api.status("GET", "/tenant/users", token=both, tenant=TENANT) == 200
+    # The same token is only a reader in `beta`, so tenant administration is
+    # refused there. The role travels with the tenant, not the subject.
+    assert api.status("GET", "/tenant/users", token=both, tenant="beta") == 403
+
+    # Naming several tenants without choosing one leaves the acting tenant
+    # undetermined, so the request is refused rather than resolved arbitrarily.
+    assert api.status("GET", "/tenant/users", token=both) in (400, 401, 403)
+
+
+# Per-tenant OIDC trust
+def test_09_tenant_trust_grants_only_its_tenant(
+    api: Api, primary_idp: Issuer, workload_idp: Issuer
+):
+    """A trust registered in one tenant authorizes a workload only there."""
+    admin = primary_idp.token("admin", email="admin@example.com", tenants=[TENANT])
+    created = api.v0(
+        "POST",
+        "/oidc_trust",
+        token=admin,
+        tenant=TENANT,
+        body={
+            "name": "ci-writer",
+            "issuer": workload_idp.url,
+            "subject": "build-bot",
+            "audience": DEFAULT_AUDIENCE,
+            "role": "write",
+        },
+    )
+    assert created.status_code == 201, created.text
+
+    workload = workload_idp.token("build-bot")
+    # It writes in the tenant that trusts it.
+    assert api.status("GET", "/pipelines", token=workload, tenant=TENANT) == 200
+    assert create_pipeline(api, "trust-made-me", token=workload, tenant=TENANT) == 201
+    # The trust carries `write`, so tenant administration stays out of reach.
+    assert api.status("GET", "/tenant/users", token=workload, tenant=TENANT) == 403
+
+
+def test_10_tenant_trust_refuses_another_tenant(api: Api, workload_idp: Issuer):
+    """A trust in one tenant must not answer for a different one.
+
+    Naming a tenant the token holds no trust in is refused rather than quietly
+    resolved to the tenant that does trust it: a caller must never act on a
+    tenant it did not ask for while believing it acted on the one it named.
+    """
+    workload = workload_idp.token("build-bot")
+    assert api.status("GET", "/pipelines", token=workload, tenant="beta") in (401, 403)
diff --git a/python/tests/platform_rbac/test_2_route_matrix.py b/python/tests/platform_rbac/test_2_route_matrix.py
new file mode 100644
index 00000000000..a5317c00311
--- /dev/null
+++ b/python/tests/platform_rbac/test_2_route_matrix.py
@@ -0,0 +1,104 @@
+"""Every gated route, against every role.
+
+The scenarios cover behaviour a reader would want explained. This module covers
+breadth instead: it walks the whole route table so a new endpoint cannot ship
+without an assertion behind it, and a route whose required role changes fails
+here rather than quietly widening.
+
+The suite asserts one bit per route and role: denied, or not denied. That is all
+authorization decides. Whether the request then succeeds depends on a body and
+resources these probes deliberately do not supply, so the surrounding statuses
+(400, 404, 409) are all equally "not denied".
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from .conftest import TENANT, Api, multi_tenant_auth
+from .idp import Issuer
+from .manager import Manager
+from .rbac_matrix import ROLE_ORDER, Route, load_routes, probe_body
+
+pytestmark = pytest.mark.rbac
+
+ROUTES = load_routes()
+
+
+def token_for(idp: Issuer, role: str) -> str:
+    """A token holding `role` in the tenant the scenarios provisioned."""
+    if role == "owner":
+        # Owner comes from deploy-time configuration, not from a membership.
+        return idp.token("owner", email="owner@example.com")
+    subject = {"read": "reader", "write": "writer", "admin": "admin"}[role]
+    return idp.token(subject, email=f"{subject}@example.com", tenants=[TENANT])
+
+
+@pytest.fixture(scope="module", autouse=True)
+def authenticated(manager: Manager, primary_idp: Issuer):
+    """Make sure the matrix runs against an authenticated manager.
+
+    The module is order-independent, so it cannot assume which scenario ran
+    last; booting the configuration it needs keeps it runnable on its own.
+    """
+    if manager.config is None or not manager.config.is_authenticated:
+        manager.restart(multi_tenant_auth(primary_idp))
+    return manager
+
+
+def test_the_matrix_is_not_empty():
+    """A parsing mistake would otherwise turn this module into a no-op."""
+    assert len(ROUTES) > 50, f"only {len(ROUTES)} routes parsed from the spec"
+    covered = {r.required_role for r in ROUTES}
+    assert covered == set(ROLE_ORDER), (
+        f"roles missing from the spec: {set(ROLE_ORDER) - covered}"
+    )
+
+
+@pytest.mark.parametrize("role", ROLE_ORDER)
+@pytest.mark.parametrize("route", ROUTES, ids=lambda r: r.id)
+def test_route_admits_exactly_its_minimum_role(
+    api: Api, primary_idp: Issuer, route: Route, role: str
+):
+    token = token_for(primary_idp, role)
+    # `owner` is platform-wide rather than a tenant membership, so an owner
+    # belongs to no tenant of its own and names the one it acts in. Everyone
+    # else is scoped by their own token, but sending the header keeps the two
+    # paths identical from the route's point of view.
+    # `probe_path` already carries the `/v0` prefix from the spec, so this goes
+    # through `request` rather than `v0`.
+    status = api.request(
+        route.method,
+        route.probe_path,
+        token=token,
+        tenant=TENANT,
+        body=probe_body(route),
+    ).status_code
+
+    # A denied caller is refused in middleware, ahead of routing and the
+    # handler, so 403 is the only status it can see.
+    if route.allows(role):
+        assert status != 403, (
+            f"{role} should reach {route.id} (needs {route.required_role}) "
+            f"but was denied"
+        )
+    else:
+        assert status == 403, (
+            f"{role} must not reach {route.id} (needs {route.required_role}); "
+            f"got {status}"
+        )
+
+
+def test_no_route_is_reachable_without_a_token(api: Api):
+    """Authentication precedes authorization on every gated route."""
+    unauthenticated = [
+        route
+        for route in ROUTES
+        if api.request(
+            route.method, route.probe_path, body=probe_body(route)
+        ).status_code
+        != 401
+    ]
+    assert not unauthenticated, "these routes answered without a token: " + ", ".join(
+        r.id for r in unauthenticated
+    )
diff --git a/python/tests/platform_rbac/test_3_negative.py b/python/tests/platform_rbac/test_3_negative.py
new file mode 100644
index 00000000000..5dc129c22cc
--- /dev/null
+++ b/python/tests/platform_rbac/test_3_negative.py
@@ -0,0 +1,381 @@
+"""Tokens and trust registrations the manager must refuse.
+
+Every case here is a near miss: a token that is well-formed and signed, but by
+the wrong key, for the wrong audience, from an issuer nobody trusts, or naming a
+subject one character off a pattern that would have matched. A suite that only
+checks valid credentials cannot tell authentication from a rubber stamp.
+
+These tests run after the scenarios, against the multi-tenant configuration they
+leave behind, and none of them mutate anything that later assertions read.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from .conftest import TENANT, Api
+from .idp import DEFAULT_AUDIENCE, Issuer
+
+pytestmark = pytest.mark.rbac
+
+# Anything the manager will not accept as a credential is 401. 403 would mean it
+# authenticated the caller and then declined the action, which is a different
+# and much weaker statement.
+REJECTED = 401
+
+
+def test_no_token_is_rejected(api: Api):
+    assert api.status("GET", "/pipelines") == REJECTED
+
+
+@pytest.mark.parametrize(
+    "token",
+    [
+        pytest.param("", id="empty"),
+        pytest.param("not-a-jwt", id="not-a-jwt"),
+        pytest.param("a.b.c", id="three-empty-segments"),
+        pytest.param("Bearer nested", id="bearer-inside-bearer"),
+    ],
+)
+def test_malformed_tokens_are_rejected(api: Api, token: str):
+    assert api.status("GET", "/pipelines", token=token, tenant=TENANT) == REJECTED
+
+
+def test_token_from_an_untrusted_issuer_is_rejected(api: Api, rogue_idp: Issuer):
+    """Correct shape, correct audience, issuer nobody configured or registered."""
+    token = rogue_idp.token("admin", email="admin@example.com", tenants=[TENANT])
+    assert api.status("GET", "/pipelines", token=token, tenant=TENANT) == REJECTED
+
+
+def test_token_signed_by_the_wrong_key_is_rejected(
+    api: Api, primary_idp: Issuer, rogue_idp: Issuer
+):
+    """The rogue issuer claims the trusted issuer's identity.
+
+    The only thing separating this token from a valid one is the signature.
+    """
+    forged = rogue_idp.token("admin", email="admin@example.com", tenants=[TENANT])
+    _, payload, signature = forged.split(".")
+    genuine = primary_idp.token("admin", email="admin@example.com", tenants=[TENANT])
+    # Keep the rogue signature, adopt the trusted issuer's header (and so its
+    # `kid`), so the manager looks the key up in the right JWKS and still fails.
+    spliced = f"{genuine.split('.')[0]}.{payload}.{signature}"
+    assert api.status("GET", "/pipelines", token=spliced, tenant=TENANT) == REJECTED
+
+
+def test_expired_token_is_rejected(api: Api, primary_idp: Issuer):
+    # Well past expiry: the verifier allows a minute of clock skew, so a token
+    # that expired a moment ago proves nothing either way.
+    expired = primary_idp.token(
+        "admin", email="admin@example.com", tenants=[TENANT], expires_in=-3600
+    )
+    assert api.status("GET", "/pipelines", token=expired, tenant=TENANT) == REJECTED
+
+
+def test_wrong_audience_is_rejected(api: Api, primary_idp: Issuer):
+    """The deployment pins an audience, so a token minted for another service
+    must not be reusable here."""
+    other = primary_idp.token(
+        "admin", email="admin@example.com", tenants=[TENANT], audience="some-other-api"
+    )
+    assert api.status("GET", "/pipelines", token=other, tenant=TENANT) == REJECTED
+
+
+def test_unknown_subject_gets_no_tenant_authority(api: Api, primary_idp: Issuer):
+    """A validly signed token for a subject with no membership and no trust."""
+    stranger = primary_idp.token("nobody-in-particular")
+    assert api.status("GET", "/tenant/users", token=stranger, tenant=TENANT) in (
+        401,
+        403,
+    )
+
+
+def test_tenant_the_token_does_not_name_is_refused(api: Api, primary_idp: Issuer):
+    """A token authorizes the tenants it names, not whichever one is asked for."""
+    token = primary_idp.token("reader", email="reader@example.com", tenants=[TENANT])
+    assert api.status("GET", "/pipelines", token=token, tenant="beta") in (401, 403)
+    # An unknown tenant must not be distinguishable from one that exists but is
+    # not authorized, or the header becomes a tenant-existence oracle.
+    unknown = api.status("GET", "/pipelines", token=token, tenant="no-such-tenant")
+    unauthorized = api.status("GET", "/pipelines", token=token, tenant="beta")
+    assert unknown == unauthorized, (
+        f"unknown tenant returned {unknown} and unauthorized returned "
+        f"{unauthorized}; differing codes let a caller enumerate tenant names"
+    )
+
+
+# Trust registration validation
+@pytest.mark.parametrize(
+    "body,reason",
+    [
+        pytest.param(
+            {"name": "", "issuer": "https://idp.example.com", "subject": "s"},
+            "empty name",
+            id="empty-name",
+        ),
+        pytest.param(
+            {"name": "empty-issuer", "issuer": "", "subject": "s"},
+            "empty issuer",
+            id="empty-issuer",
+        ),
+        pytest.param(
+            {
+                "name": "empty-subject",
+                "issuer": "https://idp.example.com",
+                "subject": "",
+            },
+            "empty subject",
+            id="empty-subject",
+        ),
+        pytest.param(
+            {
+                "name": "bad name with spaces",
+                "issuer": "https://idp.example.com",
+                "subject": "s",
+            },
+            "name outside the permitted character set",
+            id="name-charset",
+        ),
+        pytest.param(
+            {
+                "name": "owner-escalation",
+                "issuer": "https://idp.example.com",
+                "subject": "s",
+                "role": "owner",
+            },
+            "owner is deploy-time configuration",
+            id="owner-role",
+        ),
+    ],
+)
+def test_trust_registration_rejects_bad_input(
+    api: Api, primary_idp: Issuer, body: dict, reason: str
+):
+    admin = primary_idp.token("admin", email="admin@example.com", tenants=[TENANT])
+    status = api.status("POST", "/oidc_trust", token=admin, tenant=TENANT, body=body)
+    assert status == 400, f"expected 400 for {reason}, got {status}"
+
+
+def test_trust_audience_must_match_when_set(
+    api: Api, primary_idp: Issuer, workload_idp: Issuer
+):
+    """An audience on the trust is a filter, so a token missing it is refused."""
+    admin = primary_idp.token("admin", email="admin@example.com", tenants=[TENANT])
+    created = api.v0(
+        "POST",
+        "/oidc_trust",
+        token=admin,
+        tenant=TENANT,
+        body={
+            "name": "aud-scoped",
+            "issuer": workload_idp.url,
+            "subject": "aud-bot",
+            "audience": "a-specific-audience",
+            "role": "read",
+        },
+    )
+    assert created.status_code == 201, created.text
+
+    # The deployment's audience is not the trust's audience, so this is refused
+    # even though the subject and issuer both match.
+    wrong = workload_idp.token("aud-bot", audience=DEFAULT_AUDIENCE)
+    assert api.status("GET", "/pipelines", token=wrong, tenant=TENANT) in (401, 403)
+
+
+# `*` matches any run of characters, including an empty one; every other
+# character is literal. These pin both directions of that rule, because a
+# pattern looser than its author intended silently widens who a trust admits.
+#
+# A token is admitted if any trust in the tenant matches it, and several of the
+# patterns below are permissive enough to swallow other cases' subjects: `a*b`
+# takes anything starting `a` and ending `b`, `repo:**` anything starting
+# `repo:`. So each case prefixes its pattern and subject with its own name,
+# giving it a subject no other case can match. The prefix is literal and
+# identical on both sides, so it cannot change what is being measured.
+CLAIM_PATTERNS = [
+    # A star may match nothing, so the literals around it can sit together.
+    ("empty-run", "repo:acme/*", "repo:acme/", True),
+    ("empty-middle", "a*b", "ab", True),
+    # Adjacent stars demand no extra characters.
+    ("adjacent-stars", "repo:**", "repo:x", True),
+    # The tail is anchored separately, so a trailing literal cannot reuse
+    # characters an earlier one already consumed.
+    ("no-reuse", "a*a", "a", False),
+    # Nothing but `*` is special: these are not regex.
+    ("dot-is-literal", "repo:acme/a.c", "repo:acme/abc", False),
+    ("plus-is-literal", "repo:acme/a+", "repo:acme/aa", False),
+    ("bracket-is-literal", "repo:acme/[a]", "repo:acme/a", False),
+    # Matching is case-sensitive.
+    ("case-sensitive", "Repo:Acme/*", "repo:acme/api", False),
+    # A trailing star is a prefix match, so it admits anything that merely
+    # begins with the pattern. Pinned because it is the shape that surprises.
+    ("prefix-is-open-ended", "svc-a*", "svc-april-fools", True),
+    # A realistic pattern and the near misses around it. These matter more than
+    # the match: a pattern that is too eager grants a workload nobody meant to.
+    ("prefix-match", "repo:acme/*", "repo:acme/api", True),
+    ("extra-before-slash", "repo:acme/*", "repo:acmex/api", False),
+    ("missing-separator", "repo:acme/*", "repo:acme", False),
+    ("start-is-anchored", "repo:acme/*", "xrepo:acme/api", False),
+    ("wrong-case", "repo:acme/*", "repo:ACME/api", False),
+]
+
+
+def register_pattern_trust(
+    api: Api, admin: str, workload_idp: Issuer, name: str, subject: str, audience: str
+) -> None:
+    created = api.v0(
+        "POST",
+        "/oidc_trust",
+        token=admin,
+        tenant=TENANT,
+        body={
+            "name": name,
+            "issuer": workload_idp.url,
+            "subject": subject,
+            "audience": audience,
+            "role": "read",
+        },
+    )
+    assert created.status_code == 201, created.text
+
+
+@pytest.mark.parametrize(
+    "name,pattern,subject,should_match",
+    CLAIM_PATTERNS,
+    ids=[c[0] for c in CLAIM_PATTERNS],
+)
+def test_subject_pattern_semantics(
+    api: Api,
+    primary_idp: Issuer,
+    workload_idp: Issuer,
+    name: str,
+    pattern: str,
+    subject: str,
+    should_match: bool,
+):
+    admin = primary_idp.token("admin", email="admin@example.com", tenants=[TENANT])
+    ns = f"sub-{name}:"
+    register_pattern_trust(
+        api, admin, workload_idp, f"sub-{name}", ns + pattern, DEFAULT_AUDIENCE
+    )
+
+    status = api.status(
+        "GET", "/pipelines", token=workload_idp.token(ns + subject), tenant=TENANT
+    )
+    if should_match:
+        assert status == 200, f"{ns + subject!r} should match {ns + pattern!r}"
+    else:
+        assert status in (401, 403), f"{ns + subject!r} must not match {ns + pattern!r}"
+
+
+@pytest.mark.parametrize(
+    "name,pattern,audience,should_match",
+    CLAIM_PATTERNS,
+    ids=[c[0] for c in CLAIM_PATTERNS],
+)
+def test_audience_pattern_semantics(
+    api: Api,
+    primary_idp: Issuer,
+    workload_idp: Issuer,
+    name: str,
+    pattern: str,
+    audience: str,
+    should_match: bool,
+):
+    """The audience pattern is matched by the same rule as the subject.
+
+    Asserted separately because the audience is what keeps a trust from
+    admitting tokens minted for another service, so a loose pattern here has the
+    same consequence and the same corners.
+    """
+    admin = primary_idp.token("admin", email="admin@example.com", tenants=[TENANT])
+    ns = f"aud-{name}:"
+    subject = f"aud-bot-{name}"
+    register_pattern_trust(
+        api, admin, workload_idp, f"aud-{name}", subject, ns + pattern
+    )
+
+    status = api.status(
+        "GET",
+        "/pipelines",
+        token=workload_idp.token(subject, audience=ns + audience),
+        tenant=TENANT,
+    )
+    if should_match:
+        assert status == 200, (
+            f"audience {ns + audience!r} should match {ns + pattern!r}"
+        )
+    else:
+        assert status in (401, 403), (
+            f"audience {ns + audience!r} must not match {ns + pattern!r}"
+        )
+
+
+# Revocation
+
+
+def test_deleting_a_trust_revokes_its_access(
+    api: Api, primary_idp: Issuer, workload_idp: Issuer
+):
+    """Access granted by a trust ends when the trust does, and at once.
+
+    Granting is only half of a trust's life. Nothing else here proves the other
+    half, and a stale grant that outlives its record is the failure that matters:
+    an operator who revokes a workload has no other lever to pull.
+    """
+    admin = primary_idp.token("admin", email="admin@example.com", tenants=[TENANT])
+    subject = "revocable-bot"
+    register_pattern_trust(
+        api, admin, workload_idp, "revocable", subject, DEFAULT_AUDIENCE
+    )
+
+    token = workload_idp.token(subject)
+    assert api.status("GET", "/pipelines", token=token, tenant=TENANT) == 200
+
+    assert (
+        api.status("DELETE", "/oidc_trust/revocable", token=admin, tenant=TENANT) == 200
+    )
+
+    # The same token, unchanged and still unexpired, is now refused. No cache
+    # may keep it alive: the trust is consulted per request.
+    assert api.status("GET", "/pipelines", token=token, tenant=TENANT) in (401, 403)
+    # And the trust is gone from the tenant's list, not merely unmatched.
+    assert api.status("GET", "/oidc_trust/revocable", token=admin, tenant=TENANT) == 404
+
+
+def test_deleting_a_trust_leaves_the_others(
+    api: Api, primary_idp: Issuer, workload_idp: Issuer
+):
+    """Revoking one workload does not revoke its neighbours.
+
+    Both trusts name the same issuer, so this also covers the case where the
+    deleted one was the only reason to think that issuer interesting.
+    """
+    admin = primary_idp.token("admin", email="admin@example.com", tenants=[TENANT])
+    for name in ("neighbour-kept", "neighbour-dropped"):
+        register_pattern_trust(
+            api, admin, workload_idp, name, f"{name}-bot", DEFAULT_AUDIENCE
+        )
+
+    kept = workload_idp.token("neighbour-kept-bot")
+    dropped = workload_idp.token("neighbour-dropped-bot")
+    assert api.status("GET", "/pipelines", token=kept, tenant=TENANT) == 200
+    assert api.status("GET", "/pipelines", token=dropped, tenant=TENANT) == 200
+
+    assert (
+        api.status(
+            "DELETE", "/oidc_trust/neighbour-dropped", token=admin, tenant=TENANT
+        )
+        == 200
+    )
+
+    assert api.status("GET", "/pipelines", token=dropped, tenant=TENANT) in (401, 403)
+    assert api.status("GET", "/pipelines", token=kept, tenant=TENANT) == 200
+
+
+def test_deleting_an_absent_trust_is_not_found(api: Api, primary_idp: Issuer):
+    admin = primary_idp.token("admin", email="admin@example.com", tenants=[TENANT])
+    assert (
+        api.status("DELETE", "/oidc_trust/never-existed", token=admin, tenant=TENANT)
+        == 404
+    )
diff --git a/python/tests/platform_rbac/test_4_migration.py b/python/tests/platform_rbac/test_4_migration.py
new file mode 100644
index 00000000000..6154b01e007
--- /dev/null
+++ b/python/tests/platform_rbac/test_4_migration.py
@@ -0,0 +1,75 @@
+"""The operator upgrade path, run after everything else.
+
+Displacing a tenant name moves it off the tenant that holds the memberships the
+other modules provisioned, so this reshapes the installation and has to come
+last. It is a module of its own because file order is what pytest guarantees;
+being the last function in another file would not survive someone appending to
+it.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from .conftest import OWNER_EMAIL, TENANT, Api
+from .idp import Issuer
+from .test_1_scenarios import PIPELINE, PROGRAM, TENANT_PIPELINE, pipeline_program
+
+pytestmark = pytest.mark.rbac
+
+
+def test_11_operator_migrates_the_pre_auth_tenant(api: Api, primary_idp: Issuer):
+    """The upgrade path an operator takes.
+
+    Turning authentication on strands the pre-auth work in the tenant that
+    existed before it, while everyone's tokens name a tenant the first login
+    created. Renaming the old tenant onto that name reunites the two, and
+    `displace_existing` is what lets it take a name already in use. Nothing is
+    merged or deleted: the tenant that gives up the name keeps everything it had.
+
+    Displacing a name moves it off the tenant that holds the memberships every
+    earlier scenario provisioned, so doing it sooner would strip the admin of
+    the tenant it administers.
+    """
+    owner = primary_idp.token("owner", email=OWNER_EMAIL)
+    tenants = api.v0("GET", "/tenants", token=owner).json()
+
+    # The pre-auth tenant is the one still holding the pipeline from test_01,
+    # whatever it ended up being called.
+    pre_auth = next(
+        t
+        for t in tenants
+        if t["name"] != TENANT
+        and pipeline_program(api, PIPELINE, token=owner, tenant=t["id"]) == PROGRAM
+    )
+    displaced_id = next(t["id"] for t in tenants if t["name"] == TENANT)
+
+    # Taking a name already in use needs the displacement flag.
+    assert (
+        api.status(
+            "PATCH", f"/tenants/{pre_auth['id']}", token=owner, body={"name": TENANT}
+        )
+        == 409
+    )
+
+    renamed = api.v0(
+        "PATCH",
+        f"/tenants/{pre_auth['id']}",
+        token=owner,
+        body={"name": TENANT, "displace_existing": True},
+    )
+    assert renamed.status_code == 200, renamed.text
+    # The tenant that gave up the name is reported, not silently dropped.
+    assert renamed.json()["displaced"]["id"] == displaced_id
+
+    # The operator's goal: `acme` now resolves to the tenant holding the work
+    # that predates authentication.
+    admin = primary_idp.token("admin", email="admin@example.com", tenants=[TENANT])
+    assert api.status("GET", "/config/session", token=admin, tenant=TENANT) == 200
+    assert pipeline_program(api, PIPELINE, token=admin, tenant=TENANT) == PROGRAM
+
+    # And the displaced tenant kept everything it had.
+    assert (
+        pipeline_program(api, TENANT_PIPELINE, token=owner, tenant=displaced_id)
+        == PROGRAM
+    )
diff --git a/python/tests/platform_rbac/test_5_owner_revocation.py b/python/tests/platform_rbac/test_5_owner_revocation.py
new file mode 100644
index 00000000000..5e3d437e161
--- /dev/null
+++ b/python/tests/platform_rbac/test_5_owner_revocation.py
@@ -0,0 +1,84 @@
+"""Withdrawing platform ownership, the only way it can be withdrawn.
+
+`owner` is deploy-time configuration and never grantable through the API, so it
+is never revocable through the API either. The only lever is the configuration
+itself, which means revocation is a restart, and nothing else in this suite
+proves that lever works.
+
+This runs last. It hands the installation to a different owner, so every earlier
+module would lose the owner it depends on.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from .conftest import (
+    OWNER_EMAIL,
+    OWNER_TRUST_SUBJECT,
+    SUCCESSOR_EMAIL,
+    TENANT,
+    Api,
+    multi_tenant_auth,
+)
+from .idp import Issuer
+from .manager import Manager
+
+pytestmark = pytest.mark.rbac
+
+
+def test_owners_hold_the_platform_before_the_change(
+    api: Api, primary_idp: Issuer, workload_idp: Issuer
+):
+    """Both kinds of owner work, so the next test measures a change."""
+    assert (
+        api.status("GET", "/tenants", token=primary_idp.token("owner", email=OWNER_EMAIL))
+        == 200
+    )
+    assert (
+        api.status("GET", "/tenants", token=workload_idp.token(OWNER_TRUST_SUBJECT))
+        == 200
+    )
+
+
+def test_restarting_without_them_revokes_both(
+    manager: Manager, api: Api, primary_idp: Issuer, workload_idp: Issuer
+):
+    """A restart that stops naming an owner takes ownership away.
+
+    Both kinds go at once: the user named in `FELDERA_OWNERS` and the workload
+    named in `FELDERA_OWNER_TRUSTS`. Their tokens are unchanged and still valid,
+    which is the point -- nothing about the credential changed, only what the
+    installation is willing to say about it.
+    """
+    former_user = primary_idp.token("owner", email=OWNER_EMAIL)
+    former_workload = workload_idp.token(OWNER_TRUST_SUBJECT)
+
+    # Hand the installation to a different owner, and configure no owner trust.
+    manager.restart(multi_tenant_auth(primary_idp, owners=SUCCESSOR_EMAIL))
+
+    for name, token in (("user", former_user), ("workload", former_workload)):
+        status = api.status("GET", "/tenants", token=token)
+        assert status in (401, 403), f"the former owner {name} still reaches /tenants"
+        assert api.status("GET", "/config/owners", token=token) in (401, 403)
+
+    # The successor holds it instead, so this is a handover rather than an
+    # installation that has simply stopped answering.
+    successor = primary_idp.token("successor", email=SUCCESSOR_EMAIL)
+    assert api.status("GET", "/tenants", token=successor) == 200
+    assert api.status("GET", "/config/owners", token=successor) == 200
+
+
+def test_a_revoked_owner_keeps_its_tenant_membership(
+    api: Api, primary_idp: Issuer
+):
+    """Losing ownership is not losing the account.
+
+    A former owner that also holds a membership still acts in that tenant at the
+    role the membership gives it. Ownership is platform-wide and separate, so
+    withdrawing it must not disturb anything tenant-scoped.
+    """
+    admin = primary_idp.token("admin", email="admin@example.com", tenants=[TENANT])
+    assert api.status("GET", "/tenant/users", token=admin, tenant=TENANT) == 200
+    # And still cannot reach the platform routes, which is what it never had.
+    assert api.status("GET", "/tenants", token=admin, tenant=TENANT) == 403
diff --git a/scripts/rbac_demo.py b/scripts/rbac_demo.py
index 0e02d22c50e..1ad813a9958 100755
--- a/scripts/rbac_demo.py
+++ b/scripts/rbac_demo.py
@@ -23,8 +23,12 @@
   - mints tokens for four identities,
   - provisions them into one shared tenant ("acme") with roles read/write/admin,
   - leaves owner@example.com as the platform owner (from FELDERA_OWNERS),
-  - prints a ready-to-use token per role, and
-  - runs a request matrix showing what each role may and may not do.
+  - prints a ready-to-use token per role.
+
+It asserts nothing. The RBAC boundaries are covered by
+`python/tests/platform_rbac`, which owns the manager and can restart it under
+different authentication configurations; this script only sets a playground up
+so you can poke at it by hand.
 
 The four identities (all via the dummy IdP):
 
@@ -39,7 +43,7 @@
 
 import argparse
 import sys
-import time
+
 import requests
 
 TENANT_HEADER = "Feldera-Tenant"
@@ -134,99 +138,7 @@ def main() -> int:
             f"\n(owner acts in a tenant by adding the header: -H '{TENANT_HEADER}: {tenant}')"
         )
 
-    # 6. Verification matrix: each row is (role, method, path, expected, note).
-    #    `expected` is the status family we assert: 'ok' = not 403, 'deny' = 403.
-    print("\n" + "=" * 72)
-    print("VERIFICATION MATRIX (ok = 2xx; deny = 403 by RBAC; invalid = 400)")
-    print("=" * 72)
-    checks = [
-        ("read", "GET", "/pipelines", None, "ok", "monitor"),
-        ("read", "POST", "/pipelines", {"name": "x"}, "deny", "no mutate"),
-        ("read", "GET", "/tenant/users", None, "deny", "not admin"),
-        ("write", "GET", "/pipelines", None, "ok", "monitor"),
-        (
-            "write",
-            "POST",
-            "/api_keys",
-            {"name": "w1", "role": "read"},
-            "ok",
-            "mint read key",
-        ),
-        (
-            "write",
-            "POST",
-            "/api_keys",
-            {"name": "w2", "role": "admin"},
-            "deny",
-            "cannot mint admin key",
-        ),
-        ("write", "GET", "/tenant/users", None, "deny", "not admin"),
-        ("admin", "GET", "/tenant/users", None, "ok", "manage users"),
-        (
-            "admin",
-            "POST",
-            "/oidc_trust",
-            {
-                "name": "t1",
-                "issuer": "https://x",
-                "subject": "s",
-                "audience": "acme",
-                "role": "write",
-            },
-            "ok",
-            "create trust (write needs concrete audience)",
-        ),
-        (
-            "admin",
-            "POST",
-            "/oidc_trust",
-            {"name": "t2", "issuer": "https://x", "subject": "s", "role": "owner"},
-            "invalid",
-            "owner is configuration only",
-        ),
-        ("admin", "GET", "/tenants", None, "deny", "owner only"),
-        ("owner", "GET", "/tenants", None, "ok", "platform view"),
-        ("owner", "GET", "/tenant/users", None, "ok", "acts in tenant"),
-        ("admin", "GET", "/config/owners", None, "deny", "owner only"),
-        ("owner", "GET", "/config/owners", None, "ok", "who holds owner"),
-        # The configured owner trust, with no Feldera-Tenant header at all: this
-        # is how automation reaches the tenant routes on a fresh deployment,
-        # where there is no tenant to name yet.
-        ("ownertrust", "GET", "/tenants", None, "ok", "no header needed", None),
-        (
-            "ownertrust",
-            "POST",
-            "/tenants",
-            {"name": f"bootstrap-{int(time.time())}"},
-            "ok",
-            "creates a tenant with no header",
-            None,
-        ),
-    ]
-    passed = failed = 0
-    # A row carries (role, method, path, body, expected, note) and acts in
-    # `tenant`; a seventh element overrides the Feldera-Tenant header, where
-    # None means the request sends none.
-    for check in checks:
-        role, method, path, body, expected, note = check[:6]
-        tn = check[6] if len(check) > 6 else tenant
-        code, _ = call(m, method, path, tok[role], tenant=tn, body=body)
-        # ok = passed RBAC and the action succeeded (2xx); deny = blocked by RBAC
-        # (403); invalid = the request itself is not expressible (400). Anything
-        # else (401, 5xx) is an unexpected failure, not a pass.
-        good = (
-            (expected == "deny" and code == 403)
-            or (expected == "invalid" and code == 400)
-            or (expected == "ok" and 200 <= code < 300)
-        )
-        passed += good
-        failed += not good
-        mark = "PASS" if good else "FAIL"
-        print(
-            f"  [{mark}] {role:5} {method:4} {path:16} -> {code:3} (want {expected:4}; {note})"
-        )
-    print(f"\n{passed} passed, {failed} failed")
-    return 0 if failed == 0 else 2
+    return 0
 
 
 if __name__ == "__main__":

From 0d10fd94235eb5aec211bafaba096bc2a9947424 Mon Sep 17 00:00:00 2001
From: feldera-bot <feldera-bot@feldera.com>
Date: Fri, 31 Jul 2026 04:37:17 +0000
Subject: [PATCH 42/55] [ci] apply automatic fixes

Signed-off-by: feldera-bot <feldera-bot@feldera.com>
---
 crates/pipeline-manager/src/auth.rs                   | 4 +---
 python/tests/platform_rbac/test_5_owner_revocation.py | 8 ++++----
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/crates/pipeline-manager/src/auth.rs b/crates/pipeline-manager/src/auth.rs
index b70be847555..a45030d1e31 100644
--- a/crates/pipeline-manager/src/auth.rs
+++ b/crates/pipeline-manager/src/auth.rs
@@ -448,9 +448,7 @@ async fn oidc_trust_auth(
             };
             match tenant_matches.iter().find(|(t, _)| *t == selected).copied() {
                 Some(pair) => pair,
-                None => {
-                    return db_err(DBError::OidcTenantNotTrusted { tenant: selector }, req)
-                }
+                None => return db_err(DBError::OidcTenantNotTrusted { tenant: selector }, req),
             }
         }
         // Without a selector a single match is unambiguous; several are not.
diff --git a/python/tests/platform_rbac/test_5_owner_revocation.py b/python/tests/platform_rbac/test_5_owner_revocation.py
index 5e3d437e161..9142afcadb8 100644
--- a/python/tests/platform_rbac/test_5_owner_revocation.py
+++ b/python/tests/platform_rbac/test_5_owner_revocation.py
@@ -32,7 +32,9 @@ def test_owners_hold_the_platform_before_the_change(
 ):
     """Both kinds of owner work, so the next test measures a change."""
     assert (
-        api.status("GET", "/tenants", token=primary_idp.token("owner", email=OWNER_EMAIL))
+        api.status(
+            "GET", "/tenants", token=primary_idp.token("owner", email=OWNER_EMAIL)
+        )
         == 200
     )
     assert (
@@ -69,9 +71,7 @@ def test_restarting_without_them_revokes_both(
     assert api.status("GET", "/config/owners", token=successor) == 200
 
 
-def test_a_revoked_owner_keeps_its_tenant_membership(
-    api: Api, primary_idp: Issuer
-):
+def test_a_revoked_owner_keeps_its_tenant_membership(api: Api, primary_idp: Issuer):
     """Losing ownership is not losing the account.
 
     A former owner that also holds a membership still acts in that tenant at the

From 79688122be7f6e67ef0861a988f9e7e08b62579e Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Thu, 30 Jul 2026 23:05:21 -0700
Subject: [PATCH 43/55] [pipeline-manager] Restrict where a registered OIDC
 trust may point

The manager fetches a trust's issuer from its own network position before it
verifies any signature on the presented token, so registration decided an
outbound destination and only checked that the issuer was nonempty. A tenant
administrator could therefore name an internal service.

Registration now requires https, forbids embedded credentials, and rejects an
issuer whose literal address is not routable on the public internet. A hostname
is admitted here and checked again when the connection is made, because DNS can
change in between.

Issuers the operator names at deploy time are exempt, so a private IdP stays
supported; the rule covers what a tenant administrator can register.

An installation whose tenants federate against an IdP inside the manager's own
network lifts the address rule with --allow-internal-tenant-trust-issuers,
false by default. https is required either way, so the JWKS still arrives over
an authenticated channel. The policy travels as a parameter into the one
database operation every registration passes through, the way resolve_login
already takes the configured default and first-user roles.

The OIDC code moves into an oidc module: destination.rs for where a trust may
point, trust_name.rs for what it may be called. The address classification is
spelled out rather than taken from std, whose IpAddr::is_global is unstable.

The RBAC suite runs its issuers over https to match, from a local CA and the
localhost certificate it signs; a certificate cannot be both a trust root and
the certificate a server presents. The manager reaches them through
SSL_CERT_FILE, which means its OIDC client has to select rustls: reqwest
otherwise takes whichever TLS backend the target ships, and the macOS trust
store cannot be pointed elsewhere.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 .../src/api/endpoints/oidc_trust.rs           |   1 +
 crates/pipeline-manager/src/auth.rs           |   6 +
 crates/pipeline-manager/src/config.rs         |  26 ++
 crates/pipeline-manager/src/db/error.rs       |  12 +
 .../src/db/operations/oidc_trust.rs           |  12 +-
 crates/pipeline-manager/src/db/storage.rs     |   6 +
 .../src/db/storage_postgres.rs                |   3 +
 crates/pipeline-manager/src/db/test.rs        | 108 +++++++-
 crates/pipeline-manager/src/db/types/utils.rs |  20 +-
 crates/pipeline-manager/src/lib.rs            |   1 +
 crates/pipeline-manager/src/oidc.rs           |   4 +
 .../pipeline-manager/src/oidc/destination.rs  | 241 ++++++++++++++++++
 .../pipeline-manager/src/oidc/trust_name.rs   |  18 ++
 python/tests/platform_rbac/conftest.py        |  32 ++-
 python/tests/platform_rbac/idp.py             |  41 ++-
 python/tests/platform_rbac/manager.py         | 106 +++++---
 python/tests/platform_rbac/test_3_negative.py |  23 +-
 scripts/dummy_oidc.py                         |  19 +-
 18 files changed, 605 insertions(+), 74 deletions(-)
 create mode 100644 crates/pipeline-manager/src/oidc.rs
 create mode 100644 crates/pipeline-manager/src/oidc/destination.rs
 create mode 100644 crates/pipeline-manager/src/oidc/trust_name.rs

diff --git a/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs b/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
index 82b2c850cb1..e5ffbef7ab6 100644
--- a/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
+++ b/crates/pipeline-manager/src/api/endpoints/oidc_trust.rs
@@ -178,6 +178,7 @@ pub(crate) async fn post_oidc_trust(
             &body.subject,
             body.audience.as_deref(),
             requested,
+            state.config.tenant_issuer_policy(),
         )
         .await?;
     info!(
diff --git a/crates/pipeline-manager/src/auth.rs b/crates/pipeline-manager/src/auth.rs
index a45030d1e31..13a8b9d8583 100644
--- a/crates/pipeline-manager/src/auth.rs
+++ b/crates/pipeline-manager/src/auth.rs
@@ -886,6 +886,11 @@ const OIDC_FETCH_TIMEOUT_SECONDS: u64 = 10;
 /// issuer endpoint (defense in depth behind the trusted-issuer gate).
 fn oidc_http_client() -> Result<reqwest::Client, reqwest::Error> {
     reqwest::Client::builder()
+        // rustls with the platform's roots, so which certificates an issuer may
+        // present is decided the same way on every platform. The default
+        // backend is whatever the target ships, and on macOS that store cannot
+        // be pointed elsewhere.
+        .use_rustls_tls()
         .timeout(Duration::from_secs(OIDC_FETCH_TIMEOUT_SECONDS))
         .redirect(reqwest::redirect::Policy::none())
         .build()
@@ -1576,6 +1581,7 @@ mod test {
             auth_audience: "feldera-api".to_string(),
             owners: vec![],
             owner_trusts: crate::config::OwnerTrusts::default(),
+            allow_internal_tenant_trust_issuers: false,
             default_role: Role::Read,
             first_user_role: Role::Admin,
         };
diff --git a/crates/pipeline-manager/src/config.rs b/crates/pipeline-manager/src/config.rs
index 478d6ce6b1d..d3e4d064055 100644
--- a/crates/pipeline-manager/src/config.rs
+++ b/crates/pipeline-manager/src/config.rs
@@ -4,6 +4,7 @@ use crate::db::types::role::Role;
 use crate::db::types::version::Version;
 use crate::db::{error::DBError, types::pipeline::PipelineId};
 use crate::has_unstable_feature;
+use crate::oidc::destination::TenantIssuerPolicy;
 use actix_web::http::header;
 use anyhow::{Error as AnyError, Result as AnyResult};
 use clap::Parser;
@@ -1007,6 +1008,21 @@ pub struct ApiServerConfig {
     #[arg(long, default_value = "[]", env = "FELDERA_OWNER_TRUSTS")]
     pub owner_trusts: OwnerTrusts,
 
+    /// Permit a trust registered through the API to name an issuer on a private
+    /// or loopback address. Default: `false`.
+    ///
+    /// The manager fetches a trust's issuer from its own network position
+    /// before it verifies any token: in installations where tenant admins are
+    /// allowed and need to point to local issuers, set this to true. Not
+    /// permitted by default, so tenant admins cannot steer the manager to fetch
+    /// internal service locations. https is required either way.
+    ///
+    /// Issuers named at deploy time, the login provider and `--owner-trusts`,
+    /// are unaffected: they may sit on a private network either way.
+    #[serde(default)]
+    #[arg(long, action = clap::ArgAction::Set, default_value_t = false, env = "FELDERA_ALLOW_INTERNAL_TENANT_TRUST_ISSUERS")]
+    pub allow_internal_tenant_trust_issuers: bool,
+
     /// Role assigned to an authenticated user who has no explicit tenant
     /// membership yet. Must be `read` or `write`. Default: `read`.
     #[serde(default = "default_default_role")]
@@ -1096,6 +1112,15 @@ impl FromStr for OwnerTrusts {
 }
 
 impl ApiServerConfig {
+    /// Where a trust registered through the API may point.
+    pub(crate) fn tenant_issuer_policy(&self) -> TenantIssuerPolicy {
+        if self.allow_internal_tenant_trust_issuers {
+            TenantIssuerPolicy::AllowInternal
+        } else {
+            TenantIssuerPolicy::PublicHttpsOnly
+        }
+    }
+
     /// CORS configuration
     pub(crate) fn cors(&self) -> actix_cors::Cors {
         if self.dev_mode {
@@ -1142,6 +1167,7 @@ impl ApiServerConfig {
             auth_audience: "feldera-api".to_string(),
             owners: vec![],
             owner_trusts: OwnerTrusts::default(),
+            allow_internal_tenant_trust_issuers: false,
             default_role: Role::Read,
             first_user_role: Role::Admin,
         }
diff --git a/crates/pipeline-manager/src/db/error.rs b/crates/pipeline-manager/src/db/error.rs
index f323235634f..ba914cb803d 100644
--- a/crates/pipeline-manager/src/db/error.rs
+++ b/crates/pipeline-manager/src/db/error.rs
@@ -164,6 +164,10 @@ pub enum DBError {
     EmptyOidcTrustField {
         field: String,
     },
+    InvalidOidcIssuerUrl {
+        issuer: String,
+        reason: String,
+    },
     AmbiguousOidcTenant,
     OidcTenantNotTrusted {
         tenant: String,
@@ -687,6 +691,12 @@ impl Display for DBError {
                     "OIDC trust relationship field '{field}' must not be empty"
                 )
             }
+            DBError::InvalidOidcIssuerUrl { issuer, reason } => {
+                write!(
+                    f,
+                    "OIDC trust issuer '{issuer}' is not a permitted destination: {reason}"
+                )
+            }
             DBError::AmbiguousOidcTenant => {
                 write!(
                     f,
@@ -1007,6 +1017,7 @@ impl DetailedError for DBError {
             Self::UnknownUser { .. } => Cow::from("UnknownUser"),
             Self::UnknownOidcTrust { .. } => Cow::from("UnknownOidcTrust"),
             Self::EmptyOidcTrustField { .. } => Cow::from("EmptyOidcTrustField"),
+            Self::InvalidOidcIssuerUrl { .. } => Cow::from("InvalidOidcIssuerUrl"),
             Self::AmbiguousOidcTenant => Cow::from("AmbiguousOidcTenant"),
             Self::OidcTenantNotTrusted { .. } => Cow::from("OidcTenantNotTrusted"),
             Self::InvalidOidcToken { .. } => Cow::from("InvalidOidcToken"),
@@ -1134,6 +1145,7 @@ impl ResponseError for DBError {
             Self::UnknownUser { .. } => StatusCode::NOT_FOUND,
             Self::UnknownOidcTrust { .. } => StatusCode::NOT_FOUND,
             Self::EmptyOidcTrustField { .. } => StatusCode::BAD_REQUEST,
+            Self::InvalidOidcIssuerUrl { .. } => StatusCode::BAD_REQUEST,
             Self::AmbiguousOidcTenant => StatusCode::BAD_REQUEST,
             Self::OidcTenantNotTrusted { .. } => StatusCode::FORBIDDEN,
             Self::InvalidOidcToken { .. } => StatusCode::UNAUTHORIZED,
diff --git a/crates/pipeline-manager/src/db/operations/oidc_trust.rs b/crates/pipeline-manager/src/db/operations/oidc_trust.rs
index 8fdb8a75bce..69a5f13f974 100644
--- a/crates/pipeline-manager/src/db/operations/oidc_trust.rs
+++ b/crates/pipeline-manager/src/db/operations/oidc_trust.rs
@@ -5,7 +5,8 @@ use crate::db::operations::utils::{
 use crate::db::types::oidc_trust::{claim_matches, OidcTrustDescr, OidcTrustId};
 use crate::db::types::role::Role;
 use crate::db::types::tenant::TenantId;
-use crate::db::types::utils::validate_oidc_trust_name;
+use crate::oidc::destination::{validate_tenant_oidc_url, TenantIssuerPolicy};
+use crate::oidc::trust_name::validate_oidc_trust_name;
 use deadpool_postgres::Transaction;
 use std::str::FromStr;
 use uuid::Uuid;
@@ -97,6 +98,7 @@ pub async fn create_oidc_trust(
     subject: &str,
     audience: Option<&str>,
     role: Role,
+    issuer_policy: TenantIssuerPolicy,
 ) -> Result<(), DBError> {
     validate_oidc_trust_name(name)?;
     if issuer.is_empty() {
@@ -104,6 +106,14 @@ pub async fn create_oidc_trust(
             field: "issuer".to_string(),
         });
     }
+    // The manager fetches this issuer from its own network position before it
+    // verifies any signature, so a registration may not name an internal
+    // service unless the operator permits it. A hostname is checked again when
+    // the connection is made.
+    validate_tenant_oidc_url(issuer, issuer_policy).map_err(|e| DBError::InvalidOidcIssuerUrl {
+        issuer: issuer.to_string(),
+        reason: e.to_string(),
+    })?;
     if subject.is_empty() {
         return Err(DBError::EmptyOidcTrustField {
             field: "subject".to_string(),
diff --git a/crates/pipeline-manager/src/db/storage.rs b/crates/pipeline-manager/src/db/storage.rs
index 1054dc33e29..2930734a0ee 100644
--- a/crates/pipeline-manager/src/db/storage.rs
+++ b/crates/pipeline-manager/src/db/storage.rs
@@ -16,6 +16,7 @@ use crate::db::types::role::{MintableKeyRole, Role};
 use crate::db::types::tenant::TenantId;
 use crate::db::types::user::{TenantInfo, TenantMember, UserId};
 use crate::db::types::version::Version;
+use crate::oidc::destination::TenantIssuerPolicy;
 use async_trait::async_trait;
 use feldera_types::error::ErrorResponse;
 use feldera_types::runtime_status::{BootstrapConfig, RuntimeDesiredStatus, RuntimeStatus};
@@ -225,6 +226,10 @@ pub(crate) trait Storage {
 
     /// Persists a new trust relationship. `tenant_id` is `None` for a
     /// platform-wide owner trust, `Some` for a tenant-scoped one.
+    ///
+    /// `issuer_policy` is deploy-time configuration, like the roles
+    /// `resolve_login` takes: it decides whether this issuer may name an
+    /// address inside the manager's network.
     #[allow(clippy::too_many_arguments)]
     async fn create_oidc_trust(
         &self,
@@ -236,6 +241,7 @@ pub(crate) trait Storage {
         subject: &str,
         audience: Option<&str>,
         role: Role,
+        issuer_policy: TenantIssuerPolicy,
     ) -> Result<(), DBError>;
 
     /// Whether at least one trust relationship names this issuer. Called before
diff --git a/crates/pipeline-manager/src/db/storage_postgres.rs b/crates/pipeline-manager/src/db/storage_postgres.rs
index 6fa52fd7aec..eff8cd1a0e1 100644
--- a/crates/pipeline-manager/src/db/storage_postgres.rs
+++ b/crates/pipeline-manager/src/db/storage_postgres.rs
@@ -27,6 +27,7 @@ use crate::db::types::tenant::TenantId;
 use crate::db::types::user::{TenantInfo, TenantMember, UserId};
 use crate::db::types::version::Version;
 use crate::is_supported_runtime;
+use crate::oidc::destination::TenantIssuerPolicy;
 use crate::{auth::TenantRecord, config::DatabaseConfig};
 use async_trait::async_trait;
 use deadpool_postgres::{Manager, Pool, RecyclingMethod};
@@ -353,6 +354,7 @@ impl Storage for StoragePostgres {
         subject: &str,
         audience: Option<&str>,
         role: Role,
+        issuer_policy: TenantIssuerPolicy,
     ) -> Result<(), DBError> {
         let mut client = self.pool.get().await?;
         let txn = client.transaction().await?;
@@ -366,6 +368,7 @@ impl Storage for StoragePostgres {
             subject,
             audience,
             role,
+            issuer_policy,
         )
         .await?;
         txn.commit().await?;
diff --git a/crates/pipeline-manager/src/db/test.rs b/crates/pipeline-manager/src/db/test.rs
index 0119af0d6f8..0e05f3bd0df 100644
--- a/crates/pipeline-manager/src/db/test.rs
+++ b/crates/pipeline-manager/src/db/test.rs
@@ -30,11 +30,13 @@ use crate::db::types::storage::{validate_storage_status_transition, StorageStatu
 use crate::db::types::tenant::TenantId;
 use crate::db::types::user::{TenantInfo, TenantMember, UserId};
 use crate::db::types::utils::{
-    validate_api_key_name, validate_deployment_config, validate_oidc_trust_name,
-    validate_pipeline_name, validate_program_config, validate_program_info,
-    validate_runtime_config, validate_storage_status_details, MAXIMUM_TAG_LENGTH,
+    validate_api_key_name, validate_deployment_config, validate_pipeline_name,
+    validate_program_config, validate_program_info, validate_runtime_config,
+    validate_storage_status_details, MAXIMUM_TAG_LENGTH,
 };
 use crate::db::types::version::Version;
+use crate::oidc::destination::{validate_tenant_oidc_url, TenantIssuerPolicy};
+use crate::oidc::trust_name::validate_oidc_trust_name;
 use async_trait::async_trait;
 use chrono::{TimeZone, Utc};
 use feldera_types::checkpoint::CheckpointMetadata;
@@ -1286,6 +1288,91 @@ async fn rbac_login_resolution_and_membership() {
 /// before any fetch, an optional audience narrows candidates, and a token
 /// trusted by several tenants returns all of them (the caller disambiguates via
 /// the Feldera-Tenant header, verified at the auth layer).
+/// A registered issuer becomes a fetch destination before any signature is
+/// verified, so registration refuses one that names an internal service unless
+/// the operator permits it.
+#[tokio::test]
+async fn oidc_trust_rejects_an_unreachable_issuer() {
+    let handle = test_setup().await;
+    let tenant_id = handle
+        .db
+        .resolve_login(
+            Uuid::now_v7(),
+            Uuid::now_v7(),
+            "acme".to_string(),
+            "prov".to_string(),
+            "admin".to_string(),
+            None,
+            Role::Read,
+            Role::Admin,
+        )
+        .await
+        .unwrap()
+        .0;
+
+    let register = |name: &'static str, issuer: &'static str, policy: TenantIssuerPolicy| {
+        let db = &handle.db;
+        async move {
+            db.create_oidc_trust(
+                tenant_id,
+                Uuid::now_v7(),
+                name,
+                None,
+                issuer,
+                "sub",
+                None,
+                Role::Read,
+                policy,
+            )
+            .await
+        }
+    };
+
+    for issuer in [
+        "http://idp.example",             // not https
+        "https://169.254.169.254/latest", // cloud metadata service
+        "https://127.0.0.1:9876",         // loopback
+        "https://10.0.0.5",               // private network
+        "https://user:pw@idp.example",    // embedded credentials
+        "idp.example",                    // not a URL
+    ] {
+        let created = register("refused", issuer, TenantIssuerPolicy::PublicHttpsOnly).await;
+        assert!(
+            matches!(created, Err(DBError::InvalidOidcIssuerUrl { .. })),
+            "issuer '{issuer}' must be refused, got {created:?}"
+        );
+    }
+
+    // The escape hatch admits an internal address and nothing else: the same
+    // registration over http still fails.
+    register(
+        "internal",
+        "https://10.0.0.5",
+        TenantIssuerPolicy::AllowInternal,
+    )
+    .await
+    .unwrap();
+    let plaintext = register(
+        "plaintext",
+        "http://idp.example",
+        TenantIssuerPolicy::AllowInternal,
+    )
+    .await;
+    assert!(matches!(
+        plaintext,
+        Err(DBError::InvalidOidcIssuerUrl { .. })
+    ));
+
+    // A public https issuer is accepted either way.
+    register(
+        "public",
+        "https://token.actions.githubusercontent.com",
+        TenantIssuerPolicy::PublicHttpsOnly,
+    )
+    .await
+    .unwrap();
+}
+
 #[tokio::test]
 async fn oidc_trust_matching_and_issuer_gate() {
     let handle = test_setup().await;
@@ -1334,6 +1421,7 @@ async fn oidc_trust_matching_and_issuer_gate() {
             sub,
             Some("a"),
             Role::Write,
+            TenantIssuerPolicy::PublicHttpsOnly,
         )
         .await
         .unwrap();
@@ -1348,6 +1436,7 @@ async fn oidc_trust_matching_and_issuer_gate() {
             sub,
             Some("b"),
             Role::Write,
+            TenantIssuerPolicy::PublicHttpsOnly,
         )
         .await
         .unwrap();
@@ -1393,6 +1482,7 @@ async fn oidc_trust_matching_and_issuer_gate() {
             sub,
             None,
             Role::Read,
+            TenantIssuerPolicy::PublicHttpsOnly,
         )
         .await
         .unwrap();
@@ -1417,7 +1507,8 @@ async fn oidc_trust_matching_and_issuer_gate() {
             "https://owner.example",
             "root",
             None,
-            Role::Owner
+            Role::Owner,
+            TenantIssuerPolicy::PublicHttpsOnly,
         )
         .await
         .is_err());
@@ -3910,6 +4001,7 @@ async fn check_rbac_action(
                     &subject,
                     audience.as_deref(),
                     role,
+                    TenantIssuerPolicy::PublicHttpsOnly,
                 )
                 .await;
             let impl_response = handle
@@ -3923,6 +4015,7 @@ async fn check_rbac_action(
                     &subject,
                     audience.as_deref(),
                     role,
+                    TenantIssuerPolicy::PublicHttpsOnly,
                 )
                 .await;
             check_responses(i, model_response, impl_response);
@@ -5845,6 +5938,7 @@ impl Storage for Mutex<DbModel> {
         subject: &str,
         audience: Option<&str>,
         role: Role,
+        issuer_policy: TenantIssuerPolicy,
     ) -> DBResult<()> {
         validate_oidc_trust_name(name)?;
         if issuer.is_empty() {
@@ -5852,6 +5946,12 @@ impl Storage for Mutex<DbModel> {
                 field: "issuer".to_string(),
             });
         }
+        validate_tenant_oidc_url(issuer, issuer_policy).map_err(|e| {
+            DBError::InvalidOidcIssuerUrl {
+                issuer: issuer.to_string(),
+                reason: e.to_string(),
+            }
+        })?;
         if subject.is_empty() {
             return Err(DBError::EmptyOidcTrustField {
                 field: "subject".to_string(),
diff --git a/crates/pipeline-manager/src/db/types/utils.rs b/crates/pipeline-manager/src/db/types/utils.rs
index 258b0915cd4..e6387ac3d31 100644
--- a/crates/pipeline-manager/src/db/types/utils.rs
+++ b/crates/pipeline-manager/src/db/types/utils.rs
@@ -13,10 +13,11 @@ use tracing::error;
 
 /// Pattern for non-empty string containing lowercase (a-z), uppercase (A-Z),
 /// number (0-9), underscore (_) or hyphen (-) characters.
-const PATTERN_NON_EMPTY_ALPHANUMERIC_UNDERSCORE_HYPHEN: &str = r"^[a-zA-Z0-9_-]+$";
+pub(crate) const PATTERN_NON_EMPTY_ALPHANUMERIC_UNDERSCORE_HYPHEN: &str = r"^[a-zA-Z0-9_-]+$";
 
 /// Description of the non-empty alphanumeric-underscore-hyphen pattern.
-const PATTERN_NON_EMPTY_ALPHANUMERIC_UNDERSCORE_HYPHEN_DESCRIPTION: &str = "be non-empty and only \
+pub(crate) const PATTERN_NON_EMPTY_ALPHANUMERIC_UNDERSCORE_HYPHEN_DESCRIPTION: &str =
+    "be non-empty and only \
 contain lowercase (a-z), uppercase (A-Z), number (0-9), underscore (_) or hyphen (-) characters";
 
 /// The pattern is almost the same as for Kubernetes label values but slightly stricter.
@@ -61,19 +62,6 @@ pub fn validate_pipeline_name(name: &str) -> Result<(), DBError> {
     )
 }
 
-/// Maximum OIDC trust relationship name length.
-pub(crate) const MAXIMUM_OIDC_TRUST_NAME_LENGTH: usize = 100;
-
-/// Checks the provided OIDC trust relationship name is valid.
-pub fn validate_oidc_trust_name(name: &str) -> Result<(), DBError> {
-    validate_name(
-        name,
-        MAXIMUM_OIDC_TRUST_NAME_LENGTH,
-        PATTERN_NON_EMPTY_ALPHANUMERIC_UNDERSCORE_HYPHEN,
-        PATTERN_NON_EMPTY_ALPHANUMERIC_UNDERSCORE_HYPHEN_DESCRIPTION,
-    )
-}
-
 /// Checks the provided connector name is valid.
 pub fn validate_connector_name(name: &str) -> Result<(), DBError> {
     validate_name(
@@ -103,7 +91,7 @@ pub const MAXIMUM_DESCRIPTION_LENGTH: usize = 300;
 /// - It cannot be empty
 /// - It must be at most `length_limit` characters long
 /// - It must contain characters that follow the `pattern`
-fn validate_name(
+pub(crate) fn validate_name(
     name: &str,
     length_limit: usize,
     pattern: &str,
diff --git a/crates/pipeline-manager/src/lib.rs b/crates/pipeline-manager/src/lib.rs
index 961aa537a59..c8e3a826553 100644
--- a/crates/pipeline-manager/src/lib.rs
+++ b/crates/pipeline-manager/src/lib.rs
@@ -15,6 +15,7 @@ pub mod error;
 pub mod events_cleaner;
 pub mod license;
 pub mod logging;
+pub mod oidc;
 pub mod pipeline_env;
 pub mod runner;
 
diff --git a/crates/pipeline-manager/src/oidc.rs b/crates/pipeline-manager/src/oidc.rs
new file mode 100644
index 00000000000..db8fd2fe864
--- /dev/null
+++ b/crates/pipeline-manager/src/oidc.rs
@@ -0,0 +1,4 @@
+//! OIDC identity: what the platform trusts, and where it will go to check it.
+
+pub mod destination;
+pub mod trust_name;
diff --git a/crates/pipeline-manager/src/oidc/destination.rs b/crates/pipeline-manager/src/oidc/destination.rs
new file mode 100644
index 00000000000..fa5e4148d30
--- /dev/null
+++ b/crates/pipeline-manager/src/oidc/destination.rs
@@ -0,0 +1,241 @@
+//! Destination policy for OIDC discovery and JWKS fetches.
+//!
+//! A tenant administrator registers an issuer URL that the pipeline manager
+//! later fetches from its own network position, before any signature on the
+//! presented token is verified. Without a policy, registering a trust is a
+//! server-side request primitive aimed at whatever the manager can reach.
+//!
+//! Issuers the operator names at deploy time, the login provider and the owner
+//! trusts, are exempt: the authority that chooses them also chooses the network
+//! the manager runs in, so a private IdP stays supported. The policy applies to
+//! what a tenant administrator can register, which is the surface an attacker
+//! controls.
+//!
+//! An installation whose tenants federate against an IdP inside that same
+//! network lifts the policy with `--allow-internal-tenant-trust-issuers`.
+
+use std::fmt;
+use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
+use url::{Host, Url};
+
+/// Where a tenant-registered issuer may point.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum TenantIssuerPolicy {
+    /// Require https and an address routable on the public internet.
+    PublicHttpsOnly,
+    /// Permit private, loopback and link-local addresses, for an installation
+    /// whose IdP is not reachable from the public internet. https is still
+    /// required, so the JWKS is still fetched over an authenticated channel.
+    ///
+    /// This gives every tenant administrator a fetch aimed at the manager's own
+    /// network, so it is worth it only where that network is already trusted.
+    AllowInternal,
+}
+
+/// Why an issuer or `jwks_uri` URL is not a permitted fetch destination.
+#[derive(Debug, PartialEq, Eq)]
+pub enum OidcUrlError {
+    Malformed(String),
+    NotHttps(String),
+    HasCredentials,
+    NoHost,
+    PrivateAddress(IpAddr),
+}
+
+impl fmt::Display for OidcUrlError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Malformed(e) => write!(f, "not a valid URL: {e}"),
+            Self::NotHttps(scheme) => {
+                write!(f, "scheme must be https, found '{scheme}'")
+            }
+            Self::HasCredentials => f.write_str("must not embed a username or password"),
+            Self::NoHost => f.write_str("must name a host"),
+            Self::PrivateAddress(ip) => {
+                write!(f, "address {ip} is not reachable on the public internet")
+            }
+        }
+    }
+}
+
+/// Whether `ip` is routable on the public internet.
+///
+/// Rejects the ranges an SSRF probe aims at, including link-local, which is
+/// where the cloud metadata service at 169.254.169.254 lives.
+pub fn is_public_ip(ip: IpAddr) -> bool {
+    match ip {
+        IpAddr::V4(v4) => is_public_ipv4(v4),
+        IpAddr::V6(v6) => is_public_ipv6(v6),
+    }
+}
+
+// `IpAddr::is_global` answers this in std, but it is still unstable (rust issue
+// 27709), so the ranges are spelled out below.
+fn is_public_ipv4(ip: Ipv4Addr) -> bool {
+    let [a, b, _, _] = ip.octets();
+    !(ip.is_loopback()
+        || ip.is_private()
+        || ip.is_link_local()
+        || ip.is_broadcast()
+        || ip.is_documentation()
+        || ip.is_unspecified()
+        || ip.is_multicast()
+        || a == 0                                // 0.0.0.0/8, "this network"
+        || (a == 100 && (64..128).contains(&b))  // 100.64.0.0/10, carrier-grade NAT
+        || (a == 198 && (18..20).contains(&b))   // 198.18.0.0/15, benchmarking
+        || a >= 240) // 240.0.0.0/4, reserved
+}
+
+fn is_public_ipv6(ip: Ipv6Addr) -> bool {
+    // `::ffff:a.b.c.d` and `::a.b.c.d` reach an IPv4 destination, so they are
+    // judged by the IPv4 rules rather than treated as opaque IPv6.
+    if let Some(v4) = ip.to_ipv4() {
+        return is_public_ipv4(v4);
+    }
+    let first_segment = ip.segments()[0];
+    !(ip.is_loopback()
+        || ip.is_unspecified()
+        || ip.is_multicast()
+        || (first_segment & 0xfe00) == 0xfc00   // fc00::/7, unique local
+        || (first_segment & 0xffc0) == 0xfe80) // fe80::/10, link-local unicast
+}
+
+/// Validate a URL the platform would fetch on behalf of a tenant-registered
+/// trust: the issuer at registration, and the `jwks_uri` its discovery document
+/// returns.
+///
+/// Checks what holds regardless of DNS. A hostname's addresses are checked
+/// again when the connection is made, because DNS can change in between.
+pub fn validate_tenant_oidc_url(url: &str, policy: TenantIssuerPolicy) -> Result<(), OidcUrlError> {
+    let parsed = Url::parse(url).map_err(|e| OidcUrlError::Malformed(e.to_string()))?;
+    if parsed.scheme() != "https" {
+        return Err(OidcUrlError::NotHttps(parsed.scheme().to_string()));
+    }
+    if !parsed.username().is_empty() || parsed.password().is_some() {
+        return Err(OidcUrlError::HasCredentials);
+    }
+    let host = parsed.host().ok_or(OidcUrlError::NoHost)?;
+    // The policy governs which addresses are permitted. https and the absence
+    // of embedded credentials are required either way.
+    if policy == TenantIssuerPolicy::AllowInternal {
+        return Ok(());
+    }
+    match host {
+        Host::Ipv4(v4) if !is_public_ipv4(v4) => Err(OidcUrlError::PrivateAddress(IpAddr::V4(v4))),
+        Host::Ipv6(v6) if !is_public_ipv6(v6) => Err(OidcUrlError::PrivateAddress(IpAddr::V6(v6))),
+        _ => Ok(()),
+    }
+}
+
+#[cfg(test)]
+mod test {
+    use super::*;
+    use std::str::FromStr;
+
+    fn public(ip: &str) -> bool {
+        is_public_ip(IpAddr::from_str(ip).unwrap())
+    }
+
+    /// Validate under the default policy, which is what almost every case here
+    /// is about.
+    fn validate(url: &str) -> Result<(), OidcUrlError> {
+        validate_tenant_oidc_url(url, TenantIssuerPolicy::PublicHttpsOnly)
+    }
+
+    #[test]
+    fn private_and_reserved_addresses_are_not_public() {
+        for ip in [
+            "127.0.0.1",
+            "10.1.2.3",
+            "172.16.0.1",
+            "192.168.1.1",
+            "169.254.169.254", // cloud metadata service
+            "0.0.0.0",
+            "100.64.0.1",
+            "198.18.0.1",
+            "255.255.255.255",
+            "240.0.0.1",
+            "224.0.0.1",
+            "::1",
+            "::",
+            "fd00::1",
+            "fe80::1",
+            "::ffff:127.0.0.1",
+            "::ffff:10.0.0.1",
+        ] {
+            assert!(!public(ip), "{ip} must not count as public");
+        }
+    }
+
+    #[test]
+    fn routable_addresses_are_public() {
+        for ip in ["8.8.8.8", "1.1.1.1", "93.184.216.34", "2606:4700::1111"] {
+            assert!(public(ip), "{ip} must count as public");
+        }
+    }
+
+    #[test]
+    fn tenant_urls_must_be_https_without_credentials() {
+        assert!(validate("https://accounts.google.com").is_ok());
+        assert!(validate("https://token.actions.githubusercontent.com").is_ok());
+
+        assert_eq!(
+            validate("http://accounts.google.com"),
+            Err(OidcUrlError::NotHttps("http".to_string()))
+        );
+        assert_eq!(
+            validate("https://user:pw@idp.example.com"),
+            Err(OidcUrlError::HasCredentials)
+        );
+        assert!(matches!(
+            validate("not a url"),
+            Err(OidcUrlError::Malformed(_))
+        ));
+    }
+
+    #[test]
+    fn tenant_urls_may_not_name_an_internal_address() {
+        for url in INTERNAL_URLS {
+            assert!(
+                matches!(validate(url), Err(OidcUrlError::PrivateAddress(_))),
+                "{url} must be rejected"
+            );
+        }
+    }
+
+    const INTERNAL_URLS: [&str; 5] = [
+        "https://127.0.0.1/idp",
+        "https://169.254.169.254/latest/meta-data",
+        "https://10.0.0.5:8080",
+        "https://[::1]:9876",
+        "https://[fd00::1]",
+    ];
+
+    /// The escape hatch lifts the address rule and nothing else.
+    #[test]
+    fn allowing_internal_issuers_still_requires_https() {
+        let permissive = |url| validate_tenant_oidc_url(url, TenantIssuerPolicy::AllowInternal);
+        for url in INTERNAL_URLS {
+            assert!(permissive(url).is_ok(), "{url} must be admitted");
+        }
+        assert_eq!(
+            permissive("http://10.0.0.5"),
+            Err(OidcUrlError::NotHttps("http".to_string()))
+        );
+        assert_eq!(
+            permissive("https://user:pw@10.0.0.5"),
+            Err(OidcUrlError::HasCredentials)
+        );
+        assert!(matches!(
+            permissive("not a url"),
+            Err(OidcUrlError::Malformed(_))
+        ));
+    }
+
+    /// A hostname is admitted here and judged again at connect time, so that a
+    /// name resolving to an internal address is not silently trusted.
+    #[test]
+    fn a_hostname_passes_static_validation() {
+        assert!(validate("https://internal.corp.example").is_ok());
+    }
+}
diff --git a/crates/pipeline-manager/src/oidc/trust_name.rs b/crates/pipeline-manager/src/oidc/trust_name.rs
new file mode 100644
index 00000000000..a1abfd5673d
--- /dev/null
+++ b/crates/pipeline-manager/src/oidc/trust_name.rs
@@ -0,0 +1,18 @@
+use crate::db::error::DBError;
+use crate::db::types::utils::{
+    validate_name, PATTERN_NON_EMPTY_ALPHANUMERIC_UNDERSCORE_HYPHEN,
+    PATTERN_NON_EMPTY_ALPHANUMERIC_UNDERSCORE_HYPHEN_DESCRIPTION,
+};
+
+/// Longest permitted name for a trust relationship.
+pub const MAXIMUM_OIDC_TRUST_NAME_LENGTH: usize = 100;
+
+/// Checks the provided OIDC trust relationship name is valid.
+pub fn validate_oidc_trust_name(name: &str) -> Result<(), DBError> {
+    validate_name(
+        name,
+        MAXIMUM_OIDC_TRUST_NAME_LENGTH,
+        PATTERN_NON_EMPTY_ALPHANUMERIC_UNDERSCORE_HYPHEN,
+        PATTERN_NON_EMPTY_ALPHANUMERIC_UNDERSCORE_HYPHEN_DESCRIPTION,
+    )
+}
diff --git a/python/tests/platform_rbac/conftest.py b/python/tests/platform_rbac/conftest.py
index 1d9c0a098a6..4d57d033fcb 100644
--- a/python/tests/platform_rbac/conftest.py
+++ b/python/tests/platform_rbac/conftest.py
@@ -23,7 +23,7 @@
 import requests
 
 from .idp import DEFAULT_AUDIENCE, Issuer, start_issuer
-from .manager import AuthConfig, Manager, free_port
+from .manager import AuthConfig, Manager, free_port, generate_tls_cert
 
 TENANT_HEADER = "Feldera-Tenant"
 
@@ -63,35 +63,49 @@ def workdir() -> Path:
 
 
 @pytest.fixture(scope="session")
-def primary_idp(workdir: Path) -> Issuer:
+def tls(workdir: Path) -> tuple[Path, Path, Path]:
+    """The suite's CA and the `localhost` certificate it signs.
+
+    A trust registered through the API must name an https issuer, so every
+    issuer here serves TLS, and the manager is pointed at the CA through
+    `SSL_CERT_FILE`.
+    """
+    return generate_tls_cert(workdir / "run" / "tls")
+
+
+@pytest.fixture(scope="session")
+def primary_idp(workdir: Path, tls: tuple[Path, Path, Path]) -> Issuer:
     """The issuer every authenticated configuration trusts."""
-    issuer = start_issuer(free_port(), workdir / "logs", name="primary-idp")
+    issuer = start_issuer(free_port(), workdir / "logs", name="primary-idp", tls=tls)
     yield issuer
     issuer.stop()
 
 
 @pytest.fixture(scope="session")
-def workload_idp(workdir: Path) -> Issuer:
-    """A trusted issuer that is not the login provider."""
-    issuer = start_issuer(free_port(), workdir / "logs", name="workload-idp")
+def workload_idp(workdir: Path, tls: tuple[Path, Path, Path]) -> Issuer:
+    """A trusted issuer that is not the login provider.
+
+    Trusts are registered against this one through the API.
+    """
+    issuer = start_issuer(free_port(), workdir / "logs", name="workload-idp", tls=tls)
     yield issuer
     issuer.stop()
 
 
 @pytest.fixture(scope="session")
-def rogue_idp(workdir: Path) -> Issuer:
+def rogue_idp(workdir: Path, tls: tuple[Path, Path, Path]) -> Issuer:
     """A second issuer the manager trusts for nothing.
 
     It signs with its own key, so a token from it fails verification even when
     it claims the trusted issuer's `iss`.
     """
-    issuer = start_issuer(free_port(), workdir / "logs", name="rogue-idp")
+    issuer = start_issuer(free_port(), workdir / "logs", name="rogue-idp", tls=tls)
     yield issuer
     issuer.stop()
 
 
 @pytest.fixture(scope="session")
-def manager(workdir: Path) -> Manager:
+def manager(workdir: Path, tls: tuple[Path, Path, Path]) -> Manager:
     """The manager under test, shared and restarted by the scenarios."""
     mgr = Manager(state_dir=workdir / "state", run_dir=workdir / "run", https=True)
     yield mgr
diff --git a/python/tests/platform_rbac/idp.py b/python/tests/platform_rbac/idp.py
index f720abd7c35..b4b50b658ef 100644
--- a/python/tests/platform_rbac/idp.py
+++ b/python/tests/platform_rbac/idp.py
@@ -8,6 +8,10 @@
 Tokens come from `scripts/dummy_oidc.py`, whose `/token` endpoint takes the
 claims directly (`sub`, `aud`, `tenants`, `exp_secs`). A negative `exp_secs`
 yields an already-expired token, so expiry needs no clock manipulation.
+
+Every issuer serves https, because a trust registered through the API must name
+an https issuer. They share the `localhost` certificate the suite generates for
+the manager, and the manager trusts the CA behind it through `SSL_CERT_FILE`.
 """
 
 from __future__ import annotations
@@ -31,6 +35,7 @@ class Issuer:
     url: str
     process: subprocess.Popen
     log_path: Path
+    cert: Path | None = None
 
     def token(
         self,
@@ -53,7 +58,12 @@ def token(
             params["aud"] = audience
         if tenants:
             params["tenants"] = ",".join(tenants)
-        r = requests.get(f"{self.url}/token", params=params, timeout=10)
+        r = requests.get(
+            f"{self.url}/token",
+            params=params,
+            timeout=10,
+            verify=str(self.cert) if self.cert else True,
+        )
         r.raise_for_status()
         return r.json()["access_token"]
 
@@ -65,14 +75,25 @@ def stop(self) -> None:
             self.process.kill()
 
 
-def start_issuer(port: int, run_dir: Path, name: str = "idp") -> Issuer:
-    """Start `dummy_oidc.py` on `port` and wait for its discovery document."""
+def start_issuer(
+    port: int,
+    run_dir: Path,
+    name: str = "idp",
+    tls: tuple[Path, Path, Path] | None = None,
+) -> Issuer:
+    """Start `dummy_oidc.py` on `port` and wait for its discovery document.
+
+    With `tls` (certificate, key, CA) the issuer serves https, which a trust
+    registered through the API requires of it.
+    """
     run_dir.mkdir(parents=True, exist_ok=True)
     log_path = run_dir / f"{name}.log"
-    url = f"http://localhost:{port}"
+    cert = tls[2] if tls else None
+    url = f"{'https' if tls else 'http'}://localhost:{port}"
     log = log_path.open("ab")
+    tls_args = ["--tls-cert", str(tls[0]), "--tls-key", str(tls[1])] if tls else []
     process = subprocess.Popen(
-        ["uv", "run", str(DUMMY_OIDC), "--port", str(port), "--issuer", url],
+        ["uv", "run", str(DUMMY_OIDC), "--port", str(port), "--issuer", url, *tls_args],
         cwd=REPO_ROOT,
         stdout=log,
         stderr=subprocess.STDOUT,
@@ -84,9 +105,15 @@ def start_issuer(port: int, run_dir: Path, name: str = "idp") -> Issuer:
                 f"{name} exited early:\n{log_path.read_text(errors='replace')}"
             )
         try:
-            r = requests.get(f"{url}/.well-known/openid-configuration", timeout=2)
+            r = requests.get(
+                f"{url}/.well-known/openid-configuration",
+                timeout=2,
+                verify=str(cert) if cert else True,
+            )
             if r.status_code == 200:
-                return Issuer(url=url, process=process, log_path=log_path)
+                return Issuer(
+                    url=url, process=process, log_path=log_path, cert=cert
+                )
         except requests.RequestException:
             pass
         time.sleep(0.5)
diff --git a/python/tests/platform_rbac/manager.py b/python/tests/platform_rbac/manager.py
index 2bcc0446fc2..38e4acb2967 100644
--- a/python/tests/platform_rbac/manager.py
+++ b/python/tests/platform_rbac/manager.py
@@ -62,44 +62,55 @@ def free_port() -> int:
         return int(s.getsockname()[1])
 
 
-def generate_tls_cert(directory: Path) -> tuple[Path, Path]:
-    """Self-signed certificate for `localhost`, so the suite covers the HTTPS
-    listener rather than testing auth over plaintext only."""
+def generate_tls_cert(directory: Path) -> tuple[Path, Path, Path]:
+    """A local CA, and the `localhost` server certificate it signs.
+
+    Returns `(cert, key, ca_cert)`. Everything the suite runs over TLS serves
+    `cert`: the manager's own listener and every issuer. The manager trusts
+    `ca_cert` as a root, which is how it reaches those issuers.
+
+    Two certificates rather than one self-signed: a certificate marked as a CA
+    is refused when a server presents it (rustls calls this
+    `CaUsedAsEndEntity`), so the root and the server certificate have to be
+    different certificates.
+    """
     directory.mkdir(parents=True, exist_ok=True)
     cert, key = directory / "tls.crt", directory / "tls.key"
-    if cert.exists() and key.exists():
-        return cert, key
+    ca_cert, ca_key = directory / "ca.crt", directory / "ca.key"
+    if cert.exists() and key.exists() and ca_cert.exists():
+        return cert, key, ca_cert
+
+    def openssl(*args: str) -> None:
+        subprocess.run(["openssl", *args], check=True, capture_output=True)
+
+    openssl(
+        "req", "-x509", "-newkey", "rsa:2048", "-nodes",
+        "-keyout", str(ca_key), "-out", str(ca_cert),
+        "-days", "365", "-subj", "/CN=Feldera RBAC test CA",
+        "-addext", "basicConstraints=critical,CA:TRUE",
+        "-addext", "keyUsage=critical,keyCertSign,cRLSign",
+    )  # fmt: skip
+
     ext = directory / "x509_v3.ext"
     ext.write_text(
-        "[x509_v3]\nsubjectAltName = @alt_names\n\n"
+        "subjectAltName = @alt_names\n"
+        "basicConstraints = critical, CA:FALSE\n"
+        "keyUsage = critical, digitalSignature, keyEncipherment\n"
+        "extendedKeyUsage = serverAuth\n\n"
         "[alt_names]\nDNS.1 = localhost\nIP.1 = 127.0.0.1\n"
     )
-    subprocess.run(
-        [
-            "openssl",
-            "req",
-            "-x509",
-            "-newkey",
-            "rsa:4096",
-            "-nodes",
-            "-keyout",
-            str(key),
-            "-out",
-            str(cert),
-            "-days",
-            "365",
-            "-subj",
-            "/CN=localhost",
-            "-config",
-            str(ext),
-            "-extensions",
-            "x509_v3",
-        ],
-        check=True,
-        capture_output=True,
-    )
+    csr = directory / "tls.csr"
+    openssl(
+        "req", "-newkey", "rsa:2048", "-nodes",
+        "-keyout", str(key), "-out", str(csr), "-subj", "/CN=localhost",
+    )  # fmt: skip
+    openssl(
+        "x509", "-req", "-in", str(csr),
+        "-CA", str(ca_cert), "-CAkey", str(ca_key), "-CAcreateserial",
+        "-out", str(cert), "-days", "365", "-extfile", str(ext),
+    )  # fmt: skip
     key.chmod(0o644)
-    return cert, key
+    return cert, key, ca_cert
 
 
 class Manager:
@@ -143,8 +154,8 @@ def __init__(self, state_dir: Path, run_dir: Path, https: bool = True):
         for sub in ("pg", "runner", "compiler"):
             (state_dir / sub).mkdir(parents=True, exist_ok=True)
         run_dir.mkdir(parents=True, exist_ok=True)
-        self.cert, self.key = (
-            generate_tls_cert(run_dir / "tls") if https else (None, None)
+        self.cert, self.key, self.ca_cert = (
+            generate_tls_cert(run_dir / "tls") if https else (None, None, None)
         )
 
     @property
@@ -154,13 +165,37 @@ def base_url(self) -> str:
 
     @property
     def verify(self):
-        """`verify=` for requests: the certificate we issued, or False."""
-        return str(self.cert) if self.https else True
+        """`verify=` for requests: the CA that signed our certificate."""
+        return str(self.ca_cert) if self.https else True
 
     # Where the state root is visible to the manager: a fixed path inside the
     # container, or the host directory when running the binary directly.
     CONTAINER_STATE = "/state"
 
+    # Root stores a Linux image is likely to ship, in preference order.
+    SYSTEM_CA_BUNDLES = (
+        "/etc/ssl/certs/ca-certificates.crt",
+        "/etc/pki/tls/certs/ca-bundle.crt",
+    )
+
+    def _ca_bundle(self) -> Path:
+        """Roots the manager trusts: the suite's certificate and the platform's.
+
+        The manager reaches every issuer over https, so it has to trust the CA
+        that signed what they serve. Its TLS stack reads `SSL_CERT_FILE`
+        *instead of* the system store rather than in addition to it, so the
+        platform's roots are carried along; without them the manager loses every
+        other outbound https destination.
+        """
+        bundle = self.run_dir / "ca-bundle.crt"
+        roots = [self.ca_cert.read_text()]
+        for path in map(Path, self.SYSTEM_CA_BUNDLES):
+            if path.exists():
+                roots.append(path.read_text())
+                break
+        bundle.write_text("\n".join(roots))
+        return bundle
+
     def _flags(self) -> list[str]:
         root = self.CONTAINER_STATE if self.image else str(self.state_dir)
         flags = [
@@ -184,6 +219,7 @@ def start(self, config: AuthConfig) -> None:
             "RUST_LOG": "info",
             "RUST_BACKTRACE": "1",
             "FELDERA_UNSTABLE_FEATURES": "runtime_version,testing",
+            "SSL_CERT_FILE": str(self._ca_bundle()),
             **config.env,
         }
         if self.image:
diff --git a/python/tests/platform_rbac/test_3_negative.py b/python/tests/platform_rbac/test_3_negative.py
index 5dc129c22cc..d3ee0f48a53 100644
--- a/python/tests/platform_rbac/test_3_negative.py
+++ b/python/tests/platform_rbac/test_3_negative.py
@@ -146,6 +146,27 @@ def test_tenant_the_token_does_not_name_is_refused(api: Api, primary_idp: Issuer
             "owner is deploy-time configuration",
             id="owner-role",
         ),
+        # The manager fetches a registered issuer from its own network position
+        # before it verifies any token, so it refuses one it should not go to.
+        pytest.param(
+            {"name": "plaintext", "issuer": "http://idp.example.com", "subject": "s"},
+            "issuer is not https",
+            id="issuer-not-https",
+        ),
+        pytest.param(
+            {"name": "loopback", "issuer": "https://127.0.0.1:9999", "subject": "s"},
+            "issuer on a loopback address",
+            id="issuer-loopback",
+        ),
+        pytest.param(
+            {
+                "name": "metadata-service",
+                "issuer": "https://169.254.169.254/latest",
+                "subject": "s",
+            },
+            "issuer at the cloud metadata service",
+            id="issuer-link-local",
+        ),
     ],
 )
 def test_trust_registration_rejects_bad_input(
@@ -208,7 +229,7 @@ def test_trust_audience_must_match_when_set(
     # Matching is case-sensitive.
     ("case-sensitive", "Repo:Acme/*", "repo:acme/api", False),
     # A trailing star is a prefix match, so it admits anything that merely
-    # begins with the pattern. Pinned because it is the shape that surprises.
+    # begins with the pattern.
     ("prefix-is-open-ended", "svc-a*", "svc-april-fools", True),
     # A realistic pattern and the near misses around it. These matter more than
     # the match: a pattern that is too eager grants a workload nobody meant to.
diff --git a/scripts/dummy_oidc.py b/scripts/dummy_oidc.py
index 2f7e57939cf..b1871f86108 100755
--- a/scripts/dummy_oidc.py
+++ b/scripts/dummy_oidc.py
@@ -34,6 +34,7 @@
 import html
 import json
 import secrets
+import ssl
 import time
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from urllib.parse import parse_qs, urlencode, urlparse
@@ -664,13 +665,29 @@ def main() -> None:
         "(reader/writer/admin); default 'acme'. Use e.g. 'acme,beta' to place them "
         "in two tenants and exercise multi-tenant selection.",
     )
+    parser.add_argument(
+        "--tls-cert",
+        default=None,
+        help="Serve https with this certificate (PEM); requires --tls-key. The "
+        "manager refuses a registered trust whose issuer is not https, so the "
+        "integration suite runs the provider this way.",
+    )
+    parser.add_argument("--tls-key", default=None, help="Private key for --tls-cert")
     args = parser.parse_args()
 
-    issuer = args.issuer or f"http://localhost:{args.port}"
+    if bool(args.tls_cert) != bool(args.tls_key):
+        parser.error("--tls-cert and --tls-key must be given together")
+
+    scheme = "https" if args.tls_cert else "http"
+    issuer = args.issuer or f"{scheme}://localhost:{args.port}"
     demo_tenants = [t.strip() for t in args.demo_tenants.split(",") if t.strip()]
     keys = KeyMaterial()
     handler = make_handler(keys, issuer, args.audience, demo_tenants)
     server = ThreadingHTTPServer(("0.0.0.0", args.port), handler)
+    if args.tls_cert:
+        context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+        context.load_cert_chain(certfile=args.tls_cert, keyfile=args.tls_key)
+        server.socket = context.wrap_socket(server.socket, server_side=True)
 
     print_startup(issuer, args.audience, args.port)
     try:

From 922ffe27f14ec94094b0b6cd6eb3960726eaed77 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Thu, 30 Jul 2026 23:09:51 -0700
Subject: [PATCH 44/55] [pipeline-manager] Keep the default tenant bootstrap
 keyed by its id

Every start recreates the default tenant if it is missing, guarded by ON
CONFLICT (tenant): the name. Rename that tenant and the guard stops firing, the
insert collides with the primary key it already holds, and the manager fails to
start. It fails before it serves, so the installation does not come back.

The bootstrap is about the row with the well-known id, whatever it is called by
now, so it conflicts on nothing in particular and does nothing when either the
id or the name is taken. The login path keeps its own get-or-create, which
needs to know whether it created the tenant and looks the row up by name.

The RBAC suite reached this only at its last module: the migration scenario
renames whoever holds `acme`, and the owner-revocation restart is the first
start after it. That module had never run to the end, which also left the
membership assertion pointing at the name rather than at the tenant the rename
moved the membership to.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 .../src/db/operations/tenant.rs               | 23 +++++++++++++++++++
 .../src/db/storage_postgres.rs                | 16 ++++++++++---
 crates/pipeline-manager/src/db/test.rs        | 22 ++++++++++++++++++
 .../platform_rbac/test_5_owner_revocation.py  | 19 ++++++++++-----
 4 files changed, 71 insertions(+), 9 deletions(-)

diff --git a/crates/pipeline-manager/src/db/operations/tenant.rs b/crates/pipeline-manager/src/db/operations/tenant.rs
index dac64bc5cbf..ae59dca7d5b 100644
--- a/crates/pipeline-manager/src/db/operations/tenant.rs
+++ b/crates/pipeline-manager/src/db/operations/tenant.rs
@@ -18,6 +18,29 @@ pub async fn get_or_create_tenant_id(
         .0)
 }
 
+/// Ensures the default tenant exists, which every start does.
+///
+/// Keyed by id rather than by name: the default tenant may have been renamed
+/// since, and the row is still the same tenant. `ON CONFLICT DO NOTHING`
+/// without a target covers the primary key as well as the unique name, so
+/// neither a rename nor a second tenant taking the name `default` stops the
+/// manager from starting.
+pub async fn ensure_default_tenant(
+    txn: &Transaction<'_>,
+    id: Uuid,
+    name: &str,
+    provider: &str,
+) -> Result<(), DBError> {
+    let stmt = txn
+        .prepare_cached(
+            "INSERT INTO tenant (id, tenant, initial_provider) VALUES ($1, $2, $3) \
+             ON CONFLICT DO NOTHING",
+        )
+        .await?;
+    txn.execute(&stmt, &[&id, &name, &provider]).await?;
+    Ok(())
+}
+
 /// As [`get_or_create_tenant_id`]. The second component of the returned value
 /// is `true` if this call created the tenant, and `false` if it already existed.
 pub async fn get_or_create_tenant_id_created(
diff --git a/crates/pipeline-manager/src/db/storage_postgres.rs b/crates/pipeline-manager/src/db/storage_postgres.rs
index eff8cd1a0e1..5f355abafa7 100644
--- a/crates/pipeline-manager/src/db/storage_postgres.rs
+++ b/crates/pipeline-manager/src/db/storage_postgres.rs
@@ -1924,13 +1924,23 @@ impl StoragePostgres {
         // YAML -> JSON migration
         self.perform_yaml_to_json_migration().await?;
 
+        self.ensure_default_tenant().await?;
+        Ok(())
+    }
+
+    /// Creates the default tenant if this installation does not have it yet.
+    pub(crate) async fn ensure_default_tenant(&self) -> Result<(), DBError> {
         let default_tenant = TenantRecord::default();
-        self.get_or_create_tenant_id(
+        let mut client = self.pool.get().await?;
+        let txn = client.transaction().await?;
+        operations::tenant::ensure_default_tenant(
+            &txn,
             default_tenant.id.0,
-            default_tenant.tenant,
-            default_tenant.initial_provider,
+            &default_tenant.tenant,
+            &default_tenant.initial_provider,
         )
         .await?;
+        txn.commit().await?;
         Ok(())
     }
 
diff --git a/crates/pipeline-manager/src/db/test.rs b/crates/pipeline-manager/src/db/test.rs
index 0e05f3bd0df..ca852a05c07 100644
--- a/crates/pipeline-manager/src/db/test.rs
+++ b/crates/pipeline-manager/src/db/test.rs
@@ -1288,6 +1288,28 @@ async fn rbac_login_resolution_and_membership() {
 /// before any fetch, an optional audience narrows candidates, and a token
 /// trusted by several tenants returns all of them (the caller disambiguates via
 /// the Feldera-Tenant header, verified at the auth layer).
+/// Every start recreates the default tenant if it is missing, and the default
+/// tenant can be renamed, so that bootstrap must not insert a second row for it.
+#[tokio::test]
+async fn default_tenant_bootstrap_survives_a_rename() {
+    let handle = test_setup().await;
+    let default_id = TenantRecord::default().id;
+
+    handle
+        .db
+        .rename_tenant(default_id, "renamed-away", false)
+        .await
+        .unwrap();
+
+    // What the next start does.
+    handle.db.ensure_default_tenant().await.unwrap();
+
+    // Still one tenant, still under the name the rename gave it.
+    let tenants = handle.db.list_tenants().await.unwrap();
+    assert_eq!(tenants.len(), 1, "the bootstrap must not add a second row");
+    assert_eq!(tenants[0].name, "renamed-away");
+}
+
 /// A registered issuer becomes a fetch destination before any signature is
 /// verified, so registration refuses one that names an internal service unless
 /// the operator permits it.
diff --git a/python/tests/platform_rbac/test_5_owner_revocation.py b/python/tests/platform_rbac/test_5_owner_revocation.py
index 9142afcadb8..17d1fb40c33 100644
--- a/python/tests/platform_rbac/test_5_owner_revocation.py
+++ b/python/tests/platform_rbac/test_5_owner_revocation.py
@@ -74,11 +74,18 @@ def test_restarting_without_them_revokes_both(
 def test_a_revoked_owner_keeps_its_tenant_membership(api: Api, primary_idp: Issuer):
     """Losing ownership is not losing the account.
 
-    A former owner that also holds a membership still acts in that tenant at the
-    role the membership gives it. Ownership is platform-wide and separate, so
-    withdrawing it must not disturb anything tenant-scoped.
+    A member still acts in its tenant at the role the membership gives it.
+    Ownership is platform-wide and separate, so withdrawing it must not disturb
+    anything tenant-scoped.
+
+    The admin's membership is in the tenant the migration displaced, which the
+    rename left as `acme (<id>)`; a different tenant holds the name `acme` now.
     """
-    admin = primary_idp.token("admin", email="admin@example.com", tenants=[TENANT])
-    assert api.status("GET", "/tenant/users", token=admin, tenant=TENANT) == 200
+    successor = primary_idp.token("successor", email=SUCCESSOR_EMAIL)
+    tenants = api.v0("GET", "/tenants", token=successor).json()
+    home = next(t["name"] for t in tenants if t["name"].startswith(f"{TENANT} ("))
+
+    admin = primary_idp.token("admin", email="admin@example.com", tenants=[home])
+    assert api.status("GET", "/tenant/users", token=admin, tenant=home) == 200
     # And still cannot reach the platform routes, which is what it never had.
-    assert api.status("GET", "/tenants", token=admin, tenant=TENANT) == 403
+    assert api.status("GET", "/tenants", token=admin, tenant=home) == 403

From ddc1066e00bc0a35f52e7b136665e824847e35d3 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Fri, 31 Jul 2026 00:21:12 -0700
Subject: [PATCH 45/55] [tests] Pin what the route matrix reads into a status
 code

The matrix asserts one bit per route and role, and "not denied" is also what a
path that reaches no route returns. A mistyped probe path passes the whole
module while testing nothing, which this suite has already done once, when the
probes carried a doubled /v0 prefix.

Which statuses carry evidence depends on where authentication and authorization
sit relative to routing, so measure it rather than assume it. Authentication
precedes routing: a path no route serves answers 401 without a token, so the
unauthenticated sweep says nothing about whether a probe reached a route.
Authorization does not: the same path answers 404 to a reader, which is what
makes 403 evidence that a probe resolved to a real gated route.

That leaves the routes requiring `read`, where no role is ever denied and 404
would satisfy every assertion. A parameterless route answers 200 through the
same call path the matrix uses, which covers the URL composition that failed
before; a route with a parameter cannot show it, since it answers 404 whether
the route is missing or only the resource is.

The comment claiming a denied caller is refused ahead of routing was wrong.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 .../platform_rbac/test_2_route_matrix.py      | 35 +++++++++++++++++--
 1 file changed, 33 insertions(+), 2 deletions(-)

diff --git a/python/tests/platform_rbac/test_2_route_matrix.py b/python/tests/platform_rbac/test_2_route_matrix.py
index a5317c00311..e65e7aaf9a5 100644
--- a/python/tests/platform_rbac/test_2_route_matrix.py
+++ b/python/tests/platform_rbac/test_2_route_matrix.py
@@ -55,6 +55,36 @@ def test_the_matrix_is_not_empty():
     )
 
 
+def test_a_path_no_route_serves_is_not_mistaken_for_one(api: Api, primary_idp: Issuer):
+    """What makes the rest of this module mean anything.
+
+    Every assertion here reads one bit off a status code, and "not denied" is
+    also what a path that reaches nothing returns. A mistyped probe path would
+    pass the whole matrix while testing nothing, which this suite has already
+    done once.
+
+    Where authentication and authorization sit relative to routing decides which
+    statuses carry evidence, so it is pinned here rather than assumed.
+    """
+    reader = token_for(primary_idp, "read")
+    absent = "/v0/pipelines-no-such-route"
+
+    # Authentication runs ahead of routing, so a missing token answers 401 even
+    # here. `test_no_route_is_reachable_without_a_token` therefore says nothing
+    # about whether a probe path reached a route.
+    assert api.request("GET", absent).status_code == 401
+
+    # Authorization does not: an authenticated caller on a path no route serves
+    # reaches routing and gets 404. That is what makes `== 403` below evidence
+    # that a probe path resolved to a real gated route.
+    assert api.request("GET", absent, token=reader, tenant=TENANT).status_code == 404
+
+    # And the module's own call path composes a URL that reaches a route, which
+    # a `{parameter}` route cannot show: those answer 404 whether the route is
+    # missing or only the resource is.
+    assert api.request("GET", "/v0/pipelines", token=reader, tenant=TENANT).status_code == 200
+
+
 @pytest.mark.parametrize("role", ROLE_ORDER)
 @pytest.mark.parametrize("route", ROUTES, ids=lambda r: r.id)
 def test_route_admits_exactly_its_minimum_role(
@@ -75,8 +105,9 @@ def test_route_admits_exactly_its_minimum_role(
         body=probe_body(route),
     ).status_code
 
-    # A denied caller is refused in middleware, ahead of routing and the
-    # handler, so 403 is the only status it can see.
+    # A denied caller is refused before the handler runs, so 403 is the only
+    # status it can see. Routing precedes that check, so 403 also means the
+    # path resolved to a real route.
     if route.allows(role):
         assert status != 403, (
             f"{role} should reach {route.id} (needs {route.required_role}) "

From a15706d7ccc7313dd69cabad36fc711b880cba6e Mon Sep 17 00:00:00 2001
From: feldera-bot <feldera-bot@feldera.com>
Date: Fri, 31 Jul 2026 07:28:14 +0000
Subject: [PATCH 46/55] [ci] apply automatic fixes

Signed-off-by: feldera-bot <feldera-bot@feldera.com>
---
 python/tests/platform_rbac/idp.py                 | 4 +---
 python/tests/platform_rbac/test_2_route_matrix.py | 5 ++++-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/python/tests/platform_rbac/idp.py b/python/tests/platform_rbac/idp.py
index b4b50b658ef..274e328a6a4 100644
--- a/python/tests/platform_rbac/idp.py
+++ b/python/tests/platform_rbac/idp.py
@@ -111,9 +111,7 @@ def start_issuer(
                 verify=str(cert) if cert else True,
             )
             if r.status_code == 200:
-                return Issuer(
-                    url=url, process=process, log_path=log_path, cert=cert
-                )
+                return Issuer(url=url, process=process, log_path=log_path, cert=cert)
         except requests.RequestException:
             pass
         time.sleep(0.5)
diff --git a/python/tests/platform_rbac/test_2_route_matrix.py b/python/tests/platform_rbac/test_2_route_matrix.py
index e65e7aaf9a5..86d19845240 100644
--- a/python/tests/platform_rbac/test_2_route_matrix.py
+++ b/python/tests/platform_rbac/test_2_route_matrix.py
@@ -82,7 +82,10 @@ def test_a_path_no_route_serves_is_not_mistaken_for_one(api: Api, primary_idp: I
     # And the module's own call path composes a URL that reaches a route, which
     # a `{parameter}` route cannot show: those answer 404 whether the route is
     # missing or only the resource is.
-    assert api.request("GET", "/v0/pipelines", token=reader, tenant=TENANT).status_code == 200
+    assert (
+        api.request("GET", "/v0/pipelines", token=reader, tenant=TENANT).status_code
+        == 200
+    )
 
 
 @pytest.mark.parametrize("role", ROLE_ORDER)

From 330b11009c2de8ea507a57b1ce72fe0898547118 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Wed, 29 Jul 2026 12:46:01 -0700
Subject: [PATCH 47/55] [pipeline-manager] Confine federated OIDC fetches to
 public addresses

Federated authentication fetches a trust's discovery document and JWKS before it
verifies the token's signature, so an attacker who can register a trust chose an
outbound destination and learned the outcome from the 401 body.

Fetches now carry a destination policy. An issuer the operator named at deploy
time, as the login provider or in an owner trust, may sit on a private network.
A tenant-registered issuer resolves through a filtering DNS resolver that drops
loopback, private, carrier-grade NAT, link-local, and the IPv6 equivalents.
Filtering during resolution rather than before the request leaves no window in
which a hostname resolves to a public address for the check and a private one
for the connection. This is what registration could not do: it validates a URL
once, and DNS moves afterwards.

The discovery document names the second destination, so a tenant-registered
issuer's jwks_uri is held to the same policy.

--allow-internal-tenant-trust-issuers travels with the destination rather than
being read again here. Registration and fetching then apply one value, so the
flag cannot admit an issuer that the fetch would refuse, which would leave an
installation configured and broken.

The RBAC suite runs its issuers on localhost, which is the installation the flag
describes, so it sets the flag, and every trust the scenarios register exercises
that path. The two registration cases asserting an internal address is refused
go: they contradict this configuration, and the default they were checking is
covered against the validator directly in the unit tests.

Reaching an issuer is now `oidc::fetch`, beside the rule for where it may point.
A database that cannot answer the trusted-issuer or trust-matching query keeps
its own status rather than becoming 401: it says nothing about the caller's
credentials, and reporting it as one sends users to re-authenticate during an
outage.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 crates/pipeline-manager/src/auth.rs           | 154 ++++++++----------
 crates/pipeline-manager/src/oidc.rs           |   1 +
 crates/pipeline-manager/src/oidc/fetch.rs     | 136 ++++++++++++++++
 python/tests/platform_rbac/conftest.py        |   4 +
 python/tests/platform_rbac/test_3_negative.py |  14 --
 5 files changed, 210 insertions(+), 99 deletions(-)
 create mode 100644 crates/pipeline-manager/src/oidc/fetch.rs

diff --git a/crates/pipeline-manager/src/auth.rs b/crates/pipeline-manager/src/auth.rs
index 13a8b9d8583..db3b77034d9 100644
--- a/crates/pipeline-manager/src/auth.rs
+++ b/crates/pipeline-manager/src/auth.rs
@@ -46,7 +46,6 @@
 //! pipeline manager side, we store a hash of the API key in the database along
 //! with the permissions.
 
-use std::time::Duration;
 use std::{collections::HashMap, env};
 
 use actix_web::body::MessageBody;
@@ -83,6 +82,7 @@ use crate::db::storage::Storage;
 use crate::db::storage_postgres::StoragePostgres;
 use crate::db::types::role::Role;
 use crate::db::types::tenant::TenantId;
+use crate::oidc::fetch::{fetch_issuer_jwks, fetch_jwks_uri_from_discovery, OidcDestination};
 
 /// The authenticated principal behind a request, resolved by `auth_validator`
 /// and stored in request extensions. The RBAC middleware reads `role`; handlers
@@ -295,6 +295,12 @@ async fn oidc_trust_auth(
         ))
     };
 
+    // A database that cannot answer says nothing about the caller's
+    // credentials. Reporting it as 401 sends users to re-authenticate during an
+    // outage, and hides the outage from whoever is looking at status codes, so
+    // the error keeps the status it already carries.
+    let unavailable = |e: DBError, req: ServiceRequest| Err((e.into(), req));
+
     let header = match decode_header(token) {
         Ok(h) => h,
         Err(e) => {
@@ -315,32 +321,39 @@ async fn oidc_trust_auth(
     let state = req.app_data::<Data<ServerState>>().unwrap().clone();
 
     // SSRF/DoS gate: only fetch discovery/JWKS for an issuer that at least one
-    // trust names, whether configured at launch or registered in a tenant.
-    let trusted_issuer = if state.config.owner_trusts.names_issuer(&iss) {
-        Ok(true)
+    // trust names, whether configured at launch or registered in a tenant. The
+    // two sources earn different destination policies, because the operator
+    // picked one and a tenant administrator picked the other.
+    let destination = if state.config.owner_trusts.names_issuer(&iss) {
+        Some(OidcDestination::OperatorConfigured)
     } else {
-        state.db.lock().await.is_trusted_issuer(&iss).await
-    };
-    match trusted_issuer {
-        Ok(true) => {}
-        Ok(false) => {
-            debug!("Federated token from unregistered issuer '{iss}' rejected");
-            return unauthorized(
-                "No OIDC trust relationship matches this token".to_string(),
-                req,
-            );
-        }
-        Err(e) => {
-            error!("Trusted-issuer check failed for '{iss}': {e}");
-            return unauthorized(format!("Database error: {e}"), req);
+        match state.db.lock().await.is_trusted_issuer(&iss).await {
+            Ok(true) => Some(OidcDestination::TenantRegistered(
+                state.config.tenant_issuer_policy(),
+            )),
+            Ok(false) => None,
+            Err(e) => {
+                error!("Trusted-issuer check failed for '{iss}': {e}");
+                return unavailable(e, req);
+            }
         }
-    }
+    };
+    let Some(destination) = destination else {
+        debug!("Federated token from unregistered issuer '{iss}' rejected");
+        return unauthorized(
+            "No OIDC trust relationship matches this token".to_string(),
+            req,
+        );
+    };
 
-    let jwk = match resolve_issuer_jwk(&state, &iss, &kid).await {
+    let jwk = match resolve_issuer_jwk(&state, &iss, &kid, destination).await {
         Ok(k) => k,
         Err(e) => {
+            // The detail stays in the log. The caller chose this fetch's
+            // destination, so echoing the outcome would report whether an
+            // internal address answered.
             error!("Federated JWKS fetch for issuer '{iss}' failed: {e}");
-            return unauthorized(format!("JWKS lookup failed: {e}"), req);
+            return unauthorized("Could not verify the token's signing key".to_string(), req);
         }
     };
 
@@ -376,7 +389,7 @@ async fn oidc_trust_auth(
         Ok(m) => m,
         Err(e) => {
             error!("Federated trust lookup failed: {e}");
-            return unauthorized(format!("Database error: {e}"), req);
+            return unavailable(e, req);
         }
     };
     if matches.is_empty() && !owner_trust {
@@ -873,64 +886,6 @@ pub(crate) struct ProviderGenericOidc {
     pub(crate) jwk_uri: String,
 }
 
-#[derive(Deserialize)]
-struct OidcDiscoveryDocument {
-    jwks_uri: String,
-}
-
-/// Timeout for OIDC discovery / JWKS HTTP requests.
-const OIDC_FETCH_TIMEOUT_SECONDS: u64 = 10;
-
-/// HTTP client for OIDC discovery / JWKS fetches: a short timeout and no
-/// redirect following, to bound the blast radius of a slow or redirecting
-/// issuer endpoint (defense in depth behind the trusted-issuer gate).
-fn oidc_http_client() -> Result<reqwest::Client, reqwest::Error> {
-    reqwest::Client::builder()
-        // rustls with the platform's roots, so which certificates an issuer may
-        // present is decided the same way on every platform. The default
-        // backend is whatever the target ships, and on macOS that store cannot
-        // be pointed elsewhere.
-        .use_rustls_tls()
-        .timeout(Duration::from_secs(OIDC_FETCH_TIMEOUT_SECONDS))
-        .redirect(reqwest::redirect::Policy::none())
-        .build()
-}
-
-/// Fetch OIDC discovery document and extract `jwks_uri`.
-async fn fetch_jwks_uri_from_discovery(issuer: &str) -> Result<String, reqwest::Error> {
-    let discovery_url = format!(
-        "{}/.well-known/openid-configuration",
-        issuer.trim_end_matches('/')
-    );
-    let discovery: OidcDiscoveryDocument = oidc_http_client()?
-        .get(&discovery_url)
-        .send()
-        .await?
-        .json()
-        .await?;
-    Ok(discovery.jwks_uri)
-}
-
-/// Fetch and parse the RSA JWKS for a federated `issuer` (discovery then keys),
-/// using the hardened OIDC client. Called on the auth path only after the
-/// issuer is confirmed trusted.
-async fn fetch_issuer_jwks(issuer: &str) -> Result<HashMap<String, DecodingKey>, AuthError> {
-    let jwks_uri = fetch_jwks_uri_from_discovery(issuer)
-        .await
-        .map_err(|e| AuthError::JwkShape(format!("OIDC discovery failed: {e}")))?;
-    let client =
-        oidc_http_client().map_err(|e| AuthError::JwkShape(format!("OIDC client build: {e}")))?;
-    let keys_json: Value = client
-        .get(&jwks_uri)
-        .send()
-        .await
-        .map_err(|e| AuthError::JwkShape(format!("JWKS request failed: {e}")))?
-        .json()
-        .await
-        .map_err(|e| AuthError::JwkShape(format!("JWKS parse failed: {e}")))?;
-    parse_rsa_jwks(&keys_json)
-}
-
 /// Resolve the RSA decoding key for `(issuer, kid)` from the federated JWKS
 /// cache, fetching on a miss. The network fetch runs without holding the cache
 /// lock, so a slow issuer endpoint cannot serialize all federated auth.
@@ -938,11 +893,12 @@ async fn resolve_issuer_jwk(
     state: &ServerState,
     issuer: &str,
     kid: &str,
+    destination: OidcDestination,
 ) -> Result<DecodingKey, AuthError> {
     if let Some(key) = state.issuer_jwk_cache.lock().await.cached(issuer, kid) {
         return Ok(key);
     }
-    let keys = fetch_issuer_jwks(issuer).await?;
+    let keys = fetch_issuer_jwks(issuer, destination).await?;
     let mut cache = state.issuer_jwk_cache.lock().await;
     cache.insert(issuer, keys);
     cache
@@ -1001,8 +957,9 @@ pub(crate) async fn generic_oidc_auth_config(
     let iss =
         env::var("FELDERA_AUTH_ISSUER").expect("Missing environment variable FELDERA_AUTH_ISSUER");
 
-    // Use OIDC discovery to fetch jwks_uri
-    let jwk_uri = fetch_jwks_uri_from_discovery(&iss).await?;
+    // Use OIDC discovery to fetch jwks_uri. The operator set this issuer, so it
+    // may name a provider on the deployment's own network.
+    let jwk_uri = fetch_jwks_uri_from_discovery(&iss, OidcDestination::OperatorConfigured).await?;
 
     validation.set_issuer(&[&iss]);
     // Use configurable audience claim from API server configuration
@@ -1122,7 +1079,7 @@ where
 }
 
 #[derive(Debug)]
-enum AuthError {
+pub(crate) enum AuthError {
     JwtDecoding(jsonwebtoken::errors::Error),
     JwkFetch(awc::error::SendRequestError),
     JwkPayload(awc::error::PayloadError),
@@ -1364,7 +1321,7 @@ async fn fetch_jwk_oidc_keys(url: &String) -> Result<HashMap<String, DecodingKey
 /// Parse a JWK set into RSA decoding keys, keyed by `kid`. Keeps only keys
 /// declared for RS256 signature verification (`alg=RS256`, `use=sig`). Shared by
 /// the login-provider (awc) and federated (reqwest) fetch paths.
-fn parse_rsa_jwks(value: &Value) -> Result<HashMap<String, DecodingKey>, AuthError> {
+pub(crate) fn parse_rsa_jwks(value: &Value) -> Result<HashMap<String, DecodingKey>, AuthError> {
     let filtered = value
         .get("keys")
         .ok_or_else(|| {
@@ -1919,4 +1876,31 @@ mod test {
             );
         }
     }
+
+    /// A tenant-registered issuer may not reach an internal service, even when
+    /// its hostname resolves to one.
+    #[tokio::test]
+    async fn public_only_resolver_refuses_a_loopback_hostname() {
+        use reqwest::dns::Resolve;
+        use std::str::FromStr;
+
+        let refused = crate::oidc::fetch::PublicAddrsOnly
+            .resolve(reqwest::dns::Name::from_str("localhost").unwrap())
+            .await;
+        assert!(
+            refused.is_err(),
+            "'localhost' resolves to loopback and must be refused"
+        );
+
+        let permitted = crate::oidc::fetch::PublicAddrsOnly
+            .resolve(reqwest::dns::Name::from_str("one.one.one.one").unwrap())
+            .await;
+        // Skipped rather than failed when the test host has no DNS.
+        if let Ok(addrs) = permitted {
+            assert!(
+                addrs.count() > 0,
+                "a public hostname must keep at least one address"
+            );
+        }
+    }
 }
diff --git a/crates/pipeline-manager/src/oidc.rs b/crates/pipeline-manager/src/oidc.rs
index db8fd2fe864..10a4307afcd 100644
--- a/crates/pipeline-manager/src/oidc.rs
+++ b/crates/pipeline-manager/src/oidc.rs
@@ -1,4 +1,5 @@
 //! OIDC identity: what the platform trusts, and where it will go to check it.
 
 pub mod destination;
+pub mod fetch;
 pub mod trust_name;
diff --git a/crates/pipeline-manager/src/oidc/fetch.rs b/crates/pipeline-manager/src/oidc/fetch.rs
new file mode 100644
index 00000000000..56dc6c41299
--- /dev/null
+++ b/crates/pipeline-manager/src/oidc/fetch.rs
@@ -0,0 +1,136 @@
+//! Fetching an issuer's keys, and where those fetches may go.
+//!
+//! Federated authentication reaches the issuer named in a token before it can
+//! verify the token's signature, so the fetch happens on behalf of whoever
+//! presented it.
+
+use crate::auth::{parse_rsa_jwks, AuthError};
+use crate::oidc::destination::{is_public_ip, validate_tenant_oidc_url, TenantIssuerPolicy};
+use jsonwebtoken::DecodingKey;
+use serde::Deserialize;
+use serde_json::Value;
+use std::collections::HashMap;
+use std::net::SocketAddr;
+use std::sync::Arc;
+use std::time::Duration;
+
+#[derive(Deserialize)]
+struct OidcDiscoveryDocument {
+    jwks_uri: String,
+}
+
+/// Timeout for OIDC discovery / JWKS HTTP requests.
+const OIDC_FETCH_TIMEOUT_SECONDS: u64 = 10;
+
+/// Who chose the issuer, which decides where its fetches may go.
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub(crate) enum OidcDestination {
+    /// The operator named this issuer at deploy time, as the login provider or
+    /// in an owner trust, so it may sit on a private network.
+    OperatorConfigured,
+    /// A tenant administrator registered this issuer through the API. It must
+    /// be https, and must resolve to a public address unless the operator
+    /// permitted internal ones.
+    TenantRegistered(TenantIssuerPolicy),
+}
+
+/// A [`reqwest`] resolver that drops every address outside [`is_public_ip`].
+#[derive(Debug)]
+pub(crate) struct PublicAddrsOnly;
+
+impl reqwest::dns::Resolve for PublicAddrsOnly {
+    fn resolve(&self, name: reqwest::dns::Name) -> reqwest::dns::Resolving {
+        Box::pin(async move {
+            // The port is irrelevant to resolution; reqwest substitutes the
+            // real one on the addresses this returns.
+            let permitted: Vec<SocketAddr> = tokio::net::lookup_host((name.as_str(), 0))
+                .await?
+                .filter(|addr| is_public_ip(addr.ip()))
+                .collect();
+            if permitted.is_empty() {
+                return Err(format!(
+                    "'{}' resolves to no address permitted by the OIDC destination policy",
+                    name.as_str()
+                )
+                .into());
+            }
+            Ok(Box::new(permitted.into_iter()) as reqwest::dns::Addrs)
+        })
+    }
+}
+
+/// HTTP client for OIDC discovery / JWKS fetches: a short timeout and no
+/// redirect following, to bound the blast radius of a slow or redirecting
+/// issuer endpoint. A tenant-registered issuer additionally resolves through
+/// [`PublicAddrsOnly`], so it cannot name an internal service.
+pub(crate) fn oidc_http_client(
+    destination: OidcDestination,
+) -> Result<reqwest::Client, reqwest::Error> {
+    let builder = reqwest::Client::builder()
+        // rustls with the platform's roots, so which certificates an issuer may
+        // present is decided the same way on every platform. The default
+        // backend is whatever the target ships, and on macOS that store cannot
+        // be pointed elsewhere.
+        .use_rustls_tls()
+        .timeout(Duration::from_secs(OIDC_FETCH_TIMEOUT_SECONDS))
+        .redirect(reqwest::redirect::Policy::none());
+    match destination {
+        OidcDestination::TenantRegistered(TenantIssuerPolicy::PublicHttpsOnly) => {
+            builder.dns_resolver(Arc::new(PublicAddrsOnly)).build()
+        }
+        _ => builder.build(),
+    }
+}
+
+/// Fetch OIDC discovery document and extract `jwks_uri`.
+pub(crate) async fn fetch_jwks_uri_from_discovery(
+    issuer: &str,
+    destination: OidcDestination,
+) -> Result<String, reqwest::Error> {
+    let discovery_url = format!(
+        "{}/.well-known/openid-configuration",
+        issuer.trim_end_matches('/')
+    );
+    let discovery: OidcDiscoveryDocument = oidc_http_client(destination)?
+        .get(&discovery_url)
+        .send()
+        .await?
+        .json()
+        .await?;
+    Ok(discovery.jwks_uri)
+}
+
+/// Fetch and parse the RSA JWKS for a federated `issuer` (discovery then keys),
+/// using the hardened OIDC client. Called on the auth path only after the
+/// issuer is confirmed trusted.
+///
+/// The discovery document names the second destination, so for a
+/// tenant-registered issuer that destination is held to the same policy as the
+/// issuer itself. Same-origin would be stricter, but it rejects providers that
+/// legitimately split the two hosts, Google among them.
+pub(crate) async fn fetch_issuer_jwks(
+    issuer: &str,
+    destination: OidcDestination,
+) -> Result<HashMap<String, DecodingKey>, AuthError> {
+    let jwks_uri = fetch_jwks_uri_from_discovery(issuer, destination)
+        .await
+        .map_err(|e| AuthError::JwkShape(format!("OIDC discovery failed: {e}")))?;
+    if let OidcDestination::TenantRegistered(policy) = destination {
+        validate_tenant_oidc_url(&jwks_uri, policy).map_err(|e| {
+            AuthError::JwkShape(format!(
+                "issuer's jwks_uri is not a permitted destination: {e}"
+            ))
+        })?;
+    }
+    let client = oidc_http_client(destination)
+        .map_err(|e| AuthError::JwkShape(format!("OIDC client build: {e}")))?;
+    let keys_json: Value = client
+        .get(&jwks_uri)
+        .send()
+        .await
+        .map_err(|e| AuthError::JwkShape(format!("JWKS request failed: {e}")))?
+        .json()
+        .await
+        .map_err(|e| AuthError::JwkShape(format!("JWKS parse failed: {e}")))?;
+    parse_rsa_jwks(&keys_json)
+}
diff --git a/python/tests/platform_rbac/conftest.py b/python/tests/platform_rbac/conftest.py
index 4d57d033fcb..5c03f9f6ae5 100644
--- a/python/tests/platform_rbac/conftest.py
+++ b/python/tests/platform_rbac/conftest.py
@@ -131,6 +131,10 @@ def single_tenant_auth(
     env = {
         "AUTH_PROVIDER": "generic-oidc",
         "FELDERA_AUTH_CLIENT_ID": "feldera",
+        # The suite's issuers run on localhost, so a trust registered against
+        # one names a loopback address. That is the installation this flag
+        # exists for, and without it the manager refuses to fetch their keys.
+        "FELDERA_ALLOW_INTERNAL_TENANT_TRUST_ISSUERS": "true",
         "FELDERA_AUTH_ISSUER": idp.url,
         "FELDERA_AUTH_AUDIENCE": DEFAULT_AUDIENCE,
         "FELDERA_OWNERS": owners,
diff --git a/python/tests/platform_rbac/test_3_negative.py b/python/tests/platform_rbac/test_3_negative.py
index d3ee0f48a53..3df886b8b94 100644
--- a/python/tests/platform_rbac/test_3_negative.py
+++ b/python/tests/platform_rbac/test_3_negative.py
@@ -153,20 +153,6 @@ def test_tenant_the_token_does_not_name_is_refused(api: Api, primary_idp: Issuer
             "issuer is not https",
             id="issuer-not-https",
         ),
-        pytest.param(
-            {"name": "loopback", "issuer": "https://127.0.0.1:9999", "subject": "s"},
-            "issuer on a loopback address",
-            id="issuer-loopback",
-        ),
-        pytest.param(
-            {
-                "name": "metadata-service",
-                "issuer": "https://169.254.169.254/latest",
-                "subject": "s",
-            },
-            "issuer at the cloud metadata service",
-            id="issuer-link-local",
-        ),
     ],
 )
 def test_trust_registration_rejects_bad_input(

From 590dc5b45fd7cbf418e70b2f2ce6bff57f918264 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Wed, 29 Jul 2026 12:46:12 -0700
Subject: [PATCH 48/55] [pipeline-manager] Coalesce OIDC key refreshes behind a
 per-issuer cooldown

An unverified token chooses the key ID, and a cache miss fetched discovery and
JWKS on every request. Repeating unknown key IDs therefore turned one inbound
request into two outbound ones, and concurrent misses for the same issuer each
fetched independently. No credential was needed: the token only had to name a
registered issuer.

Refreshes for an issuer now serialize on a gate, so concurrent misses cost one
fetch, and a refresh that did not produce the requested key ID blocks further
fetches for thirty seconds. The cooldown starts before the fetch, so a failing
issuer is retried on the cooldown rather than on every request.

A genuine key rollover still resolves on its first miss, because the cooldown
only applies once a refresh has already run and come back without the key.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 crates/pipeline-manager/src/auth.rs | 99 ++++++++++++++++++++++++++++-
 1 file changed, 98 insertions(+), 1 deletion(-)

diff --git a/crates/pipeline-manager/src/auth.rs b/crates/pipeline-manager/src/auth.rs
index db3b77034d9..1e2f0ccb4ba 100644
--- a/crates/pipeline-manager/src/auth.rs
+++ b/crates/pipeline-manager/src/auth.rs
@@ -46,7 +46,7 @@
 //! pipeline manager side, we store a hash of the API key in the database along
 //! with the permissions.
 
-use std::{collections::HashMap, env};
+use std::{collections::HashMap, env, sync::Arc};
 
 use actix_web::body::MessageBody;
 use actix_web::http::header::{self, HeaderMap, HeaderName, HeaderValue};
@@ -889,6 +889,12 @@ pub(crate) struct ProviderGenericOidc {
 /// Resolve the RSA decoding key for `(issuer, kid)` from the federated JWKS
 /// cache, fetching on a miss. The network fetch runs without holding the cache
 /// lock, so a slow issuer endpoint cannot serialize all federated auth.
+///
+/// An unverified token chooses the `kid`, so a miss must not cost a fetch per
+/// request. Refreshes for one issuer serialize on a gate, and a refresh that
+/// did not produce the requested `kid` blocks further fetches for
+/// [`ISSUER_REFRESH_COOLDOWN_SECONDS`]. A genuine key rollover still resolves on
+/// its first miss, because the cooldown only starts once a refresh has run.
 async fn resolve_issuer_jwk(
     state: &ServerState,
     issuer: &str,
@@ -898,6 +904,26 @@ async fn resolve_issuer_jwk(
     if let Some(key) = state.issuer_jwk_cache.lock().await.cached(issuer, kid) {
         return Ok(key);
     }
+
+    let gate = state.issuer_jwk_cache.lock().await.refresh_gate(issuer);
+    let _refreshing = gate.lock().await;
+
+    {
+        let mut cache = state.issuer_jwk_cache.lock().await;
+        // A refresh may have completed while this request waited on the gate.
+        if let Some(key) = cache.cached(issuer, kid) {
+            return Ok(key);
+        }
+        if cache.refreshed_recently(issuer) {
+            return Err(AuthError::JwkShape(
+                "kid not present in issuer JWKS".to_string(),
+            ));
+        }
+        // Marked before the fetch, so that a failing issuer is retried on the
+        // cooldown rather than on every request.
+        cache.mark_refreshed(issuer);
+    }
+
     let keys = fetch_issuer_jwks(issuer, destination).await?;
     let mut cache = state.issuer_jwk_cache.lock().await;
     cache.insert(issuer, keys);
@@ -1205,14 +1231,31 @@ pub struct JwkCache {
 
 /// JWKS cache keyed by (issuer, kid) for federated tokens whose issuer is
 /// dynamically discovered from a registered trust relationship.
+///
+/// Lock order is always gate before cache. Take an issuer's gate first, then
+/// the lock around this struct, and release that lock before awaiting anything.
+/// Holding this struct's lock while awaiting a gate is the reverse order and
+/// deadlocks against any request already in [`resolve_issuer_jwk`], which is
+/// why that function reads the gate out of a temporary rather than holding the
+/// cache across the two.
 pub struct IssuerJwkCache {
     cache: TimedCache<(String, String), DecodingKey>,
+    /// Issuers refreshed within the cooldown. Membership is the whole value:
+    /// entries expire after [`ISSUER_REFRESH_COOLDOWN_SECONDS`].
+    recent_refresh: TimedCache<String, ()>,
+    /// One gate per issuer, so concurrent misses cost a single fetch.
+    refresh_gates: TimedCache<String, Arc<tokio::sync::Mutex<()>>>,
 }
 
 const DEFAULT_JWK_CACHE_LIFETIME_SECONDS: u64 = 120;
 const DEFAULT_JWK_CACHE_CAPACITY: usize = 10;
 const ISSUER_JWK_CACHE_CAPACITY: usize = 64;
 
+/// Minimum gap between JWKS refreshes for one issuer. An unverified token
+/// chooses the `kid`, so without this gap every unknown `kid` would cost a
+/// discovery fetch and a JWKS fetch.
+const ISSUER_REFRESH_COOLDOWN_SECONDS: u64 = 30;
+
 impl IssuerJwkCache {
     pub(crate) fn new() -> Self {
         Self {
@@ -1220,6 +1263,14 @@ impl IssuerJwkCache {
                 DEFAULT_JWK_CACHE_LIFETIME_SECONDS,
                 ISSUER_JWK_CACHE_CAPACITY,
             ),
+            recent_refresh: TimedCache::with_lifespan_and_capacity(
+                ISSUER_REFRESH_COOLDOWN_SECONDS,
+                ISSUER_JWK_CACHE_CAPACITY,
+            ),
+            refresh_gates: TimedCache::with_lifespan_and_capacity(
+                DEFAULT_JWK_CACHE_LIFETIME_SECONDS,
+                ISSUER_JWK_CACHE_CAPACITY,
+            ),
         }
     }
 
@@ -1238,6 +1289,27 @@ impl IssuerJwkCache {
                 .cache_set((issuer.to_string(), kid), decoding_key);
         }
     }
+
+    /// Whether `issuer` was refreshed within the cooldown.
+    fn refreshed_recently(&mut self, issuer: &str) -> bool {
+        self.recent_refresh.cache_get(&issuer.to_string()).is_some()
+    }
+
+    /// Start `issuer`'s cooldown.
+    fn mark_refreshed(&mut self, issuer: &str) {
+        self.recent_refresh.cache_set(issuer.to_string(), ());
+    }
+
+    /// The gate that serializes refreshes for `issuer`.
+    fn refresh_gate(&mut self, issuer: &str) -> Arc<tokio::sync::Mutex<()>> {
+        let key = issuer.to_string();
+        if let Some(gate) = self.refresh_gates.cache_get(&key) {
+            return gate.clone();
+        }
+        let gate = Arc::new(tokio::sync::Mutex::new(()));
+        self.refresh_gates.cache_set(key, gate.clone());
+        gate
+    }
 }
 
 impl JwkCache {
@@ -1903,4 +1975,29 @@ mod test {
             );
         }
     }
+
+    /// An unverified token picks the `kid`, so a refresh that did not produce it
+    /// must not let the next request fetch again.
+    #[tokio::test]
+    async fn an_issuer_refresh_starts_a_cooldown() {
+        let mut cache = super::IssuerJwkCache::new();
+        assert!(!cache.refreshed_recently("https://idp.example.com"));
+
+        cache.mark_refreshed("https://idp.example.com");
+        assert!(cache.refreshed_recently("https://idp.example.com"));
+        // The cooldown is per issuer, so one slow provider cannot block others.
+        assert!(!cache.refreshed_recently("https://other.example.com"));
+    }
+
+    /// Concurrent misses for one issuer share a gate, so they cost one fetch.
+    #[tokio::test]
+    async fn a_refresh_gate_is_shared_per_issuer() {
+        let mut cache = super::IssuerJwkCache::new();
+        let first = cache.refresh_gate("https://idp.example.com");
+        let second = cache.refresh_gate("https://idp.example.com");
+        let other = cache.refresh_gate("https://other.example.com");
+
+        assert!(Arc::ptr_eq(&first, &second));
+        assert!(!Arc::ptr_eq(&first, &other));
+    }
 }

From 6f2c3fe5c2c553e538cf54753fd32926a16d4a97 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Wed, 29 Jul 2026 12:46:40 -0700
Subject: [PATCH 49/55] [pipeline-manager] Require write to compile a program

The route table classified validate_program and the pipeline diff by whether
they change durable state, and neither does, so both sat at read. Both take a
caller-supplied program and hand it to the shared compiler, which spawns a Java
process per request. A key labelled read-only could therefore consume compute
shared across tenants.

Both now require write. Compiling a supplied program is write authority even
when nothing is persisted, and the realistic caller is someone about to deploy.
No web-console flow calls either route, so this costs no console behaviour.

The role is not the whole control: a write user can saturate the compiler just
as easily. Admission control at the compiler remains to be added.

Profiling stays at read. It acts on a pipeline the reader can already observe,
and a bounded duration rather than the role is what limits its cost.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 crates/pipeline-manager/src/api/rbac.rs | 20 ++++++++++++--------
 openapi.json                            |  4 ++--
 2 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/crates/pipeline-manager/src/api/rbac.rs b/crates/pipeline-manager/src/api/rbac.rs
index 30e28e5a184..1fc1b11f53a 100644
--- a/crates/pipeline-manager/src/api/rbac.rs
+++ b/crates/pipeline-manager/src/api/rbac.rs
@@ -61,7 +61,7 @@ static ROUTE_MIN_ROLE: &[(&str, &str, Role)] = &[
     ("POST", "/v0/pipelines/{pipeline_name}/commit_transaction", Role::Write), // commit_transaction
     ("GET", "/v0/pipelines/{pipeline_name}/completion_status", Role::Read), // completion_status
     ("GET", "/v0/pipelines/{pipeline_name}/dataflow_graph", Role::Read), // get_pipeline_dataflow_graph
-    ("POST", "/v0/pipelines/{pipeline_name}/diff", Role::Read), // post_pipeline_diff (compile-only, no data/state change)
+    ("POST", "/v0/pipelines/{pipeline_name}/diff", Role::Write), // post_pipeline_diff (submits a candidate program to the shared compiler)
     ("POST", "/v0/pipelines/{pipeline_name}/dismiss_error", Role::Write), // post_pipeline_dismiss_error
     ("POST", "/v0/pipelines/{pipeline_name}/egress/{table_name}", Role::Write), // http_output
     ("GET", "/v0/pipelines/{pipeline_name}/events", Role::Read), // list_pipeline_events
@@ -89,7 +89,7 @@ static ROUTE_MIN_ROLE: &[(&str, &str, Role)] = &[
     ("GET", "/v0/pipelines/{pipeline_name}/time_series", Role::Read), // get_pipeline_time_series
     ("GET", "/v0/pipelines/{pipeline_name}/time_series_stream", Role::Read), // get_pipeline_time_series_stream
     ("POST", "/v0/pipelines/{pipeline_name}/update_runtime", Role::Write), // post_update_runtime
-    ("POST", "/v0/validate_program", Role::Read), // post_validate_program (compile-only, no data/state change)
+    ("POST", "/v0/validate_program", Role::Write), // post_validate_program (submits a program to the shared compiler)
     ("POST", "/v0/pipelines/{pipeline_name}/views/{view_name}/connectors/{connector_name}/command", Role::Write), // post_pipeline_output_connector_command
     ("GET", "/v0/pipelines/{pipeline_name}/views/{view_name}/connectors/{connector_name}/stats", Role::Read), // get_pipeline_output_connector_status
     // RBAC tenant/user management
@@ -433,15 +433,15 @@ mod test {
     /// A route that can change something never admits `read`. The exceptions
     /// are the POSTs that compile or profile: they take a body but leave no
     /// data or state behind.
+    /// Profiling is the one POST a reader may reach: it acts on a pipeline the
+    /// reader can already observe, and a bounded duration, not the role, is
+    /// what limits its cost. The compile routes are not exempt, because they
+    /// hand a caller-supplied program to the shared compiler.
     #[test]
     fn a_mutating_route_never_admits_read() {
-        let posts_that_change_nothing = [
-            "/v0/pipelines/{pipeline_name}/diff",
-            "/v0/pipelines/{pipeline_name}/samply_profile",
-            "/v0/validate_program",
-        ];
+        let posts_a_reader_may_make = ["/v0/pipelines/{pipeline_name}/samply_profile"];
         for (method, pattern, required) in ROUTE_MIN_ROLE {
-            if *method == "GET" || posts_that_change_nothing.contains(pattern) {
+            if *method == "GET" || posts_a_reader_may_make.contains(pattern) {
                 continue;
             }
             assert!(
@@ -481,6 +481,10 @@ mod test {
             Role::Write,
         );
         expect("GET", "/v0/pipelines/{pipeline_name}/query", Role::Write);
+        // Compiling a caller-supplied program is write authority, even though
+        // neither route persists anything.
+        expect("POST", "/v0/validate_program", Role::Write);
+        expect("POST", "/v0/pipelines/{pipeline_name}/diff", Role::Write);
         expect(
             "POST",
             "/v0/pipelines/{pipeline_name}/start_transaction",
diff --git a/openapi.json b/openapi.json
index eebc4acf385..f55caf57423 100644
--- a/openapi.json
+++ b/openapi.json
@@ -3883,7 +3883,7 @@
           "Pipeline Lifecycle"
         ],
         "summary": "Compute Program Diff",
-        "description": "Required role: `read` or higher.\n\nCompute the diff between the pipeline's current program and a proposed new\nversion, without modifying or restarting the pipeline.\n\nThe diff lists the tables, views, and connectors that would be added,\nremoved, or modified. It is the same diff shown when approving changes during\nbootstrapping, letting you preview the effect of a change before applying it.\n\nThe baseline is the pipeline's currently configured program compiled with its\nruntime, not necessarily the program in the latest checkpoint (which may have\nbeen produced by a different program or runtime version).",
+        "description": "Required role: `write` or higher.\n\nCompute the diff between the pipeline's current program and a proposed new\nversion, without modifying or restarting the pipeline.\n\nThe diff lists the tables, views, and connectors that would be added,\nremoved, or modified. It is the same diff shown when approving changes during\nbootstrapping, letting you preview the effect of a change before applying it.\n\nThe baseline is the pipeline's currently configured program compiled with its\nruntime, not necessarily the program in the latest checkpoint (which may have\nbeen produced by a different program or runtime version).",
         "operationId": "post_pipeline_diff",
         "parameters": [
           {
@@ -7916,7 +7916,7 @@
           "Pipeline Lifecycle"
         ],
         "summary": "Validate Program",
-        "description": "Required role: `read` or higher.\n\nValidate a SQL program by compiling it, without creating a pipeline or\nbuilding the pipeline binary. Reports SQL errors and warnings and the derived\nschema and connectors. Set `ir` to also return the program IR (dataflow).\n\nNote that this endpoint returns HTTP 200, regardless of whether validation\nsucceeds or fails. The validation result, including any compiler warnings and errors,\nis encoded in the `ValidateProgramResponse` response body.",
+        "description": "Required role: `write` or higher.\n\nValidate a SQL program by compiling it, without creating a pipeline or\nbuilding the pipeline binary. Reports SQL errors and warnings and the derived\nschema and connectors. Set `ir` to also return the program IR (dataflow).\n\nNote that this endpoint returns HTTP 200, regardless of whether validation\nsucceeds or fails. The validation result, including any compiler warnings and errors,\nis encoded in the `ValidateProgramResponse` response body.",
         "operationId": "post_validate_program",
         "requestBody": {
           "description": "The SQL program to validate, an optional runtime version, and whether to return the IR",

From 83701cb50c294053cd58bdd5e0c8e28a9e2215fa Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Fri, 31 Jul 2026 08:58:15 -0700
Subject: [PATCH 50/55] [scripts] Let the RBAC demo register an internal trust
 issuer

The demo runs its issuer on localhost, which a trust registered through the API may not name by default. The flag is what such an installation sets.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 scripts/rbac_up.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/scripts/rbac_up.sh b/scripts/rbac_up.sh
index 51a5ed25529..1aadc776784 100755
--- a/scripts/rbac_up.sh
+++ b/scripts/rbac_up.sh
@@ -63,12 +63,17 @@ echo "== starting pipeline-manager (:8080, auth on, owner=owner@example.com) =="
 # Two ways to be an owner, both configured here and neither grantable at
 # runtime: a user (FELDERA_OWNERS) and a workload (FELDERA_OWNER_TRUSTS), the
 # latter standing in for CI that holds no login.
+#
+# A trust registered through the API may name a loopback address here, which the
+# manager refuses by default. It still has to be https, so registering one
+# against this demo's own http issuer is refused; point it at an https issuer.
 AUTH_PROVIDER=generic-oidc \
 FELDERA_AUTH_CLIENT_ID=feldera \
 FELDERA_AUTH_ISSUER=http://localhost:9876 \
 FELDERA_AUTH_AUDIENCE=feldera-api \
 FELDERA_OWNERS=owner@example.com \
 FELDERA_OWNER_TRUSTS='[{"issuer": "http://localhost:9876", "subject": "ci-bot", "audience": "feldera-api"}]' \
+FELDERA_ALLOW_INTERNAL_TENANT_TRUST_ISSUERS=true \
 FELDERA_UNSTABLE_FEATURES='runtime_version,testing' \
   "$BIN" \
     --pg-embed-working-directory="$DEMO/pg" \

From fac36beaeb36e209618a00950cf537f68b8b4840 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Fri, 31 Jul 2026 10:17:34 -0700
Subject: [PATCH 51/55] [web-console] Don't create a Monaco editor after its
 consumer unmounts

MonacoEditorRunes awaits the Monaco loader, and the json contribution module
when `jsonSchemas` is set, before it creates the editor. A consumer that
unmounts inside that window leaves Svelte to null the bound container, and
`editor.create` then walks up from null looking for a shadow root and throws
"Cannot read properties of null (reading 'parentNode')".

Nothing awaits the `onMount` promise, so the throw surfaces as an unhandled
rejection after the test that triggered it has already passed. Vitest reports
every test file green and then exits non-zero, which reads as a failure with no
failing test. Record the teardown in `onDestroy` and check it before touching
the DOM.

Unit tests reach the editor only through JSONDialog and MultiJSONDialog, whose
specs this branch adds, so the run fails here and not on main. The new test
closes the dialog while the loader is still in flight; it fails with three
rejections when the guard is removed.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 .../src/lib/MonacoEditorRunes.svelte          | 13 +++++++++-
 .../dialogs/JSONDialog.svelte.spec.ts         | 24 +++++++++++++++++++
 2 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/js-packages/common-ui/src/lib/MonacoEditorRunes.svelte b/js-packages/common-ui/src/lib/MonacoEditorRunes.svelte
index f55e8252d5d..53300bd2de7 100644
--- a/js-packages/common-ui/src/lib/MonacoEditorRunes.svelte
+++ b/js-packages/common-ui/src/lib/MonacoEditorRunes.svelte
@@ -29,6 +29,7 @@
   let monaco: typeof Monaco
 
   let container: HTMLDivElement
+  let isDestroyed = false
   let {
     editor = $bindable(),
     model,
@@ -116,6 +117,13 @@
         )
       }
     }
+    // Both awaits above yield to the event loop, and the consumer can unmount
+    // in that window: Svelte nulls `container` on teardown, and Monaco walks up
+    // from it looking for a shadow root, so creating the editor now would throw
+    // "Cannot read properties of null (reading 'parentNode')".
+    if (isDestroyed) {
+      return
+    }
     editor = monaco.editor.create(container, {
       // TODO: Workaround for Windows-only cursor mis-positioning on mouse click
       // (cursor lands progressively further off the clicked glyph along the line;
@@ -139,7 +147,10 @@
     onready(editor)
   })
 
-  onDestroy(() => editor?.dispose())
+  onDestroy(() => {
+    isDestroyed = true
+    editor?.dispose()
+  })
 </script>
 
 <div
diff --git a/js-packages/web-console/src/lib/components/dialogs/JSONDialog.svelte.spec.ts b/js-packages/web-console/src/lib/components/dialogs/JSONDialog.svelte.spec.ts
index 92d86c17415..3bffe313e72 100644
--- a/js-packages/web-console/src/lib/components/dialogs/JSONDialog.svelte.spec.ts
+++ b/js-packages/web-console/src/lib/components/dialogs/JSONDialog.svelte.spec.ts
@@ -3,7 +3,10 @@
  * with it, an Apply button; without it, no Apply and a Close button in its place
  * (plus a read-only editor). This lets the pipeline config dialog go read-only
  * for a caller without `write:pipeline_config` while the JSON stays viewable.
+ *
+ * Also covers closing the dialog while its Monaco editor is still loading.
  */
+import loader from '@monaco-editor/loader'
 import { describe, expect, it, vi } from 'vitest'
 import { page } from 'vitest/browser'
 import { render } from 'vitest-browser-svelte'
@@ -28,4 +31,25 @@ describe('JSONDialog.svelte', () => {
     await expect.element(page.getByRole('button', { name: 'Apply' })).not.toBeInTheDocument()
     await expect.element(page.getByTestId('btn-dialog-cancel')).toHaveTextContent('Close')
   })
+
+  it('closing it while Monaco is still loading does not reject', async () => {
+    const rejections: string[] = []
+    const collectRejection = (event: PromiseRejectionEvent) => rejections.push(String(event.reason))
+    window.addEventListener('unhandledrejection', collectRejection)
+    try {
+      // Unmount inside the window where the editor's loader has not resolved,
+      // so the container is gone by the time the editor would be created.
+      const dialog = render(JSONDialog, baseProps())
+      await dialog.unmount()
+      await loader.init()
+      // The rejection lands a few turns after the load resolves; stop as soon
+      // as one does, and give a clean run the full budget before believing it.
+      for (let attempt = 0; attempt < 40 && rejections.length === 0; attempt++) {
+        await new Promise((resolve) => setTimeout(resolve, 50))
+      }
+    } finally {
+      window.removeEventListener('unhandledrejection', collectRejection)
+    }
+    expect(rejections).toEqual([])
+  })
 })

From 5225e977e98f4b18f957587137cdca465f765914 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Fri, 31 Jul 2026 11:01:26 -0700
Subject: [PATCH 52/55] [tests] Say why the RBAC suite's manager refused a
 request

A failed assertion in this suite reports what the API answered and nothing
about the manager that answered it. The workflow's `always()` step means to
cover that by dumping `docker logs`, but the manager fixture removes its
container when it tears down, so the step runs after the evidence is gone and
prints nothing. CI showed this on `test_02_pipeline_survives_enabling_auth`:
a 401 where 200 was expected, with no way to tell whether the token, the key
fetch or the trust lookup was at fault.

Capture the manager and issuer logs from a report hook instead. The hook runs
while the test's own fixtures are still alive, which is the last moment those
logs exist, and it attaches them to the failing test rather than to the job.

Raise `RUST_LOG` for `auth` and `oidc` to debug as well. Those modules log the
reason a token is refused at debug, so at info the captured log would have
recorded the 401 and still not explained it.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 python/tests/platform_rbac/conftest.py | 23 +++++++++++++++++++++++
 python/tests/platform_rbac/manager.py  |  4 +++-
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/python/tests/platform_rbac/conftest.py b/python/tests/platform_rbac/conftest.py
index 5c03f9f6ae5..77e2438661e 100644
--- a/python/tests/platform_rbac/conftest.py
+++ b/python/tests/platform_rbac/conftest.py
@@ -43,6 +43,29 @@ def pytest_configure(config: pytest.Config) -> None:
     )
 
 
+@pytest.hookimpl(wrapper=True)
+def pytest_runtest_makereport(item: pytest.Item, call: pytest.CallInfo):
+    """Attach the manager and issuer logs to a failing test.
+
+    A failed assertion says what the API answered, not why. The manager fixture
+    removes its container when it tears down, so CI's `always()` cleanup finds
+    nothing left to dump; here the test's fixtures are still alive, which makes
+    this the last moment the logs exist.
+    """
+    report = yield
+    if report.when != "call" or not report.failed:
+        return report
+    funcargs = getattr(item, "funcargs", {})
+    manager = funcargs.get("manager")
+    if manager is not None:
+        report.sections.append(("Manager log", manager.logs()[-8000:]))
+    workdir = funcargs.get("workdir")
+    if workdir is not None:
+        for log in sorted(Path(workdir).glob("logs/*.log")):
+            report.sections.append((log.stem, log.read_text(errors="replace")[-4000:]))
+    return report
+
+
 @pytest.fixture(scope="session")
 def workdir() -> Path:
     """A short-pathed working directory.
diff --git a/python/tests/platform_rbac/manager.py b/python/tests/platform_rbac/manager.py
index 38e4acb2967..e5eed8861a6 100644
--- a/python/tests/platform_rbac/manager.py
+++ b/python/tests/platform_rbac/manager.py
@@ -216,7 +216,9 @@ def start(self, config: AuthConfig) -> None:
         assert self._proc is None and self._container is None, "already running"
         self.config = config
         env = {
-            "RUST_LOG": "info",
+            # Why a token was refused is logged at debug in `auth` and `oidc`,
+            # so at plain info a 401 reaches the test with no reason attached.
+            "RUST_LOG": "info,pipeline_manager::auth=debug,pipeline_manager::oidc=debug",
             "RUST_BACKTRACE": "1",
             "FELDERA_UNSTABLE_FEATURES": "runtime_version,testing",
             "SSL_CERT_FILE": str(self._ca_bundle()),

From db8fa85d9d18c7cec7a8772938d6bc92f3cb8f60 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Fri, 31 Jul 2026 12:40:41 -0700
Subject: [PATCH 53/55] [tests] Show what the RBAC container sees of its CA
 bundle

The manager in CI refuses every token because its JWKS fetch cannot verify the
issuer: `InvalidCertificate(UnknownIssuer)`. Two causes produce that identically,
and they need different fixes: `SSL_CERT_FILE` never reaching the process, so the
image's own root store answers instead, or a bundle that arrives and does not
chain to the issuer's certificate.

Dump the container's view on a failing test: the user it runs as, the value of
`SSL_CERT_FILE`, whether that path is readable there, how many certificates it
holds, and `curl` against the issuer both with the bundle and with the ambient
roots. The `curl --cacert` result is the one that separates the two causes.

Local runs are unaffected: the probe only has something to say when the manager
is a container.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 python/tests/platform_rbac/conftest.py |  5 ++++
 python/tests/platform_rbac/manager.py  | 35 ++++++++++++++++++++++++++
 2 files changed, 40 insertions(+)

diff --git a/python/tests/platform_rbac/conftest.py b/python/tests/platform_rbac/conftest.py
index 77e2438661e..af9dc9dccc5 100644
--- a/python/tests/platform_rbac/conftest.py
+++ b/python/tests/platform_rbac/conftest.py
@@ -59,6 +59,11 @@ def pytest_runtest_makereport(item: pytest.Item, call: pytest.CallInfo):
     manager = funcargs.get("manager")
     if manager is not None:
         report.sections.append(("Manager log", manager.logs()[-8000:]))
+        idp = funcargs.get("primary_idp")
+        probe_url = f"{idp.url}/.well-known/openid-configuration" if idp else None
+        view = manager.container_tls_view(probe_url)
+        if view:
+            report.sections.append(("Container TLS view", view))
     workdir = funcargs.get("workdir")
     if workdir is not None:
         for log in sorted(Path(workdir).glob("logs/*.log")):
diff --git a/python/tests/platform_rbac/manager.py b/python/tests/platform_rbac/manager.py
index e5eed8861a6..545ca421fba 100644
--- a/python/tests/platform_rbac/manager.py
+++ b/python/tests/platform_rbac/manager.py
@@ -388,6 +388,41 @@ def failure_summary(self) -> str:
         ]
         return "\n".join(interesting[-20:]) or self.logs()[-2000:]
 
+    def container_tls_view(self, probe_url: str | None = None) -> str:
+        """What the manager's container sees of the CA bundle it was handed.
+
+        A JWKS fetch that cannot verify the issuer looks the same whether
+        `SSL_CERT_FILE` never reached the process or reached it and does not
+        verify that issuer, and those have different fixes. `curl --cacert`
+        against the issuer separates them: it succeeds only when the bundle is
+        readable in the container and does chain to the issuer's certificate.
+        """
+        if not self._container:
+            return ""
+        script = (
+            'echo "user=$(id -un) uid=$(id -u)"\n'
+            'echo "SSL_CERT_FILE=${SSL_CERT_FILE:-<unset>}"\n'
+            'if [ -n "$SSL_CERT_FILE" ]; then\n'
+            '  ls -l "$SSL_CERT_FILE" 2>&1\n'
+            "  echo \"certs_in_bundle=$(grep -c 'BEGIN CERTIFICATE' "
+            '"$SSL_CERT_FILE" 2>/dev/null || echo unreadable)"\n'
+            "fi\n"
+        )
+        if probe_url:
+            script += (
+                f'curl -sS --cacert "$SSL_CERT_FILE" -o /dev/null '
+                f"-w 'curl_with_bundle=%{{http_code}}\\n' '{probe_url}' 2>&1\n"
+                f"curl -sS -o /dev/null "
+                f"-w 'curl_ambient_roots=%{{http_code}}\\n' '{probe_url}' 2>&1\n"
+            )
+        out = subprocess.run(
+            ["docker", "exec", self._container, "sh", "-c", script],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+        return out.stdout + out.stderr
+
     def logs(self) -> str:
         if self._container:
             out = subprocess.run(

From a1222ba257c69511d49e59917fa1ccc9d27c25d4 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Fri, 31 Jul 2026 13:13:09 -0700
Subject: [PATCH 54/55] [pipeline-manager] Trust the configured CA when
 fetching OIDC keys

An issuer behind a private CA could not be reached, so no token from it could be
verified and every authenticated request answered 401. `--private-ca-cert-path`
did not help: it reaches the clients built from `CommonConfig`, and neither OIDC
fetch used those.

The login provider's JWKS fetch made this worse by using a default `awc` client.
awc picks one root source at compile time and `rustls-0_23-webpki-roots` wins
over `rustls-0_23-native-roots` whenever both are enabled. `adapters` asks for
the former and `pipeline-manager` for the latter, so building them together, as
the release image does, left the login provider trusting the public web PKI and
nothing else. `SSL_CERT_FILE` was silently ignored, contrary to what this crate's
manifest says it is for. Building `pipeline-manager` alone kept native roots, so
the two builds disagreed.

Fetch the login provider's keys with the same reqwest client the federated path
uses, and give that client the deployment's configured roots on top of the
platform's. reqwest merges root sources instead of choosing between them, so the
result no longer depends on which crates share the build. Startup discovery takes
the same roots, since it runs before any of this and fails the same way.

`AuthError` loses `JwkPayload` and `JwkContentType`, which only the awc path
produced; a malformed key set now reports `JwkShape` and a failed request
`JwkFetch`.

The RBAC suite names the CA through `--private-ca-cert-path` rather than
`SSL_CERT_FILE`, which is what a deployment with a private CA does and what makes
the suite fail when this regresses: reverting the change stops the manager from
starting, because discovery cannot verify the issuer.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 crates/pipeline-manager/src/api/main.rs   |  7 +-
 crates/pipeline-manager/src/auth.rs       | 83 +++++++++++++----------
 crates/pipeline-manager/src/config.rs     | 23 ++++++-
 crates/pipeline-manager/src/oidc/fetch.rs | 17 +++--
 python/tests/platform_rbac/manager.py     | 52 ++++----------
 5 files changed, 99 insertions(+), 83 deletions(-)

diff --git a/crates/pipeline-manager/src/api/main.rs b/crates/pipeline-manager/src/api/main.rs
index ce94d2f7aaf..8f8d33614f3 100644
--- a/crates/pipeline-manager/src/api/main.rs
+++ b/crates/pipeline-manager/src/api/main.rs
@@ -862,6 +862,9 @@ pub(crate) struct ServerState {
     pub config: ApiServerConfig,
     pub jwk_cache: Arc<Mutex<JwkCache>>,
     pub issuer_jwk_cache: Arc<Mutex<IssuerJwkCache>>,
+    /// Roots an OIDC fetch trusts on top of the platform's, read once here so
+    /// that authenticating a request never touches the filesystem.
+    pub oidc_root_certs: Vec<reqwest::Certificate>,
     probe: Arc<Mutex<DbProbe>>,
     pub demos: Vec<Demo>,
     pub license_check: Arc<RwLock<Option<LicenseCheck>>>,
@@ -877,6 +880,7 @@ impl ServerState {
         let runner = RunnerInteraction::new(common_config.clone(), db.clone());
         let db_copy = db.clone();
         let demos = read_demos_from_directories(&config.demos_dir);
+        let oidc_root_certs = common_config.configured_root_certificates().await?;
         Ok(Self {
             db,
             runner,
@@ -884,6 +888,7 @@ impl ServerState {
             config,
             jwk_cache: Arc::new(Mutex::new(JwkCache::new())),
             issuer_jwk_cache: Arc::new(Mutex::new(IssuerJwkCache::new())),
+            oidc_root_certs,
             probe: DbProbe::new(db_copy).await,
             demos,
             license_check,
@@ -960,7 +965,7 @@ pub async fn run(
         crate::config::AuthProviderType::None => None,
         crate::config::AuthProviderType::AwsCognito => Some(crate::auth::aws_auth_config()),
         crate::config::AuthProviderType::GenericOidc => {
-            match crate::auth::generic_oidc_auth_config(&api_config).await {
+            match crate::auth::generic_oidc_auth_config(&api_config, &state.oidc_root_certs).await {
                 Ok(config) => Some(config),
                 Err(e) => {
                     error!("Failed to configure generic OIDC authentication: {}", e);
diff --git a/crates/pipeline-manager/src/auth.rs b/crates/pipeline-manager/src/auth.rs
index 1e2f0ccb4ba..5d6eca2de5f 100644
--- a/crates/pipeline-manager/src/auth.rs
+++ b/crates/pipeline-manager/src/auth.rs
@@ -61,7 +61,6 @@ use actix_web_httpauth::extractors::{
     bearer::{BearerAuth, Config},
     AuthenticationError,
 };
-use awc::error::JsonPayloadError;
 use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
 use cached::{Cached, TimedCache};
 use jsonwebtoken::{decode, decode_header, Algorithm, DecodingKey, TokenData, Validation};
@@ -82,7 +81,10 @@ use crate::db::storage::Storage;
 use crate::db::storage_postgres::StoragePostgres;
 use crate::db::types::role::Role;
 use crate::db::types::tenant::TenantId;
-use crate::oidc::fetch::{fetch_issuer_jwks, fetch_jwks_uri_from_discovery, OidcDestination};
+use crate::oidc::fetch::{
+    fetch_issuer_jwks, fetch_jwks_uri_from_discovery, oidc_http_client, OidcDestination,
+};
+use reqwest::Certificate;
 
 /// The authenticated principal behind a request, resolved by `auth_validator`
 /// and stored in request extensions. The RBAC middleware reads `role`; handlers
@@ -924,7 +926,7 @@ async fn resolve_issuer_jwk(
         cache.mark_refreshed(issuer);
     }
 
-    let keys = fetch_issuer_jwks(issuer, destination).await?;
+    let keys = fetch_issuer_jwks(issuer, destination, &state.oidc_root_certs).await?;
     let mut cache = state.issuer_jwk_cache.lock().await;
     cache.insert(issuer, keys);
     cache
@@ -976,6 +978,7 @@ pub(crate) fn aws_auth_config() -> AuthConfiguration {
 
 pub(crate) async fn generic_oidc_auth_config(
     api_config: &crate::config::ApiServerConfig,
+    extra_roots: &[Certificate],
 ) -> Result<AuthConfiguration, Box<dyn std::error::Error>> {
     let mut validation = Validation::new(Algorithm::RS256);
     let client_id = env::var("FELDERA_AUTH_CLIENT_ID")
@@ -985,7 +988,9 @@ pub(crate) async fn generic_oidc_auth_config(
 
     // Use OIDC discovery to fetch jwks_uri. The operator set this issuer, so it
     // may name a provider on the deployment's own network.
-    let jwk_uri = fetch_jwks_uri_from_discovery(&iss, OidcDestination::OperatorConfigured).await?;
+    let jwk_uri =
+        fetch_jwks_uri_from_discovery(&iss, OidcDestination::OperatorConfigured, extra_roots)
+            .await?;
 
     validation.set_issuer(&[&iss]);
     // Use configurable audience claim from API server configuration
@@ -1107,9 +1112,7 @@ where
 #[derive(Debug)]
 pub(crate) enum AuthError {
     JwtDecoding(jsonwebtoken::errors::Error),
-    JwkFetch(awc::error::SendRequestError),
-    JwkPayload(awc::error::PayloadError),
-    JwkContentType,
+    JwkFetch(reqwest::Error),
     JwkShape(String),
     NoTenantFound,
     InsufficientGroups,
@@ -1122,9 +1125,7 @@ impl std::fmt::Display for AuthError {
         match self {
             AuthError::JwtDecoding(err) => err.fmt(f),
             AuthError::JwkFetch(err) => err.fmt(f),
-            AuthError::JwkPayload(err) => err.fmt(f),
             AuthError::JwkShape(err) => err.fmt(f),
-            AuthError::JwkContentType => f.write_str("Content type error"),
             AuthError::NoTenantFound => f.write_str("You are not authorized to access any Feldera tenant. Contact your administrator if you need access to Feldera."),
             AuthError::InsufficientGroups => f.write_str("User does not belong to required groups for access."),
             AuthError::MissingTenantHeader => f.write_str("Feldera-Tenant header is required when access token contains multiple tenants."),
@@ -1133,8 +1134,8 @@ impl std::fmt::Display for AuthError {
     }
 }
 
-impl From<awc::error::SendRequestError> for AuthError {
-    fn from(value: awc::error::SendRequestError) -> Self {
+impl From<reqwest::Error> for AuthError {
+    fn from(value: reqwest::Error) -> Self {
         Self::JwkFetch(value)
     }
 }
@@ -1174,7 +1175,9 @@ async fn decode_oidc_token(
 
                     let state = req.app_data::<Data<ServerState>>().unwrap();
                     let cache = &mut state.jwk_cache.lock().await;
-                    let jwk = cache.get(&kid, &configuration.provider).await?;
+                    let jwk = cache
+                        .get(&kid, &configuration.provider, &state.oidc_root_certs)
+                        .await?;
 
                     let token_data = decode::<OidcClaim>(token, &jwk, &configuration.validation);
                     match token_data {
@@ -1326,6 +1329,7 @@ impl JwkCache {
         &mut self,
         key: &String,
         provider: &AuthProvider,
+        extra_roots: &[Certificate],
     ) -> Result<DecodingKey, AuthError> {
         let cache = &mut self.cache;
         let val = &cache.cache_get(key);
@@ -1333,7 +1337,7 @@ impl JwkCache {
             Some(dk) => Ok((*dk).clone()),
             None => {
                 // TODO: Introduce a minimum delay between refreshes
-                let fetched = fetch_jwk_keys(provider).await;
+                let fetched = fetch_jwk_keys(provider, extra_roots).await;
                 match fetched {
                     Ok(map) => {
                         for (key_id, decoding_key) in map {
@@ -1354,40 +1358,45 @@ impl JwkCache {
 
 async fn fetch_jwk_keys(
     provider: &AuthProvider,
+    extra_roots: &[Certificate],
 ) -> Result<HashMap<String, DecodingKey>, AuthError> {
     match &provider {
-        AuthProvider::AwsCognito(provider) => fetch_jwk_oidc_keys(&provider.jwk_uri).await,
-        AuthProvider::GenericOidc(provider) => fetch_jwk_oidc_keys(&provider.jwk_uri).await,
+        AuthProvider::AwsCognito(provider) => {
+            fetch_jwk_oidc_keys(&provider.jwk_uri, extra_roots).await
+        }
+        AuthProvider::GenericOidc(provider) => {
+            fetch_jwk_oidc_keys(&provider.jwk_uri, extra_roots).await
+        }
     }
 }
 
 // We don't want to fetch keys on every authentication attempt, so cache the
 // results. TODO: implement periodic refresh
-async fn fetch_jwk_oidc_keys(url: &String) -> Result<HashMap<String, DecodingKey>, AuthError> {
-    let client = awc::Client::new();
+//
+// This shares the federated path's client so both reach an issuer the same way.
+// A default `awc` client cannot: it picks one root source at compile time, and
+// `rustls-0_23-webpki-roots` wins over `rustls-0_23-native-roots` whenever both
+// are enabled, which happens as soon as the manager is built alongside a crate
+// that asks for the former. The login provider then silently loses every root
+// outside the public web PKI, including this deployment's own CA.
+async fn fetch_jwk_oidc_keys(
+    url: &str,
+    extra_roots: &[Certificate],
+) -> Result<HashMap<String, DecodingKey>, AuthError> {
+    let client = oidc_http_client(OidcDestination::OperatorConfigured, extra_roots)
+        .map_err(|e| AuthError::JwkShape(format!("OIDC client build: {e}")))?;
 
-    let res = client.get(url).send().await;
-    if let Err(e) = &res {
+    let response = client.get(url).send().await.map_err(|e| {
         debug!("JWK fetch request failed: {:?}", e);
-    }
+        AuthError::JwkFetch(e)
+    })?;
 
-    let keys_as_json = res?.json::<Value>().await;
+    let keys_as_json = response.json::<Value>().await.map_err(|e| {
+        debug!("Failed to read JWK response: {}", e);
+        AuthError::JwkShape(e.to_string())
+    })?;
 
-    match keys_as_json {
-        Ok(value) => parse_rsa_jwks(&value),
-        Err(JsonPayloadError::Deserialize(json_error)) => {
-            debug!("Failed to deserialize JWK response: {}", json_error);
-            Err(AuthError::JwkShape(json_error.to_string()))
-        }
-        Err(JsonPayloadError::Payload(payload)) => {
-            debug!("JWK payload error: {:?}", payload);
-            Err(AuthError::JwkPayload(payload))
-        }
-        Err(JsonPayloadError::ContentType) => {
-            debug!("JWK response has invalid content type");
-            Err(AuthError::JwkContentType)
-        }
-    }
+    parse_rsa_jwks(&keys_as_json)
 }
 
 /// Parse a JWK set into RSA decoding keys, keyed by `kid`. Keeps only keys
@@ -1681,7 +1690,7 @@ mod test {
     async fn invalid_url() {
         ensure_default_crypto_provider();
         let url = "http://localhost/doesnotexist".to_owned();
-        let res = fetch_jwk_oidc_keys(&url).await;
+        let res = fetch_jwk_oidc_keys(&url, &[]).await;
         assert!(matches!(res.err().unwrap(), AuthError::JwkFetch(_)));
     }
 
diff --git a/crates/pipeline-manager/src/config.rs b/crates/pipeline-manager/src/config.rs
index d3e4d064055..cff01b60b66 100644
--- a/crates/pipeline-manager/src/config.rs
+++ b/crates/pipeline-manager/src/config.rs
@@ -6,7 +6,7 @@ use crate::db::{error::DBError, types::pipeline::PipelineId};
 use crate::has_unstable_feature;
 use crate::oidc::destination::TenantIssuerPolicy;
 use actix_web::http::header;
-use anyhow::{Error as AnyError, Result as AnyResult};
+use anyhow::{Context, Error as AnyError, Result as AnyResult};
 use clap::Parser;
 use openssl::asn1::Asn1Time;
 use openssl::bn::{BigNum, MsbOption};
@@ -530,6 +530,27 @@ impl CommonConfig {
         paths
     }
 
+    /// The roots this deployment configured, for a client that must keep
+    /// trusting the public web PKI as well.
+    ///
+    /// [`Self::reqwest_client`] replaces the root store outright, which suits a
+    /// call that only ever reaches this deployment. An OIDC fetch is different:
+    /// it may reach a public provider or one sitting behind these certificates,
+    /// so it adds them to the platform's roots rather than replacing them.
+    pub async fn configured_root_certificates(&self) -> AnyResult<Vec<Certificate>> {
+        let mut roots = Vec::new();
+        for path in self.ca_cert_paths() {
+            let pem = tokio::fs::read(path)
+                .await
+                .with_context(|| format!("reading CA certificate '{path}'"))?;
+            roots.extend(
+                Certificate::from_pem_bundle(&pem)
+                    .with_context(|| format!("parsing CA certificate '{path}'"))?,
+            );
+        }
+        Ok(roots)
+    }
+
     /// Creates `awc` client.
     ///
     /// - If HTTPS is enabled for Feldera HTTP servers, the client will only have our root HTTPS
diff --git a/crates/pipeline-manager/src/oidc/fetch.rs b/crates/pipeline-manager/src/oidc/fetch.rs
index 56dc6c41299..3f93629c3bc 100644
--- a/crates/pipeline-manager/src/oidc/fetch.rs
+++ b/crates/pipeline-manager/src/oidc/fetch.rs
@@ -65,8 +65,9 @@ impl reqwest::dns::Resolve for PublicAddrsOnly {
 /// [`PublicAddrsOnly`], so it cannot name an internal service.
 pub(crate) fn oidc_http_client(
     destination: OidcDestination,
+    extra_roots: &[reqwest::Certificate],
 ) -> Result<reqwest::Client, reqwest::Error> {
-    let builder = reqwest::Client::builder()
+    let mut builder = reqwest::Client::builder()
         // rustls with the platform's roots, so which certificates an issuer may
         // present is decided the same way on every platform. The default
         // backend is whatever the target ships, and on macOS that store cannot
@@ -74,6 +75,12 @@ pub(crate) fn oidc_http_client(
         .use_rustls_tls()
         .timeout(Duration::from_secs(OIDC_FETCH_TIMEOUT_SECONDS))
         .redirect(reqwest::redirect::Policy::none());
+    // An issuer may sit behind the deployment's own CA, which the web PKI does
+    // not know. These add to the platform's roots rather than replacing them,
+    // so a public provider still verifies.
+    for root in extra_roots {
+        builder = builder.add_root_certificate(root.clone());
+    }
     match destination {
         OidcDestination::TenantRegistered(TenantIssuerPolicy::PublicHttpsOnly) => {
             builder.dns_resolver(Arc::new(PublicAddrsOnly)).build()
@@ -86,12 +93,13 @@ pub(crate) fn oidc_http_client(
 pub(crate) async fn fetch_jwks_uri_from_discovery(
     issuer: &str,
     destination: OidcDestination,
+    extra_roots: &[reqwest::Certificate],
 ) -> Result<String, reqwest::Error> {
     let discovery_url = format!(
         "{}/.well-known/openid-configuration",
         issuer.trim_end_matches('/')
     );
-    let discovery: OidcDiscoveryDocument = oidc_http_client(destination)?
+    let discovery: OidcDiscoveryDocument = oidc_http_client(destination, extra_roots)?
         .get(&discovery_url)
         .send()
         .await?
@@ -111,8 +119,9 @@ pub(crate) async fn fetch_jwks_uri_from_discovery(
 pub(crate) async fn fetch_issuer_jwks(
     issuer: &str,
     destination: OidcDestination,
+    extra_roots: &[reqwest::Certificate],
 ) -> Result<HashMap<String, DecodingKey>, AuthError> {
-    let jwks_uri = fetch_jwks_uri_from_discovery(issuer, destination)
+    let jwks_uri = fetch_jwks_uri_from_discovery(issuer, destination, extra_roots)
         .await
         .map_err(|e| AuthError::JwkShape(format!("OIDC discovery failed: {e}")))?;
     if let OidcDestination::TenantRegistered(policy) = destination {
@@ -122,7 +131,7 @@ pub(crate) async fn fetch_issuer_jwks(
             ))
         })?;
     }
-    let client = oidc_http_client(destination)
+    let client = oidc_http_client(destination, extra_roots)
         .map_err(|e| AuthError::JwkShape(format!("OIDC client build: {e}")))?;
     let keys_json: Value = client
         .get(&jwks_uri)
diff --git a/python/tests/platform_rbac/manager.py b/python/tests/platform_rbac/manager.py
index 545ca421fba..1b8792a9456 100644
--- a/python/tests/platform_rbac/manager.py
+++ b/python/tests/platform_rbac/manager.py
@@ -172,30 +172,6 @@ def verify(self):
     # container, or the host directory when running the binary directly.
     CONTAINER_STATE = "/state"
 
-    # Root stores a Linux image is likely to ship, in preference order.
-    SYSTEM_CA_BUNDLES = (
-        "/etc/ssl/certs/ca-certificates.crt",
-        "/etc/pki/tls/certs/ca-bundle.crt",
-    )
-
-    def _ca_bundle(self) -> Path:
-        """Roots the manager trusts: the suite's certificate and the platform's.
-
-        The manager reaches every issuer over https, so it has to trust the CA
-        that signed what they serve. Its TLS stack reads `SSL_CERT_FILE`
-        *instead of* the system store rather than in addition to it, so the
-        platform's roots are carried along; without them the manager loses every
-        other outbound https destination.
-        """
-        bundle = self.run_dir / "ca-bundle.crt"
-        roots = [self.ca_cert.read_text()]
-        for path in map(Path, self.SYSTEM_CA_BUNDLES):
-            if path.exists():
-                roots.append(path.read_text())
-                break
-        bundle.write_text("\n".join(roots))
-        return bundle
-
     def _flags(self) -> list[str]:
         root = self.CONTAINER_STATE if self.image else str(self.state_dir)
         flags = [
@@ -208,6 +184,7 @@ def _flags(self) -> list[str]:
                 "--enable-https",
                 f"--https-tls-cert-path={self.cert}",
                 f"--https-tls-key-path={self.key}",
+                f"--private-ca-cert-path={self.ca_cert}",
             ]
         return flags
 
@@ -221,7 +198,6 @@ def start(self, config: AuthConfig) -> None:
             "RUST_LOG": "info,pipeline_manager::auth=debug,pipeline_manager::oidc=debug",
             "RUST_BACKTRACE": "1",
             "FELDERA_UNSTABLE_FEATURES": "runtime_version,testing",
-            "SSL_CERT_FILE": str(self._ca_bundle()),
             **config.env,
         }
         if self.image:
@@ -389,29 +365,25 @@ def failure_summary(self) -> str:
         return "\n".join(interesting[-20:]) or self.logs()[-2000:]
 
     def container_tls_view(self, probe_url: str | None = None) -> str:
-        """What the manager's container sees of the CA bundle it was handed.
+        """What the manager's container sees of the CA it was pointed at.
 
-        A JWKS fetch that cannot verify the issuer looks the same whether
-        `SSL_CERT_FILE` never reached the process or reached it and does not
-        verify that issuer, and those have different fixes. `curl --cacert`
-        against the issuer separates them: it succeeds only when the bundle is
-        readable in the container and does chain to the issuer's certificate.
+        A fetch that cannot verify the issuer looks the same whether the CA
+        never reached the container or reached it and does not chain to the
+        issuer, and those have different fixes. `curl --cacert` separates them:
+        it succeeds only when the file is readable there and does chain.
         """
-        if not self._container:
+        if not self._container or not self.ca_cert:
             return ""
+        ca = self.ca_cert
         script = (
             'echo "user=$(id -un) uid=$(id -u)"\n'
-            'echo "SSL_CERT_FILE=${SSL_CERT_FILE:-<unset>}"\n'
-            'if [ -n "$SSL_CERT_FILE" ]; then\n'
-            '  ls -l "$SSL_CERT_FILE" 2>&1\n'
-            "  echo \"certs_in_bundle=$(grep -c 'BEGIN CERTIFICATE' "
-            '"$SSL_CERT_FILE" 2>/dev/null || echo unreadable)"\n'
-            "fi\n"
+            f'echo "ca_cert={ca}"\n'
+            f'ls -l "{ca}" 2>&1\n'
         )
         if probe_url:
             script += (
-                f'curl -sS --cacert "$SSL_CERT_FILE" -o /dev/null '
-                f"-w 'curl_with_bundle=%{{http_code}}\\n' '{probe_url}' 2>&1\n"
+                f'curl -sS --cacert "{ca}" -o /dev/null '
+                f"-w 'curl_with_ca=%{{http_code}}\\n' '{probe_url}' 2>&1\n"
                 f"curl -sS -o /dev/null "
                 f"-w 'curl_ambient_roots=%{{http_code}}\\n' '{probe_url}' 2>&1\n"
             )

From 22f9d9f2cee5f71f7a26831aba16e88230b37295 Mon Sep 17 00:00:00 2001
From: Gerd Zellweger <mail@gerdzellweger.com>
Date: Fri, 31 Jul 2026 16:21:24 -0700
Subject: [PATCH 55/55] [ci] Cancel the run when a platform integration job
 fails

A failing job in test-integration-platform.yml left its siblings running. The
HTTPS, RBAC and OIDC trust suite could fail in minutes and oss-platform-tests
would still hold a GKE runner for hours.

ci.yml's cancel-if-tests-integration-platform-failed cannot prevent that: it
watches the caller-side invoke-tests-integration-platform job, which stands for
the whole called workflow and reports failure only once every job in it has
finished. build-rust.yml was the only called workflow carrying a sentinel next
to its own job, which is why the scheme looked like it covered everything.

Give each job in test-integration-platform.yml its own sentinel. github.run_id
inside a called workflow names the caller's run, so the cancel takes down the
whole run rather than this workflow alone. Record the rule where ci.yml
documents the scheme, since that is where someone adding a job will look.

Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
---
 .github/workflows/ci.yml                      |  6 +++
 .../workflows/test-integration-platform.yml   | 52 +++++++++++++++++++
 2 files changed, 58 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 466724291ca..647686de674 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,6 +14,12 @@ jobs:
   # watches a single upstream job and immediately cancels the entire run on
   # failure.
   #
+  # A sentinel here watches an `invoke-*` job, which stands for a whole called
+  # workflow and reports failure only once every job in it has finished. A
+  # called workflow that runs several jobs therefore needs its own sentinel per
+  # job, next to those jobs, or one failing job leaves its siblings running.
+  # See build-rust.yml and test-integration-platform.yml.
+  #
   # IMPORTANT: The sentinel cancel is asynchronous. Any job that must not run
   # when a prior job fails MUST also list that job in its `needs:` field and
   # check its result in its `if:` condition — do not rely on the cancel alone.
diff --git a/.github/workflows/test-integration-platform.yml b/.github/workflows/test-integration-platform.yml
index 37c3020ba07..2e46ace194b 100644
--- a/.github/workflows/test-integration-platform.yml
+++ b/.github/workflows/test-integration-platform.yml
@@ -330,3 +330,55 @@ jobs:
         working-directory: crates/fda
         env:
           FDA_BINARY: ${{ github.workspace }}/build/fda
+
+  # One cancel sentinel per job above, following the scheme ci.yml documents.
+  # ci.yml's cancel-if-tests-integration-platform-failed is not enough on its
+  # own: it watches the caller-side job, which reports failure only once every
+  # job here has finished, so a job that fails early leaves its siblings, and
+  # the rest of the run, going for hours. These watch a single job each and
+  # cancel the run as soon as it fails. `github.run_id` is the caller's run,
+  # so the whole run goes down, not just this workflow.
+  cancel-if-manager-no-network-failed:
+    name: Cancel if No-Network Manager Test Failed
+    needs: [manager-no-network]
+    if: failure()
+    runs-on: ubuntu-latest-amd64
+    permissions:
+      actions: write
+    steps:
+      - name: Cancel workflow
+        run: |
+          curl -fsSL -X POST \
+            -H "Authorization: Bearer ${{ github.token }}" \
+            -H "Accept: application/vnd.github+json" \
+            "https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/cancel"
+
+  cancel-if-manager-https-rbac-failed:
+    name: Cancel if HTTPS, RBAC and OIDC Trust Tests Failed
+    needs: [manager-https-rbac]
+    if: failure()
+    runs-on: ubuntu-latest-amd64
+    permissions:
+      actions: write
+    steps:
+      - name: Cancel workflow
+        run: |
+          curl -fsSL -X POST \
+            -H "Authorization: Bearer ${{ github.token }}" \
+            -H "Accept: application/vnd.github+json" \
+            "https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/cancel"
+
+  cancel-if-oss-platform-tests-failed:
+    name: Cancel if OSS Platform Tests Failed
+    needs: [oss-platform-tests]
+    if: failure()
+    runs-on: ubuntu-latest-amd64
+    permissions:
+      actions: write
+    steps:
+      - name: Cancel workflow
+        run: |
+          curl -fsSL -X POST \
+            -H "Authorization: Bearer ${{ github.token }}" \
+            -H "Accept: application/vnd.github+json" \
+            "https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/cancel"