Fix storage metrics not being accurate

- Add theme system (Dark/Light palettes, ModernTheme, ThemeManager)
- Add InputDialog, Spinner common view
- Add DuplicatesCsvExportService
- Refresh views, dialogs, and view models across tabs
- Update localization strings (en/fr)
- Tweak services (transfer, permissions, search, user access, ownership elevation, bulk operations)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.editorconfig

@@ -0,0 +1,16 @@
+root = true
+
+[*.cs]
+indent_style = space
+indent_size = 4
+end_of_line = crlf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+# ConfigureAwait(false) is required in non-UI service/infrastructure code so
+# callers that may still sync-wait cannot deadlock on the WPF dispatcher.
+# Scoped to Services/ and Infrastructure/ — ViewModels legitimately resume on
+# the UI thread for INotifyPropertyChanged updates.
+[{SharepointToolbox/Services/**.cs,SharepointToolbox/Infrastructure/**.cs}]
+dotnet_diagnostic.CA2007.severity = suggestion

SharepointToolbox.Tests/Helpers/SharePointPaginationHelperTests.cs

@@ -9,21 +9,21 @@ public class SharePointPaginationHelperTests
     public void BuildPagedViewXml_NullInput_ReturnsViewWithRowLimit()
     {
         var result = SharePointPaginationHelper.BuildPagedViewXml(null, 2000);
-        Assert.Equal("<View><RowLimit>2000</RowLimit></View>", result);
+        Assert.Equal("<View><RowLimit Paged='TRUE'>2000</RowLimit></View>", result);
     }
 
     [Fact]
     public void BuildPagedViewXml_EmptyString_ReturnsViewWithRowLimit()
     {
         var result = SharePointPaginationHelper.BuildPagedViewXml("", 2000);
-        Assert.Equal("<View><RowLimit>2000</RowLimit></View>", result);
+        Assert.Equal("<View><RowLimit Paged='TRUE'>2000</RowLimit></View>", result);
     }
 
     [Fact]
     public void BuildPagedViewXml_WhitespaceOnly_ReturnsViewWithRowLimit()
     {
         var result = SharePointPaginationHelper.BuildPagedViewXml("   ", 2000);
-        Assert.Equal("<View><RowLimit>2000</RowLimit></View>", result);
+        Assert.Equal("<View><RowLimit Paged='TRUE'>2000</RowLimit></View>", result);
     }
 
     [Fact]
@@ -31,7 +31,15 @@ public class SharePointPaginationHelperTests
     {
         var input = "<View><RowLimit>100</RowLimit></View>";
         var result = SharePointPaginationHelper.BuildPagedViewXml(input, 2000);
-        Assert.Equal("<View><RowLimit>2000</RowLimit></View>", result);
+        Assert.Equal("<View><RowLimit Paged='TRUE'>2000</RowLimit></View>", result);
+    }
+
+    [Fact]
+    public void BuildPagedViewXml_ExistingPagedRowLimit_ReplacesWithNewSize()
+    {
+        var input = "<View><RowLimit Paged='TRUE'>100</RowLimit></View>";
+        var result = SharePointPaginationHelper.BuildPagedViewXml(input, 5000);
+        Assert.Equal("<View><RowLimit Paged='TRUE'>5000</RowLimit></View>", result);
     }
 
     [Fact]
@@ -39,10 +47,9 @@ public class SharePointPaginationHelperTests
     {
         var input = "<View><Query><OrderBy><FieldRef Name='Title'/></OrderBy></Query></View>";
         var result = SharePointPaginationHelper.BuildPagedViewXml(input, 2000);
-        Assert.Contains("<RowLimit>2000</RowLimit>", result);
+        Assert.Contains("<RowLimit Paged='TRUE'>2000</RowLimit>", result);
         Assert.EndsWith("</View>", result);
-        // Ensure RowLimit is inserted before the closing </View>
+        var rowLimitIndex = result.IndexOf("<RowLimit Paged='TRUE'>2000</RowLimit>", StringComparison.Ordinal);
-        var rowLimitIndex = result.IndexOf("<RowLimit>2000</RowLimit>", StringComparison.Ordinal);
         var closingViewIndex = result.LastIndexOf("</View>", StringComparison.Ordinal);
         Assert.True(rowLimitIndex < closingViewIndex, "RowLimit should appear before </View>");
     }

SharepointToolbox.Tests/Services/Export/HtmlExportServiceTests.cs

@@ -115,7 +115,7 @@ public class HtmlExportServiceTests
         var svc = new HtmlExportService();
         var html = svc.BuildHtml(new[] { entry }, null, groupMembers);
 
-        Assert.Contains("onclick=\"toggleGroup('grpmem0')\"", html);
+        Assert.Contains("data-group-target=\"grpmem0\"", html);
         Assert.Contains("class=\"user-pill group-expandable\"", html);
     }
 
@@ -152,7 +152,8 @@ public class HtmlExportServiceTests
         var svc = new HtmlExportService();
         var html = svc.BuildHtml(new[] { entry }, null, groupMembers);
 
-        Assert.Contains("function toggleGroup", html);
+        Assert.Contains("data-group-target", html);
+        Assert.Contains("getAttribute('data-group-target')", html);
     }
 
     [Fact]
@@ -165,7 +166,7 @@ public class HtmlExportServiceTests
         var svc = new HtmlExportService();
         var html = svc.BuildHtml(new[] { simplifiedEntry }, null, groupMembers);
 
-        Assert.Contains("onclick=\"toggleGroup('grpmem0')\"", html);
+        Assert.Contains("data-group-target=\"grpmem0\"", html);
         Assert.Contains("class=\"user-pill group-expandable\"", html);
     }
 }

SharepointToolbox.Tests/Services/StorageServiceTests.cs

@@ -28,4 +28,21 @@ public class StorageServiceTests
         var node = new StorageNode { TotalSizeBytes = 5000L, FileStreamSizeBytes = 3000L };
         Assert.Equal(2000L, node.VersionSizeBytes);
     }
+
+    [Fact]
+    public void StorageNode_DefaultKind_IsLibrary()
+    {
+        var node = new StorageNode();
+        Assert.Equal(StorageNodeKind.Library, node.Kind);
+    }
+
+    [Fact]
+    public void StorageScanOptions_DefaultIncludeFlags_AreAllTrue()
+    {
+        var opts = new StorageScanOptions();
+        Assert.True(opts.IncludeHiddenLibraries);
+        Assert.True(opts.IncludePreservationHold);
+        Assert.True(opts.IncludeListAttachments);
+        Assert.True(opts.IncludeRecycleBin);
+    }
 }

SharepointToolbox.Tests/ViewModels/Dialogs/SitePickerDialogLogicTests.cs

@@ -0,0 +1,88 @@
+using System.ComponentModel;
+using SharepointToolbox.ViewModels.Dialogs;
+using SharepointToolbox.Views.Dialogs;
+using Xunit;
+
+namespace SharepointToolbox.Tests.ViewModels.Dialogs;
+
+public class SitePickerDialogLogicTests
+{
+    private static SitePickerItem Item(string url, string title, long sizeMb = 0, string template = "")
+        => new(url, title, sizeMb, 0, template);
+
+    [Fact]
+    public void ApplyFilter_TextFilter_MatchesUrlOrTitle_CaseInsensitive()
+    {
+        var items = new[]
+        {
+            Item("https://t/sites/hr", "HR Team"),
+            Item("https://t/sites/finance", "Finance"),
+        };
+
+        var result = SitePickerDialogLogic.ApplyFilter(items, "fINaNce", 0, long.MaxValue, "All").ToList();
+
+        Assert.Single(result);
+        Assert.Equal("Finance", result[0].Title);
+    }
+
+    [Fact]
+    public void ApplyFilter_SizeRange_FiltersInclusively()
+    {
+        var items = new[]
+        {
+            Item("a", "A", sizeMb: 100),
+            Item("b", "B", sizeMb: 500),
+            Item("c", "C", sizeMb: 1200),
+        };
+
+        var result = SitePickerDialogLogic.ApplyFilter(items, "", 100, 600, "All").ToList();
+
+        Assert.Equal(2, result.Count);
+        Assert.Contains(result, i => i.Title == "A");
+        Assert.Contains(result, i => i.Title == "B");
+    }
+
+    [Fact]
+    public void ApplyFilter_KindAll_SkipsKindCheck()
+    {
+        var items = new[] { Item("a", "A", template: "STS#3"), Item("b", "B", template: "GROUP#0") };
+
+        var result = SitePickerDialogLogic.ApplyFilter(items, "", 0, long.MaxValue, "All").ToList();
+
+        Assert.Equal(2, result.Count);
+    }
+
+    [Fact]
+    public void ApplySort_UnknownColumn_ReturnsInputUnchanged()
+    {
+        var items = new[] { Item("b", "B"), Item("a", "A") };
+
+        var result = SitePickerDialogLogic.ApplySort(items, "Nonexistent", ListSortDirection.Ascending).ToList();
+
+        Assert.Equal("B", result[0].Title);
+        Assert.Equal("A", result[1].Title);
+    }
+
+    [Fact]
+    public void ApplySort_Title_Ascending_And_Descending()
+    {
+        var items = new[] { Item("b", "B"), Item("a", "A"), Item("c", "C") };
+
+        var asc = SitePickerDialogLogic.ApplySort(items, "Title", ListSortDirection.Ascending).ToList();
+        var desc = SitePickerDialogLogic.ApplySort(items, "Title", ListSortDirection.Descending).ToList();
+
+        Assert.Equal(new[] { "A", "B", "C" }, asc.Select(i => i.Title));
+        Assert.Equal(new[] { "C", "B", "A" }, desc.Select(i => i.Title));
+    }
+
+    [Theory]
+    [InlineData("", 42L, 42L)]
+    [InlineData("   ", 42L, 42L)]
+    [InlineData("not-a-number", 42L, 42L)]
+    [InlineData("100", 42L, 100L)]
+    [InlineData("  100  ", 42L, 100L)]
+    public void ParseLongOrDefault_HandlesEmptyAndInvalid(string input, long fallback, long expected)
+    {
+        Assert.Equal(expected, SitePickerDialogLogic.ParseLongOrDefault(input, fallback));
+    }
+}

SharepointToolbox.Tests/ViewModels/FeatureViewModelBaseTests.cs

@@ -44,19 +44,25 @@ public class FeatureViewModelBaseTests
     public async Task ProgressValue_AndStatusMessage_UpdateViaIProgress()
     {
         var vm = new TestViewModel();
+        int midProgress = -1;
+        string? midStatus = null;
+
         vm.OperationFunc = async (ct, progress) =>
         {
             progress.Report(new OperationProgress(50, 100, "halfway"));
-            await Task.Yield();
+            // Let the Progress<T> callback dispatch before sampling.
+            await Task.Delay(20, ct);
+            midProgress = vm.ProgressValue;
+            midStatus   = vm.StatusMessage;
         };
 
         await vm.RunCommand.ExecuteAsync(null);
 
-        // Allow dispatcher to process
+        // Mid-operation snapshot confirms IProgress reaches bound properties.
-        await Task.Delay(20);
+        // Post-completion, FeatureViewModelBase snaps to 100% / "Complete"
-
+        // so stale "Scanning X" labels don't linger after a successful run.
-        Assert.Equal(50, vm.ProgressValue);
+        Assert.Equal(50, midProgress);
-        Assert.Equal("halfway", vm.StatusMessage);
+        Assert.Equal("halfway", midStatus);
     }
 
     [Fact]

SharepointToolbox.Tests/ViewModels/ProfileManagementViewModelRegistrationTests.cs

@@ -87,11 +87,11 @@ public class ProfileManagementViewModelRegistrationTests : IDisposable
     }
 
     [Fact]
-    public async Task RegisterApp_ShowsFallback_WhenNotAdmin()
+    public async Task RegisterApp_ShowsFallback_WhenGraphReturnsFallbackRequired()
     {
         _mockAppReg
-            .Setup(s => s.IsGlobalAdminAsync(It.IsAny<string>(), It.IsAny<CancellationToken>()))
+            .Setup(s => s.RegisterAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>(), It.IsAny<CancellationToken>()))
-            .ReturnsAsync(false);
+            .ReturnsAsync(AppRegistrationResult.FallbackRequired());
 
         var vm = CreateViewModel();
         vm.SelectedProfile = MakeProfile(appId: null);
@@ -105,10 +105,7 @@ public class ProfileManagementViewModelRegistrationTests : IDisposable
     public async Task RegisterApp_SetsAppId_OnSuccess()
     {
         _mockAppReg
-            .Setup(s => s.IsGlobalAdminAsync(It.IsAny<string>(), It.IsAny<CancellationToken>()))
+            .Setup(s => s.RegisterAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>(), It.IsAny<CancellationToken>()))
-            .ReturnsAsync(true);
-        _mockAppReg
-            .Setup(s => s.RegisterAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<CancellationToken>()))
             .ReturnsAsync(AppRegistrationResult.Success("new-app-id-123"));
 
         var profileService = new ProfileService(new ProfileRepository(_tempFile));
@@ -132,7 +129,7 @@ public class ProfileManagementViewModelRegistrationTests : IDisposable
     public async Task RemoveApp_ClearsAppId()
     {
         _mockAppReg
-            .Setup(s => s.RemoveAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<CancellationToken>()))
+            .Setup(s => s.RemoveAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>(), It.IsAny<CancellationToken>()))
             .Returns(Task.CompletedTask);
         _mockAppReg
             .Setup(s => s.ClearMsalSessionAsync(It.IsAny<string>(), It.IsAny<string>()))

SharepointToolbox.Tests/ViewModels/SettingsViewModelLogoTests.cs

@@ -32,7 +32,7 @@ public class SettingsViewModelLogoTests : IDisposable
         var settingsService = new SettingsService(new SettingsRepository(_tempFile));
         var mockBranding = brandingService ?? new Mock<IBrandingService>().Object;
         var logger = NullLogger<FeatureViewModelBase>.Instance;
-        return new SettingsViewModel(settingsService, mockBranding, logger);
+        return new SettingsViewModel(settingsService, mockBranding, new ThemeManager(NullLogger<ThemeManager>.Instance), logger);
     }
 
     [Fact]

SharepointToolbox.Tests/ViewModels/SettingsViewModelOwnershipTests.cs

@@ -30,7 +30,7 @@ public class SettingsViewModelOwnershipTests : IDisposable
         var settingsService = new SettingsService(new SettingsRepository(_tempFile));
         var mockBranding = new Mock<IBrandingService>().Object;
         var logger = NullLogger<FeatureViewModelBase>.Instance;
-        return new SettingsViewModel(settingsService, mockBranding, logger);
+        return new SettingsViewModel(settingsService, mockBranding, new ThemeManager(NullLogger<ThemeManager>.Instance), logger);
     }
 
     [Fact]
@@ -50,7 +50,7 @@ public class SettingsViewModelOwnershipTests : IDisposable
         var settingsService = new SettingsService(new SettingsRepository(_tempFile));
         var mockBranding = new Mock<IBrandingService>().Object;
         var logger = NullLogger<FeatureViewModelBase>.Instance;
-        var vm = new SettingsViewModel(settingsService, mockBranding, logger);
+        var vm = new SettingsViewModel(settingsService, mockBranding, new ThemeManager(NullLogger<ThemeManager>.Instance), logger);
 
         await vm.LoadAsync();
         vm.AutoTakeOwnership = true;

SharepointToolbox.Tests/ViewModels/StorageViewModelFilterTests.cs

@@ -0,0 +1,141 @@
+using System.Reflection;
+using CommunityToolkit.Mvvm.Messaging;
+using Microsoft.Extensions.Logging.Abstractions;
+using Moq;
+using SharepointToolbox.Core.Models;
+using SharepointToolbox.Services;
+using SharepointToolbox.ViewModels;
+using SharepointToolbox.ViewModels.Tabs;
+using Xunit;
+
+namespace SharepointToolbox.Tests.ViewModels;
+
+/// <summary>
+/// Verifies that the report filter flags (Show*) project the raw scan output
+/// (<c>_allNodes</c>) into <c>Results</c> correctly: hiding a kind drops the
+/// matching root nodes plus their entire subtree, preserving DFS ordering.
+/// </summary>
+public class StorageViewModelFilterTests
+{
+    public StorageViewModelFilterTests() => WeakReferenceMessenger.Default.Reset();
+
+    private static StorageViewModel CreateVm()
+    {
+        var vm = new StorageViewModel(
+            new Mock<IStorageService>().Object,
+            new Mock<ISessionManager>().Object,
+            NullLogger<FeatureViewModelBase>.Instance);
+        vm.SetCurrentProfile(new TenantProfile { Name = "T", TenantUrl = "https://t", ClientId = "c" });
+        return vm;
+    }
+
+    /// <summary>Inject a flat node list straight into the private _allNodes field
+    /// and trigger a rebuild via toggling a Show flag.</summary>
+    private static void Seed(StorageViewModel vm, List<StorageNode> flat)
+    {
+        var field = typeof(StorageViewModel).GetField("_allNodes",
+            BindingFlags.Instance | BindingFlags.NonPublic)!;
+        field.SetValue(vm, flat);
+        // Toggle off+on to force RebuildFilteredResults().
+        vm.ShowLibraries = false;
+        vm.ShowLibraries = true;
+    }
+
+    private static List<StorageNode> MakeMixedTree() => new()
+    {
+        new() { Name = "Documents", Kind = StorageNodeKind.Library, IndentLevel = 0, TotalSizeBytes = 100 },
+        new() { Name = "Sub",       Kind = StorageNodeKind.Library, IndentLevel = 1, TotalSizeBytes = 50  },
+        new() { Name = "Preserve",  Kind = StorageNodeKind.PreservationHold, IndentLevel = 0, TotalSizeBytes = 200 },
+        new() { Name = "[Recycle]", Kind = StorageNodeKind.RecycleBin,       IndentLevel = 0, TotalSizeBytes = 300 },
+        new() { Name = "[Attach] L",Kind = StorageNodeKind.ListAttachments,  IndentLevel = 0, TotalSizeBytes = 75  },
+    };
+
+    [Fact]
+    public void AllShowFlagsTrue_AllNodesAppear()
+    {
+        var vm = CreateVm();
+        Seed(vm, MakeMixedTree());
+        Assert.Equal(5, vm.Results.Count);
+    }
+
+    [Fact]
+    public void HideRecycleBin_RemovesOnlyRecycleNode()
+    {
+        var vm = CreateVm();
+        Seed(vm, MakeMixedTree());
+        vm.ShowRecycleBin = false;
+        Assert.DoesNotContain(vm.Results, n => n.Kind == StorageNodeKind.RecycleBin);
+        Assert.Equal(4, vm.Results.Count);
+    }
+
+    [Fact]
+    public void HidePreservationHold_RemovesPreservationNode()
+    {
+        var vm = CreateVm();
+        Seed(vm, MakeMixedTree());
+        vm.ShowPreservationHold = false;
+        Assert.DoesNotContain(vm.Results, n => n.Kind == StorageNodeKind.PreservationHold);
+    }
+
+    [Fact]
+    public void HideLibraries_DropsLibraryRootAndItsChildren()
+    {
+        var vm = CreateVm();
+        Seed(vm, MakeMixedTree());
+        vm.ShowLibraries = false;
+        // "Documents" + "Sub" both gone — Sub's subtree dropped with its parent root.
+        Assert.DoesNotContain(vm.Results, n => n.Name == "Documents");
+        Assert.DoesNotContain(vm.Results, n => n.Name == "Sub");
+    }
+
+    [Fact]
+    public void CombineRecycleBinStages_True_MergesStagesIntoSingleRow()
+    {
+        var vm = CreateVm();
+        var nodes = new List<StorageNode>
+        {
+            new() { Name = "[Recycle Bin] First-stage",  Kind = StorageNodeKind.RecycleBin, IndentLevel = 0,
+                    SiteTitle = "S1", TotalSizeBytes = 100, FileStreamSizeBytes = 100, TotalFileCount = 3 },
+            new() { Name = "[Recycle Bin] Second-stage", Kind = StorageNodeKind.RecycleBin, IndentLevel = 0,
+                    SiteTitle = "S1", TotalSizeBytes = 250, FileStreamSizeBytes = 250, TotalFileCount = 7 },
+        };
+        Seed(vm, nodes);
+        vm.CombineRecycleBinStages = true;
+
+        var bins = vm.Results.Where(n => n.Kind == StorageNodeKind.RecycleBin).ToList();
+        Assert.Single(bins);
+        Assert.Equal(350, bins[0].TotalSizeBytes);
+        Assert.Equal(10,  bins[0].TotalFileCount);
+    }
+
+    [Fact]
+    public void CombineRecycleBinStages_False_KeepsSeparateRows()
+    {
+        var vm = CreateVm();
+        var nodes = new List<StorageNode>
+        {
+            new() { Name = "[Recycle Bin] First-stage",  Kind = StorageNodeKind.RecycleBin, IndentLevel = 0,
+                    SiteTitle = "S1", TotalSizeBytes = 100 },
+            new() { Name = "[Recycle Bin] Second-stage", Kind = StorageNodeKind.RecycleBin, IndentLevel = 0,
+                    SiteTitle = "S1", TotalSizeBytes = 250 },
+        };
+        Seed(vm, nodes);
+        vm.CombineRecycleBinStages = false;
+
+        Assert.Equal(2, vm.Results.Count(n => n.Kind == StorageNodeKind.RecycleBin));
+    }
+
+    [Fact]
+    public void HideAll_LeavesEmptyResults()
+    {
+        var vm = CreateVm();
+        Seed(vm, MakeMixedTree());
+        vm.ShowLibraries = false;
+        vm.ShowHiddenLibraries = false;
+        vm.ShowPreservationHold = false;
+        vm.ShowListAttachments = false;
+        vm.ShowRecycleBin = false;
+        vm.ShowSubsites = false;
+        Assert.Empty(vm.Results);
+    }
+}

SharepointToolbox/App.xaml

@@ -4,16 +4,24 @@
              xmlns:local="clr-namespace:SharepointToolbox"
              xmlns:conv="clr-namespace:SharepointToolbox.Views.Converters">
     <Application.Resources>
-        <BooleanToVisibilityConverter x:Key="BoolToVisibilityConverter" />
+        <ResourceDictionary>
-        <conv:IndentConverter            x:Key="IndentConverter" />
+            <ResourceDictionary.MergedDictionaries>
-        <conv:BytesConverter             x:Key="BytesConverter" />
+                <ResourceDictionary Source="/Themes/LightPalette.xaml" />
-        <conv:InverseBoolConverter       x:Key="InverseBoolConverter" />
+                <ResourceDictionary Source="/Themes/ModernTheme.xaml" />
-        <conv:EnumBoolConverter          x:Key="EnumBoolConverter" />
+            </ResourceDictionary.MergedDictionaries>
-        <conv:StringToVisibilityConverter x:Key="StringToVisibilityConverter" />
+            <BooleanToVisibilityConverter x:Key="BoolToVisibilityConverter" />
-        <conv:ListToStringConverter      x:Key="ListToStringConverter" />
+            <conv:IndentConverter            x:Key="IndentConverter" />
-        <conv:Base64ToImageSourceConverter x:Key="Base64ToImageConverter" />
+            <conv:BytesConverter             x:Key="BytesConverter" />
-        <Style x:Key="RightAlignStyle" TargetType="TextBlock">
+            <conv:InverseBoolConverter       x:Key="InverseBoolConverter" />
-            <Setter Property="HorizontalAlignment" Value="Right" />
+            <conv:EnumBoolConverter          x:Key="EnumBoolConverter" />
-        </Style>
+            <conv:StringToVisibilityConverter x:Key="StringToVisibilityConverter" />
+            <conv:ListToStringConverter      x:Key="ListToStringConverter" />
+            <conv:StorageKindConverter       x:Key="StorageKindConverter" />
+            <conv:Base64ToImageSourceConverter x:Key="Base64ToImageConverter" />
+            <Style x:Key="RightAlignStyle" TargetType="TextBlock">
+                <Setter Property="HorizontalAlignment" Value="Right" />
+                <Setter Property="Foreground" Value="{DynamicResource TextBrush}" />
+            </Style>
+        </ResourceDictionary>
     </Application.Resources>
 </Application>

SharepointToolbox/App.xaml.cs

@@ -34,9 +34,34 @@ public partial class App : Application
             .Build();
 
         host.Start();
+
+        // Apply persisted language before any UI is created so bindings resolve to the saved culture.
+        try
+        {
+            var settings = host.Services.GetRequiredService<SettingsService>().GetSettingsAsync().GetAwaiter().GetResult();
+            if (!string.IsNullOrWhiteSpace(settings.Lang))
+                Localization.TranslationSource.Instance.CurrentCulture = new System.Globalization.CultureInfo(settings.Lang);
+        }
+        catch (Exception ex)
+        {
+            Log.Warning(ex, "Failed to apply persisted language at startup");
+        }
+
         App app = new();
         app.InitializeComponent();
 
+        // Apply persisted theme (System/Light/Dark) before MainWindow constructs so brushes resolve correctly.
+        try
+        {
+            var theme = host.Services.GetRequiredService<ThemeManager>();
+            var settings = host.Services.GetRequiredService<SettingsService>().GetSettingsAsync().GetAwaiter().GetResult();
+            theme.ApplyFromString(settings.Theme);
+        }
+        catch (Exception ex)
+        {
+            Log.Warning(ex, "Failed to apply persisted theme at startup");
+        }
+
         var mainWindow = host.Services.GetRequiredService<MainWindow>();
 
         // Wire LogPanelSink now that we have the RichTextBox
@@ -88,6 +113,7 @@ public partial class App : Application
         services.AddSingleton<ISessionManager>(sp => sp.GetRequiredService<SessionManager>());
         services.AddSingleton<ProfileService>();
         services.AddSingleton<SettingsService>();
+        services.AddSingleton<ThemeManager>();
         services.AddSingleton<MainWindowViewModel>();
         // Phase 11-04: ProfileManagementViewModel and SettingsViewModel now receive IBrandingService and GraphClientFactory
         services.AddTransient<ProfileManagementViewModel>();
@@ -112,9 +138,16 @@ public partial class App : Application
         // Phase 3: Duplicates
         services.AddTransient<IDuplicatesService, DuplicatesService>();
         services.AddTransient<DuplicatesHtmlExportService>();
+        services.AddTransient<DuplicatesCsvExportService>();
         services.AddTransient<DuplicatesViewModel>();
         services.AddTransient<DuplicatesView>();
 
+        // Versions cleanup
+        services.AddTransient<IVersionCleanupService, VersionCleanupService>();
+        services.AddTransient<VersionCleanupHtmlExportService>();
+        services.AddTransient<VersionCleanupViewModel>();
+        services.AddTransient<VersionCleanupView>();
+
         // Phase 2: Permissions
         services.AddTransient<IPermissionsService, PermissionsService>();
         services.AddTransient<ISiteListService, SiteListService>();

SharepointToolbox/Core/Helpers/SharePointPaginationHelper.cs

@@ -6,9 +6,12 @@ namespace SharepointToolbox.Core.Helpers;
 
 public static class SharePointPaginationHelper
 {
+    // Max page size SharePoint honors with Paged='TRUE' (threshold bypass).
+    private const int DefaultRowLimit = 5000;
+
     /// <summary>
     /// Enumerates all items in a SharePoint list, bypassing the 5,000-item threshold.
-    /// Uses CamlQuery with RowLimit=2000 and ListItemCollectionPosition for pagination.
+    /// Uses CamlQuery with Paged='TRUE' RowLimit and ListItemCollectionPosition for pagination.
     /// Never call ExecuteQuery directly on a list — always use this helper.
     /// </summary>
     public static async IAsyncEnumerable<ListItem> GetAllItemsAsync(
@@ -18,7 +21,7 @@ public static class SharePointPaginationHelper
         [EnumeratorCancellation] CancellationToken ct = default)
     {
         var query = baseQuery ?? CamlQuery.CreateAllItemsQuery();
-        query.ViewXml = BuildPagedViewXml(query.ViewXml, rowLimit: 2000);
+        query.ViewXml = BuildPagedViewXml(query.ViewXml, DefaultRowLimit);
         query.ListItemCollectionPosition = null;
 
         do
@@ -36,21 +39,75 @@ public static class SharePointPaginationHelper
         while (query.ListItemCollectionPosition != null);
     }
 
+    /// <summary>
+    /// Enumerates items within a specific folder (direct children by default, or
+    /// recursive when <paramref name="recursive"/> is true). Uses paginated CAML
+    /// with no WHERE clause so it works on libraries above the 5,000-item threshold.
+    /// Callers filter by FSObjType client-side via the returned ListItem fields.
+    /// </summary>
+    public static async IAsyncEnumerable<ListItem> GetItemsInFolderAsync(
+        ClientContext ctx,
+        List list,
+        string folderServerRelativeUrl,
+        bool recursive,
+        string[]? viewFields = null,
+        [EnumeratorCancellation] CancellationToken ct = default)
+    {
+        var fields = viewFields ?? new[]
+        {
+            "FSObjType", "FileRef", "FileLeafRef", "FileDirRef", "File_x0020_Size"
+        };
+
+        var viewFieldsXml = string.Join(string.Empty,
+            fields.Select(f => $"<FieldRef Name='{f}' />"));
+
+        var scope = recursive ? " Scope='RecursiveAll'" : string.Empty;
+        var viewXml =
+            $"<View{scope}>" +
+              "<Query></Query>" +
+              $"<ViewFields>{viewFieldsXml}</ViewFields>" +
+              $"<RowLimit Paged='TRUE'>{DefaultRowLimit}</RowLimit>" +
+            "</View>";
+
+        var query = new CamlQuery
+        {
+            ViewXml = viewXml,
+            FolderServerRelativeUrl = folderServerRelativeUrl,
+            ListItemCollectionPosition = null
+        };
+
+        do
+        {
+            ct.ThrowIfCancellationRequested();
+            var items = list.GetItems(query);
+            ctx.Load(items);
+            await ctx.ExecuteQueryAsync();
+
+            foreach (var item in items)
+                yield return item;
+
+            query.ListItemCollectionPosition = items.ListItemCollectionPosition;
+        }
+        while (query.ListItemCollectionPosition != null);
+    }
+
     internal static string BuildPagedViewXml(string? existingXml, int rowLimit)
     {
-        // Inject or replace RowLimit in existing CAML, or create minimal view
         if (string.IsNullOrWhiteSpace(existingXml))
-            return $"<View><RowLimit>{rowLimit}</RowLimit></View>";
+            return $"<View><RowLimit Paged='TRUE'>{rowLimit}</RowLimit></View>";
 
-        // Simple replacement approach — adequate for Phase 1
+        // Replace any existing <RowLimit ...>n</RowLimit> with paged form.
-        if (existingXml.Contains("<RowLimit>", StringComparison.OrdinalIgnoreCase))
+        if (System.Text.RegularExpressions.Regex.IsMatch(
+                existingXml, @"<RowLimit[^>]*>\d+</RowLimit>",
+                System.Text.RegularExpressions.RegexOptions.IgnoreCase))
         {
             return System.Text.RegularExpressions.Regex.Replace(
                 existingXml, @"<RowLimit[^>]*>\d+</RowLimit>",
-                $"<RowLimit>{rowLimit}</RowLimit>",
+                $"<RowLimit Paged='TRUE'>{rowLimit}</RowLimit>",
                 System.Text.RegularExpressions.RegexOptions.IgnoreCase);
         }
-        return existingXml.Replace("</View>", $"<RowLimit>{rowLimit}</RowLimit></View>",
+        return existingXml.Replace("</View>",
+            $"<RowLimit Paged='TRUE'>{rowLimit}</RowLimit></View>",
             StringComparison.OrdinalIgnoreCase);
     }
 }

SharepointToolbox/Core/Models/AppSettings.cs

@@ -5,4 +5,5 @@ public class AppSettings
     public string DataFolder { get; set; } = string.Empty;
     public string Lang { get; set; } = "en";
     public bool AutoTakeOwnership { get; set; } = false;
+    public string Theme { get; set; } = "System"; // System | Light | Dark
 }

SharepointToolbox/Core/Models/DuplicateItem.cs

@@ -10,4 +10,8 @@ public class DuplicateItem
     public DateTime? Modified { get; set; }
     public int? FolderCount { get; set; }
     public int? FileCount { get; set; }
+    /// <summary>URL of the site the item was collected from.</summary>
+    public string SiteUrl { get; set; } = string.Empty;
+    /// <summary>Friendly site title; falls back to a derived label when unknown.</summary>
+    public string SiteTitle { get; set; } = string.Empty;
 }

SharepointToolbox/Core/Models/OperationProgress.cs

@@ -1,7 +1,7 @@
 namespace SharepointToolbox.Core.Models;
 
-public record OperationProgress(int Current, int Total, string Message)
+public record OperationProgress(int Current, int Total, string Message, bool IsIndeterminate = false)
 {
     public static OperationProgress Indeterminate(string message) =>
-        new(0, 0, message);
+        new(0, 0, message, IsIndeterminate: true);
 }

SharepointToolbox/Core/Models/SiteInfo.cs

@@ -1,3 +1,42 @@
 namespace SharepointToolbox.Core.Models;
 
-public record SiteInfo(string Url, string Title);
+public record SiteInfo(string Url, string Title)
+{
+    public long StorageUsedMb { get; init; }
+    public long StorageQuotaMb { get; init; }
+    public string Template { get; init; } = string.Empty;
+
+    public SiteKind Kind => SiteKindHelper.FromTemplate(Template);
+}
+
+public enum SiteKind
+{
+    Unknown,
+    TeamSite,
+    CommunicationSite,
+    Classic
+}
+
+public static class SiteKindHelper
+{
+    public static SiteKind FromTemplate(string template)
+    {
+        if (string.IsNullOrEmpty(template)) return SiteKind.Unknown;
+        if (template.StartsWith("GROUP#", StringComparison.OrdinalIgnoreCase)) return SiteKind.TeamSite;
+        if (template.StartsWith("SITEPAGEPUBLISHING#", StringComparison.OrdinalIgnoreCase)) return SiteKind.CommunicationSite;
+        if (template.StartsWith("STS#", StringComparison.OrdinalIgnoreCase)) return SiteKind.Classic;
+        return SiteKind.Unknown;
+    }
+
+    public static string DisplayName(SiteKind kind)
+    {
+        var key = kind switch
+        {
+            SiteKind.TeamSite => "sitepicker.kind.teamsite",
+            SiteKind.CommunicationSite => "sitepicker.kind.communication",
+            SiteKind.Classic => "sitepicker.kind.classic",
+            _ => "sitepicker.kind.other"
+        };
+        return Localization.TranslationSource.Instance[key];
+    }
+}

SharepointToolbox/Core/Models/StorageNode.cs

@@ -12,5 +12,6 @@ public class StorageNode
     public long TotalFileCount { get; set; }
     public DateTime? LastModified { get; set; }
     public int IndentLevel { get; set; }
+    public StorageNodeKind Kind { get; set; } = StorageNodeKind.Library;
     public List<StorageNode> Children { get; set; } = new();
 }

SharepointToolbox/Core/Models/StorageNodeKind.cs

@@ -0,0 +1,15 @@
+namespace SharepointToolbox.Core.Models;
+
+/// <summary>
+/// Classification used to filter storage report output. Every node is captured
+/// during a scan; the report user picks which categories appear.
+/// </summary>
+public enum StorageNodeKind
+{
+    Library,
+    HiddenLibrary,
+    PreservationHold,
+    ListAttachments,
+    RecycleBin,
+    Subsite
+}

SharepointToolbox/Core/Models/StorageScanOptions.cs

@@ -3,5 +3,9 @@ namespace SharepointToolbox.Core.Models;
 public record StorageScanOptions(
     bool PerLibrary = true,
     bool IncludeSubsites = false,
-    int FolderDepth = 0   // 0 = library root only; >0 = recurse N levels
+    int FolderDepth = 0,             // 0 = library root only; >0 = recurse N levels
+    bool IncludeHiddenLibraries = true,
+    bool IncludePreservationHold = true,
+    bool IncludeListAttachments = true,
+    bool IncludeRecycleBin = true
 );

SharepointToolbox/Core/Models/TransferJob.cs

@@ -10,4 +10,24 @@ public class TransferJob
     public string DestinationFolderPath { get; set; } = string.Empty;
     public TransferMode Mode { get; set; } = TransferMode.Copy;
     public ConflictPolicy ConflictPolicy { get; set; } = ConflictPolicy.Skip;
+
+    /// <summary>
+    /// Optional library-relative file paths. When non-empty, only these files
+    /// are transferred; SourceFolderPath recursive enumeration is skipped.
+    /// </summary>
+    public IReadOnlyList<string> SelectedFilePaths { get; set; } = Array.Empty<string>();
+
+    /// <summary>
+    /// When true, recreate the source folder name under the destination folder
+    /// (dest/srcFolderName/... ). When false, the source folder's contents land
+    /// directly inside the destination folder.
+    /// </summary>
+    public bool IncludeSourceFolder { get; set; }
+
+    /// <summary>
+    /// When true (default), transfer the files inside the source folder.
+    /// When false, only create the folder structure (useful together with
+    /// <see cref="IncludeSourceFolder"/> to clone an empty scaffold).
+    /// </summary>
+    public bool CopyFolderContents { get; set; } = true;
 }

SharepointToolbox/Core/Models/VersionCleanupOptions.cs

@@ -0,0 +1,9 @@
+namespace SharepointToolbox.Core.Models;
+
+public record VersionCleanupOptions(
+    IReadOnlyList<string> LibraryTitles,
+    int KeepLast,
+    bool KeepFirst)
+{
+    public static VersionCleanupOptions Default => new(Array.Empty<string>(), 5, false);
+}

SharepointToolbox/Core/Models/VersionCleanupResult.cs

@@ -0,0 +1,14 @@
+namespace SharepointToolbox.Core.Models;
+
+public class VersionCleanupResult
+{
+    public string SiteUrl { get; init; } = string.Empty;
+    public string Library { get; init; } = string.Empty;
+    public string FileServerRelativeUrl { get; init; } = string.Empty;
+    public string FileName { get; init; } = string.Empty;
+    public int VersionsBefore { get; init; }
+    public int VersionsDeleted { get; init; }
+    public int VersionsRemaining { get; init; }
+    public long BytesFreed { get; init; }
+    public string? Error { get; init; }
+}

SharepointToolbox/Infrastructure/Auth/GraphClientFactory.cs

@@ -15,17 +15,47 @@ public class GraphClientFactory
 
     /// <summary>
     /// Creates a GraphServiceClient that acquires tokens via the same MSAL PCA
-    /// used for SharePoint auth, but with Graph scopes.
+    /// used for SharePoint auth, but with Graph scopes. Uses the /common authority
+    /// and the <c>.default</c> scope (whatever the client is pre-consented for).
     /// </summary>
-    public async Task<GraphServiceClient> CreateClientAsync(string clientId, CancellationToken ct)
+    public Task<GraphServiceClient> CreateClientAsync(string clientId, CancellationToken ct)
+        => CreateClientAsync(clientId, tenantId: null, scopes: null, ct);
+
+    /// <summary>
+    /// Creates a GraphServiceClient pinned to a specific tenant authority.
+    /// Pass the tenant domain (e.g. "contoso.onmicrosoft.com") or tenant GUID.
+    /// Null <paramref name="tenantId"/> falls back to /common.
+    /// </summary>
+    public Task<GraphServiceClient> CreateClientAsync(string clientId, string? tenantId, CancellationToken ct)
+        => CreateClientAsync(clientId, tenantId, scopes: null, ct);
+
+    /// <summary>
+    /// Creates a GraphServiceClient with explicit Graph delegated scopes.
+    /// Use when <c>.default</c> is insufficient — typically for admin actions that
+    /// need scopes not pre-consented on the bootstrap client (e.g. app registration
+    /// requires <c>Application.ReadWrite.All</c> and
+    /// <c>DelegatedPermissionGrant.ReadWrite.All</c>). Triggers an admin-consent
+    /// prompt on first use if the tenant has not yet consented.
+    /// </summary>
+    public async Task<GraphServiceClient> CreateClientAsync(
+        string clientId,
+        string? tenantId,
+        string[]? scopes,
+        CancellationToken ct)
     {
         var pca = await _msalFactory.GetOrCreateAsync(clientId);
+
+        // Always reuse a cached account when one exists — `WithTenantId` on the
+        // silent/interactive call redirects the authority, and MSAL stores
+        // refresh tokens per tenant. Skipping the cached account forces an
+        // interactive prompt on every Graph call (the bug that produced 4–5
+        // sign-in windows during app registration).
         var accounts = await pca.GetAccountsAsync();
         var account = accounts.FirstOrDefault();
 
-        var graphScopes = new[] { "https://graph.microsoft.com/.default" };
+        var graphScopes = scopes ?? new[] { "https://graph.microsoft.com/.default" };
 
-        var tokenProvider = new MsalTokenProvider(pca, account, graphScopes);
+        var tokenProvider = new MsalTokenProvider(pca, account, graphScopes, tenantId);
         var authProvider = new BaseBearerTokenAuthenticationProvider(tokenProvider);
         return new GraphServiceClient(authProvider);
     }
@@ -37,14 +67,16 @@ public class GraphClientFactory
 internal class MsalTokenProvider : IAccessTokenProvider
 {
     private readonly IPublicClientApplication _pca;
-    private readonly IAccount? _account;
+    private IAccount? _account;
     private readonly string[] _scopes;
+    private readonly string? _tenantId;
 
-    public MsalTokenProvider(IPublicClientApplication pca, IAccount? account, string[] scopes)
+    public MsalTokenProvider(IPublicClientApplication pca, IAccount? account, string[] scopes, string? tenantId = null)
     {
         _pca = pca;
         _account = account;
         _scopes = scopes;
+        _tenantId = tenantId;
     }
 
     public AllowedHostsValidator AllowedHostsValidator { get; } = new();
@@ -54,18 +86,35 @@ internal class MsalTokenProvider : IAccessTokenProvider
         Dictionary<string, object>? additionalAuthenticationContext = null,
         CancellationToken cancellationToken = default)
     {
-        try
+        // Refresh _account from PCA cache each call — interactive flows on a
+        // sibling token provider populate the cache, and we want the next
+        // request on this provider to use that account silently.
+        if (_account is null)
         {
-            var result = await _pca.AcquireTokenSilent(_scopes, _account)
+            var accounts = await _pca.GetAccountsAsync();
-                .ExecuteAsync(cancellationToken);
+            _account = accounts.FirstOrDefault();
-            return result.AccessToken;
         }
-        catch (MsalUiRequiredException)
+
+        if (_account is not null)
         {
-            // If silent fails, try interactive
+            try
-            var result = await _pca.AcquireTokenInteractive(_scopes)
+            {
-                .ExecuteAsync(cancellationToken);
+                var silent = _pca.AcquireTokenSilent(_scopes, _account);
-            return result.AccessToken;
+                if (_tenantId is not null) silent = silent.WithTenantId(_tenantId);
+                var result = await silent.ExecuteAsync(cancellationToken);
+                return result.AccessToken;
+            }
+            catch (MsalUiRequiredException)
+            {
+                // fall through to interactive
+            }
         }
+
+        var interactive = _pca.AcquireTokenInteractive(_scopes);
+        if (_tenantId is not null) interactive = interactive.WithTenantId(_tenantId);
+        var interactiveResult = await interactive.ExecuteAsync(cancellationToken);
+        // Cache the account so subsequent calls on this provider go silent.
+        _account = interactiveResult.Account;
+        return interactiveResult.AccessToken;
     }
 }

SharepointToolbox/Localization/Strings.fr.resx

@@ -82,6 +82,103 @@
   <data name="tab.duplicates" xml:space="preserve">
     <value>Doublons</value>
   </data>
+  <data name="tab.versions" xml:space="preserve">
+    <value>Versions</value>
+  </data>
+  <data name="versions.tab" xml:space="preserve">
+    <value>Nettoyage des versions</value>
+  </data>
+  <data name="versions.grp.libs" xml:space="preserve">
+    <value>Bibliothèques</value>
+  </data>
+  <data name="versions.grp.policy" xml:space="preserve">
+    <value>Politique de conservation</value>
+  </data>
+  <data name="versions.btn.pickLibs" xml:space="preserve">
+    <value>Choisir des bibliothèques…</value>
+  </data>
+  <data name="versions.btn.clearLibs" xml:space="preserve">
+    <value>Réinitialiser (toutes les bibliothèques)</value>
+  </data>
+  <data name="versions.btn.run" xml:space="preserve">
+    <value>Supprimer les anciennes versions</value>
+  </data>
+  <data name="versions.lbl.keepLast" xml:space="preserve">
+    <value>Conserver les dernières&#160;:</value>
+  </data>
+  <data name="versions.chk.keepFirst" xml:space="preserve">
+    <value>Conserver aussi la toute première version</value>
+  </data>
+  <data name="versions.chk.confirm" xml:space="preserve">
+    <value>Demander confirmation avant l'exécution</value>
+  </data>
+  <data name="versions.note" xml:space="preserve">
+    <value>Seules les versions historiques sont supprimées. La version courante publiée est toujours conservée. L'action est irréversible.</value>
+  </data>
+  <data name="versions.libs.all" xml:space="preserve">
+    <value>Toutes les bibliothèques (aucun filtre)</value>
+  </data>
+  <data name="versions.libs.count" xml:space="preserve">
+    <value>{0} bibliothèque(s) sélectionnée(s)</value>
+  </data>
+  <data name="versions.confirm" xml:space="preserve">
+    <value>Supprimer les versions historiques en gardant les {0} dernières {1}&#160;?
+Cette action est irréversible.</value>
+  </data>
+  <data name="versions.confirm.keepFirst" xml:space="preserve">
+    <value>(plus la première version)</value>
+  </data>
+  <data name="versions.err.keepLast" xml:space="preserve">
+    <value>«&#160;Conserver les dernières&#160;» doit être supérieur ou égal à 0.</value>
+  </data>
+  <data name="versions.summary.files" xml:space="preserve">
+    <value>Fichiers nettoyés&#160;:</value>
+  </data>
+  <data name="versions.summary.deleted" xml:space="preserve">
+    <value>Versions supprimées&#160;:</value>
+  </data>
+  <data name="versions.summary.freed" xml:space="preserve">
+    <value>Octets libérés&#160;:</value>
+  </data>
+  <data name="versions.col.library" xml:space="preserve">
+    <value>Bibliothèque</value>
+  </data>
+  <data name="versions.col.file" xml:space="preserve">
+    <value>Fichier</value>
+  </data>
+  <data name="versions.col.before" xml:space="preserve">
+    <value>Avant</value>
+  </data>
+  <data name="versions.col.deleted" xml:space="preserve">
+    <value>Supprimées</value>
+  </data>
+  <data name="versions.col.remaining" xml:space="preserve">
+    <value>Restantes</value>
+  </data>
+  <data name="versions.col.freed" xml:space="preserve">
+    <value>Libérés</value>
+  </data>
+  <data name="versions.col.path" xml:space="preserve">
+    <value>Chemin</value>
+  </data>
+  <data name="versions.col.error" xml:space="preserve">
+    <value>Erreur</value>
+  </data>
+  <data name="librarypicker.title" xml:space="preserve">
+    <value>Sélectionner les bibliothèques</value>
+  </data>
+  <data name="librarypicker.loading" xml:space="preserve">
+    <value>Chargement des bibliothèques…</value>
+  </data>
+  <data name="librarypicker.loaded" xml:space="preserve">
+    <value>{0} bibliothèques chargées.</value>
+  </data>
+  <data name="librarypicker.selectAll" xml:space="preserve">
+    <value>Tout sélectionner</value>
+  </data>
+  <data name="librarypicker.selectNone" xml:space="preserve">
+    <value>Tout désélectionner</value>
+  </data>
   <data name="tab.templates" xml:space="preserve">
     <value>Modèles</value>
   </data>
@@ -109,6 +206,18 @@
   <data name="settings.lang.fr" xml:space="preserve">
     <value>Français</value>
   </data>
+  <data name="settings.theme" xml:space="preserve">
+    <value>Thème</value>
+  </data>
+  <data name="settings.theme.system" xml:space="preserve">
+    <value>Utiliser le paramètre système</value>
+  </data>
+  <data name="settings.theme.light" xml:space="preserve">
+    <value>Clair</value>
+  </data>
+  <data name="settings.theme.dark" xml:space="preserve">
+    <value>Sombre</value>
+  </data>
   <data name="settings.folder" xml:space="preserve">
     <value>Dossier de sortie des données</value>
   </data>
@@ -124,18 +233,36 @@
   <data name="profile.clientid" xml:space="preserve">
     <value>ID client</value>
   </data>
+  <data name="profile.clientid.hint" xml:space="preserve">
+    <value>Optionnel — laissez vide pour enregistrer l'application automatiquement</value>
+  </data>
   <data name="profile.add" xml:space="preserve">
     <value>Ajouter</value>
   </data>
-  <data name="profile.rename" xml:space="preserve">
+  <data name="profile.save" xml:space="preserve">
-    <value>Renommer</value>
+    <value>Enregistrer</value>
   </data>
   <data name="profile.delete" xml:space="preserve">
     <value>Supprimer</value>
   </data>
+  <data name="profile.add.tooltip" xml:space="preserve">
+    <value>Créer un nouveau profil à partir des valeurs ci-dessus.</value>
+  </data>
+  <data name="profile.save.tooltip" xml:space="preserve">
+    <value>Enregistrer les modifications du profil sélectionné.</value>
+  </data>
+  <data name="profile.delete.tooltip" xml:space="preserve">
+    <value>Supprimer le profil sélectionné.</value>
+  </data>
+  <data name="profile.register.warning" xml:space="preserve">
+    <value>L'enregistrement de l'application peut nécessiter jusqu'à {0} connexions. Continuer&#160;?</value>
+  </data>
   <data name="status.ready" xml:space="preserve">
     <value>Prêt</value>
   </data>
+  <data name="status.complete" xml:space="preserve">
+    <value>Termin&#233;</value>
+  </data>
   <data name="status.cancelled" xml:space="preserve">
     <value>Opération annulée</value>
   </data>
@@ -179,6 +306,28 @@
   <data name="stor.col.share" xml:space="preserve"><value>Part du total</value></data>
   <data name="stor.rad.csv" xml:space="preserve"><value>CSV</value></data>
   <data name="stor.rad.html" xml:space="preserve"><value>HTML</value></data>
+  <data name="stor.col.kind" xml:space="preserve"><value>Type</value></data>
+  <data name="stor.kind.library" xml:space="preserve"><value>Bibliothèque</value></data>
+  <data name="stor.kind.hidden" xml:space="preserve"><value>Bibliothèque masquée</value></data>
+  <data name="stor.kind.preservation" xml:space="preserve"><value>Conservation</value></data>
+  <data name="stor.kind.attachments" xml:space="preserve"><value>Pièces jointes</value></data>
+  <data name="stor.kind.recyclebin" xml:space="preserve"><value>Corbeille</value></data>
+  <data name="stor.kind.subsite" xml:space="preserve"><value>Sous-site</value></data>
+  <data name="grp.scan.sources" xml:space="preserve"><value>Sources analysées</value></data>
+  <data name="grp.report.filter" xml:space="preserve"><value>Afficher dans le rapport</value></data>
+  <data name="chk.scan.hidden" xml:space="preserve"><value>Bibliothèques masquées</value></data>
+  <data name="chk.scan.preservation" xml:space="preserve"><value>Conservation</value></data>
+  <data name="chk.scan.attachments" xml:space="preserve"><value>Pièces jointes</value></data>
+  <data name="chk.scan.recyclebin" xml:space="preserve"><value>Corbeille</value></data>
+  <data name="chk.show.libraries" xml:space="preserve"><value>Bibliothèques</value></data>
+  <data name="chk.show.hidden" xml:space="preserve"><value>Bibliothèques masquées</value></data>
+  <data name="chk.show.preservation" xml:space="preserve"><value>Conservation</value></data>
+  <data name="chk.show.attachments" xml:space="preserve"><value>Pièces jointes</value></data>
+  <data name="chk.show.recyclebin" xml:space="preserve"><value>Corbeille</value></data>
+  <data name="chk.show.subsites" xml:space="preserve"><value>Sous-sites</value></data>
+  <data name="chk.combine.recyclebin" xml:space="preserve"><value>Combiner les corbeilles (afficher le total)</value></data>
+  <data name="storage.lbl.spo_reported_colon" xml:space="preserve"><value>Total rapporté par SPO : </value></data>
+  <data name="storage.lbl.recyclebin_colon" xml:space="preserve"><value>Corbeille : </value></data>
   <!-- Phase 3: File Search Tab -->
   <data name="grp.search.filters" xml:space="preserve"><value>Filtres de recherche</value></data>
   <data name="lbl.detail.level" xml:space="preserve"><value>Niveau de d&#233;tail :</value></data>
@@ -354,6 +503,27 @@
   <data name="audit.btn.exportHtml" xml:space="preserve">
     <value>Exporter HTML</value>
   </data>
+  <data name="export.split.label" xml:space="preserve">
+    <value>D&#233;couper</value>
+  </data>
+  <data name="export.split.single" xml:space="preserve">
+    <value>Fichier unique</value>
+  </data>
+  <data name="export.split.bySite" xml:space="preserve">
+    <value>Par site</value>
+  </data>
+  <data name="export.split.byUser" xml:space="preserve">
+    <value>Par utilisateur</value>
+  </data>
+  <data name="export.html.layout.label" xml:space="preserve">
+    <value>Mise en page HTML</value>
+  </data>
+  <data name="export.html.layout.separate" xml:space="preserve">
+    <value>Fichiers s&#233;par&#233;s</value>
+  </data>
+  <data name="export.html.layout.tabbed" xml:space="preserve">
+    <value>Fichier unique &#224; onglets</value>
+  </data>
   <data name="audit.summary.total" xml:space="preserve">
     <value>Total des acc&#232;s</value>
   </data>
@@ -434,4 +604,183 @@
   <data name="settings.ownership.auto" xml:space="preserve"><value>Prendre automatiquement la propri&#233;t&#233; d'administrateur de collection de sites en cas de refus d'acc&#232;s</value></data>
   <data name="settings.ownership.description" xml:space="preserve"><value>Lorsqu'activ&#233;, l'application prendra automatiquement les droits d'administrateur de collection de sites lorsqu'un scan rencontre une erreur de refus d'acc&#232;s. N&#233;cessite les permissions d'administrateur de tenant.</value></data>
   <data name="permissions.elevated.tooltip" xml:space="preserve"><value>Ce site a &#233;t&#233; &#233;lev&#233; automatiquement — la propri&#233;t&#233; a &#233;t&#233; prise pour compl&#233;ter le scan</value></data>
+  <!-- Report export localization -->
+  <data name="report.title.user_access" xml:space="preserve"><value>Rapport d'audit des acc&#232;s utilisateurs</value></data>
+  <data name="report.title.user_access_consolidated" xml:space="preserve"><value>Rapport d'audit des acc&#232;s utilisateurs (consolid&#233;)</value></data>
+  <data name="report.title.permissions" xml:space="preserve"><value>Rapport des permissions SharePoint</value></data>
+  <data name="report.title.permissions_simplified" xml:space="preserve"><value>Rapport des permissions SharePoint (simplifi&#233;)</value></data>
+  <data name="report.title.storage" xml:space="preserve"><value>M&#233;triques de stockage SharePoint</value></data>
+  <data name="report.title.duplicates" xml:space="preserve"><value>Rapport de d&#233;tection de doublons SharePoint</value></data>
+  <data name="report.title.duplicates_short" xml:space="preserve"><value>Rapport de d&#233;tection de doublons</value></data>
+  <data name="report.title.search" xml:space="preserve"><value>R&#233;sultats de recherche de fichiers SharePoint</value></data>
+  <data name="report.title.search_short" xml:space="preserve"><value>R&#233;sultats de recherche de fichiers</value></data>
+  <data name="report.title.versions" xml:space="preserve"><value>Rapport de nettoyage des versions SharePoint</value></data>
+  <data name="report.title.versions_short" xml:space="preserve"><value>Rapport de nettoyage des versions</value></data>
+  <data name="report.stat.total_accesses" xml:space="preserve"><value>Acc&#232;s totaux</value></data>
+  <data name="report.stat.users_audited" xml:space="preserve"><value>Utilisateurs audit&#233;s</value></data>
+  <data name="report.stat.sites_scanned" xml:space="preserve"><value>Sites analys&#233;s</value></data>
+  <data name="report.stat.high_privilege" xml:space="preserve"><value>Privil&#232;ge &#233;lev&#233;</value></data>
+  <data name="report.stat.external_users" xml:space="preserve"><value>Utilisateurs externes</value></data>
+  <data name="report.stat.total_entries" xml:space="preserve"><value>Entr&#233;es totales</value></data>
+  <data name="report.stat.unique_permission_sets" xml:space="preserve"><value>Ensembles de permissions uniques</value></data>
+  <data name="report.stat.distinct_users_groups" xml:space="preserve"><value>Utilisateurs/Groupes distincts</value></data>
+  <data name="report.stat.libraries" xml:space="preserve"><value>Biblioth&#232;ques</value></data>
+  <data name="report.stat.files" xml:space="preserve"><value>Fichiers</value></data>
+  <data name="report.stat.total_size" xml:space="preserve"><value>Taille totale</value></data>
+  <data name="report.stat.version_size" xml:space="preserve"><value>Taille des versions</value></data>
+  <data name="report.badge.guest" xml:space="preserve"><value>Invit&#233;</value></data>
+  <data name="report.badge.direct" xml:space="preserve"><value>Direct</value></data>
+  <data name="report.badge.group" xml:space="preserve"><value>Groupe</value></data>
+  <data name="report.badge.inherited" xml:space="preserve"><value>H&#233;rit&#233;</value></data>
+  <data name="report.badge.unique" xml:space="preserve"><value>Unique</value></data>
+  <data name="report.view.by_user" xml:space="preserve"><value>Par utilisateur</value></data>
+  <data name="report.view.by_site" xml:space="preserve"><value>Par site</value></data>
+  <data name="report.filter.placeholder_results" xml:space="preserve"><value>Filtrer les r&#233;sultats...</value></data>
+  <data name="report.filter.placeholder_permissions" xml:space="preserve"><value>Filtrer les permissions...</value></data>
+  <data name="report.filter.placeholder_rows" xml:space="preserve"><value>Filtrer les lignes…</value></data>
+  <data name="report.filter.label" xml:space="preserve"><value>Filtre :</value></data>
+  <data name="report.col.site" xml:space="preserve"><value>Site</value></data>
+  <data name="report.col.sites" xml:space="preserve"><value>Sites</value></data>
+  <data name="report.col.object_type" xml:space="preserve"><value>Type d'objet</value></data>
+  <data name="report.col.object" xml:space="preserve"><value>Objet</value></data>
+  <data name="report.col.permission_level" xml:space="preserve"><value>Niveau de permission</value></data>
+  <data name="report.col.access_type" xml:space="preserve"><value>Type d'acc&#232;s</value></data>
+  <data name="report.col.granted_through" xml:space="preserve"><value>Accord&#233; via</value></data>
+  <data name="report.col.user" xml:space="preserve"><value>Utilisateur</value></data>
+  <data name="report.col.title" xml:space="preserve"><value>Titre</value></data>
+  <data name="report.col.url" xml:space="preserve"><value>URL</value></data>
+  <data name="report.col.users_groups" xml:space="preserve"><value>Utilisateurs/Groupes</value></data>
+  <data name="report.col.simplified" xml:space="preserve"><value>Simplifi&#233;</value></data>
+  <data name="report.col.risk" xml:space="preserve"><value>Risque</value></data>
+  <data name="report.col.library_folder" xml:space="preserve"><value>Biblioth&#232;que / Dossier</value></data>
+  <data name="report.col.last_modified" xml:space="preserve"><value>Derni&#232;re modification</value></data>
+  <data name="report.col.name" xml:space="preserve"><value>Nom</value></data>
+  <data name="report.col.library" xml:space="preserve"><value>Biblioth&#232;que</value></data>
+  <data name="report.col.path" xml:space="preserve"><value>Chemin</value></data>
+  <data name="report.col.size" xml:space="preserve"><value>Taille</value></data>
+  <data name="report.col.created" xml:space="preserve"><value>Cr&#233;&#233;</value></data>
+  <data name="report.col.modified" xml:space="preserve"><value>Modifi&#233;</value></data>
+  <data name="report.col.created_by" xml:space="preserve"><value>Cr&#233;&#233; par</value></data>
+  <data name="report.col.modified_by" xml:space="preserve"><value>Modifi&#233; par</value></data>
+  <data name="report.col.file_name" xml:space="preserve"><value>Nom de fichier</value></data>
+  <data name="report.col.extension" xml:space="preserve"><value>Extension</value></data>
+  <data name="report.col.file_type" xml:space="preserve"><value>Type de fichier</value></data>
+  <data name="report.col.file_count" xml:space="preserve"><value>Nombre de fichiers</value></data>
+  <data name="report.col.error" xml:space="preserve"><value>Erreur</value></data>
+  <data name="report.col.timestamp" xml:space="preserve"><value>Horodatage</value></data>
+  <data name="report.col.number" xml:space="preserve"><value>#</value></data>
+  <data name="report.col.group" xml:space="preserve"><value>Groupe</value></data>
+  <data name="report.col.total_size_mb" xml:space="preserve"><value>Taille totale (Mo)</value></data>
+  <data name="report.col.version_size_mb" xml:space="preserve"><value>Taille des versions (Mo)</value></data>
+  <data name="report.col.size_mb" xml:space="preserve"><value>Taille (Mo)</value></data>
+  <data name="report.col.size_bytes" xml:space="preserve"><value>Taille (octets)</value></data>
+  <data name="report.text.accesses" xml:space="preserve"><value>acc&#232;s</value></data>
+  <data name="report.text.access_es" xml:space="preserve"><value>acc&#232;s</value></data>
+  <data name="report.text.sites_parens" xml:space="preserve"><value>site(s)</value></data>
+  <data name="report.text.permissions_parens" xml:space="preserve"><value>permission(s)</value></data>
+  <data name="report.text.copies" xml:space="preserve"><value>copies</value></data>
+  <data name="report.text.duplicate_groups_found" xml:space="preserve"><value>groupe(s) de doublons trouv&#233;(s).</value></data>
+  <data name="report.text.results_parens" xml:space="preserve"><value>r&#233;sultat(s)</value></data>
+  <data name="report.text.of" xml:space="preserve"><value>sur</value></data>
+  <data name="report.text.shown" xml:space="preserve"><value>affich&#233;(s)</value></data>
+  <data name="report.text.generated" xml:space="preserve"><value>G&#233;n&#233;r&#233;</value></data>
+  <data name="report.text.generated_colon" xml:space="preserve"><value>G&#233;n&#233;r&#233; :</value></data>
+  <data name="report.text.members_unavailable" xml:space="preserve"><value>membres indisponibles</value></data>
+  <data name="report.text.link" xml:space="preserve"><value>Lien</value></data>
+  <data name="report.text.no_ext" xml:space="preserve"><value>(sans ext.)</value></data>
+  <data name="report.text.no_extension" xml:space="preserve"><value>(sans extension)</value></data>
+  <data name="report.text.high_priv" xml:space="preserve"><value>priv. &#233;lev&#233;</value></data>
+  <data name="report.section.storage_by_file_type" xml:space="preserve"><value>Stockage par type de fichier</value></data>
+  <data name="report.section.library_details" xml:space="preserve"><value>D&#233;tails des biblioth&#232;ques</value></data>
+  <!-- Site picker dialog -->
+  <data name="sitepicker.title" xml:space="preserve"><value>S&#233;lectionner les sites</value></data>
+  <data name="sitepicker.filter" xml:space="preserve"><value>Filtre&#160;:</value></data>
+  <data name="sitepicker.type" xml:space="preserve"><value>Type&#160;:</value></data>
+  <data name="sitepicker.type.all" xml:space="preserve"><value>Tous</value></data>
+  <data name="sitepicker.type.team" xml:space="preserve"><value>Sites d'&#233;quipe (MS Teams)</value></data>
+  <data name="sitepicker.type.communication" xml:space="preserve"><value>Communication</value></data>
+  <data name="sitepicker.type.classic" xml:space="preserve"><value>Classique</value></data>
+  <data name="sitepicker.type.other" xml:space="preserve"><value>Autre</value></data>
+  <data name="sitepicker.size" xml:space="preserve"><value>Taille (Mo)&#160;:</value></data>
+  <data name="sitepicker.size.min" xml:space="preserve"><value>min</value></data>
+  <data name="sitepicker.size.max" xml:space="preserve"><value>max</value></data>
+  <data name="sitepicker.col.title" xml:space="preserve"><value>Titre</value></data>
+  <data name="sitepicker.col.url" xml:space="preserve"><value>URL</value></data>
+  <data name="sitepicker.col.type" xml:space="preserve"><value>Type</value></data>
+  <data name="sitepicker.col.size" xml:space="preserve"><value>Taille</value></data>
+  <data name="sitepicker.btn.load" xml:space="preserve"><value>Charger les sites</value></data>
+  <data name="sitepicker.btn.selectAll" xml:space="preserve"><value>Tout s&#233;lectionner</value></data>
+  <data name="sitepicker.btn.deselectAll" xml:space="preserve"><value>Tout d&#233;s&#233;lectionner</value></data>
+  <data name="sitepicker.btn.ok" xml:space="preserve"><value>OK</value></data>
+  <data name="sitepicker.btn.cancel" xml:space="preserve"><value>Annuler</value></data>
+  <data name="sitepicker.status.loading" xml:space="preserve"><value>Chargement des sites...</value></data>
+  <data name="sitepicker.status.loaded" xml:space="preserve"><value>{0} sites charg&#233;s.</value></data>
+  <data name="sitepicker.status.shown" xml:space="preserve"><value>{0} / {1} sites affich&#233;s.</value></data>
+  <data name="sitepicker.status.error" xml:space="preserve"><value>Erreur&#160;: {0}</value></data>
+  <data name="sitepicker.kind.teamsite" xml:space="preserve"><value>Site d'&#233;quipe</value></data>
+  <data name="sitepicker.kind.communication" xml:space="preserve"><value>Communication</value></data>
+  <data name="sitepicker.kind.classic" xml:space="preserve"><value>Classique</value></data>
+  <data name="sitepicker.kind.other" xml:space="preserve"><value>Autre</value></data>
+  <!-- Common UI -->
+  <data name="common.valid" xml:space="preserve"><value>Valide</value></data>
+  <data name="common.errors" xml:space="preserve"><value>Erreurs</value></data>
+  <data name="common.close" xml:space="preserve"><value>Fermer</value></data>
+  <data name="common.new_folder" xml:space="preserve"><value>+ Nouveau dossier</value></data>
+  <data name="common.guest" xml:space="preserve"><value>Invit&#233;</value></data>
+  <!-- InputDialog -->
+  <data name="input.title" xml:space="preserve"><value>Saisie</value></data>
+  <!-- ProfileManagementDialog -->
+  <data name="profmgmt.title" xml:space="preserve"><value>G&#233;rer les profils</value></data>
+  <data name="profmgmt.group" xml:space="preserve"><value>Profils</value></data>
+  <!-- Duplicates columns -->
+  <data name="duplicates.col.group" xml:space="preserve"><value>Groupe</value></data>
+  <data name="duplicates.col.copies" xml:space="preserve"><value>Copies</value></data>
+  <!-- Folder structure levels -->
+  <data name="folderstruct.col.level1" xml:space="preserve"><value>Niveau 1</value></data>
+  <data name="folderstruct.col.level2" xml:space="preserve"><value>Niveau 2</value></data>
+  <data name="folderstruct.col.level3" xml:space="preserve"><value>Niveau 3</value></data>
+  <data name="folderstruct.col.level4" xml:space="preserve"><value>Niveau 4</value></data>
+  <!-- Permissions extra columns -->
+  <data name="perm.col.unique_perms" xml:space="preserve"><value>Perm. uniques</value></data>
+  <data name="perm.col.permission_levels" xml:space="preserve"><value>Niveaux d'autorisation</value></data>
+  <data name="perm.col.principal_type" xml:space="preserve"><value>Type de principal</value></data>
+  <!-- Storage summary labels -->
+  <data name="storage.lbl.total_size_colon" xml:space="preserve"><value>Taille totale&#160;: </value></data>
+  <data name="storage.lbl.version_size_colon" xml:space="preserve"><value>Taille des versions&#160;: </value></data>
+  <data name="storage.lbl.files_colon" xml:space="preserve"><value>Fichiers&#160;: </value></data>
+  <!-- Templates columns -->
+  <data name="templates.col.source" xml:space="preserve"><value>Source</value></data>
+  <data name="templates.col.captured" xml:space="preserve"><value>Captur&#233;</value></data>
+  <!-- Transfer view -->
+  <data name="transfer.text.files_selected" xml:space="preserve"><value> fichier(s) s&#233;lectionn&#233;(s)</value></data>
+  <data name="transfer.chk.include_source" xml:space="preserve"><value>Inclure le dossier source dans la destination</value></data>
+  <data name="transfer.chk.include_source.tooltip" xml:space="preserve"><value>Si activ&#233;, recr&#233;e le dossier source sous la destination. Sinon, d&#233;pose le contenu directement dans le dossier de destination.</value></data>
+  <data name="transfer.chk.copy_contents" xml:space="preserve"><value>Copier le contenu du dossier</value></data>
+  <data name="transfer.chk.copy_contents.tooltip" xml:space="preserve"><value>Si activ&#233; (par d&#233;faut), transf&#232;re les fichiers du dossier. Sinon, seul le dossier est cr&#233;&#233; &#224; la destination.</value></data>
+  <!-- Shared ViewModel errors and statuses -->
+  <data name="err.no_tenant" xml:space="preserve"><value>Aucun tenant connect&#233;.</value></data>
+  <data name="err.no_tenant_connected" xml:space="preserve"><value>Aucun tenant s&#233;lectionn&#233;. Connectez-vous &#224; un tenant d'abord.</value></data>
+  <data name="err.no_profile_selected" xml:space="preserve"><value>Aucun profil de tenant s&#233;lectionn&#233;. Connectez-vous d'abord.</value></data>
+  <data name="err.no_sites_selected" xml:space="preserve"><value>S&#233;lectionnez au moins un site dans la barre d'outils.</value></data>
+  <data name="err.no_users_selected" xml:space="preserve"><value>Ajoutez au moins un utilisateur &#224; auditer.</value></data>
+  <data name="err.no_valid_rows" xml:space="preserve"><value>Aucune ligne valide &#224; traiter. Importez un CSV d'abord.</value></data>
+  <data name="err.template_name_required" xml:space="preserve"><value>Le nom du mod&#232;le est requis.</value></data>
+  <data name="err.site_title_required" xml:space="preserve"><value>Le titre du nouveau site est requis.</value></data>
+  <data name="err.site_alias_required" xml:space="preserve"><value>L'alias du nouveau site est requis.</value></data>
+  <data name="err.transfer_source_required" xml:space="preserve"><value>Le site source et la biblioth&#232;que doivent &#234;tre s&#233;lectionn&#233;s.</value></data>
+  <data name="err.transfer_dest_required" xml:space="preserve"><value>Le site de destination et la biblioth&#232;que doivent &#234;tre s&#233;lectionn&#233;s.</value></data>
+  <data name="err.library_title_required" xml:space="preserve"><value>Le titre de la biblioth&#232;que est requis.</value></data>
+  <!-- Templates status -->
+  <data name="templates.status.capturing" xml:space="preserve"><value>Capture du mod&#232;le...</value></data>
+  <data name="templates.status.success" xml:space="preserve"><value>Mod&#232;le captur&#233; avec succ&#232;s.</value></data>
+  <data name="templates.status.capture_failed" xml:space="preserve"><value>&#201;chec de la capture&#160;: {0}</value></data>
+  <data name="templates.status.applying" xml:space="preserve"><value>Application du mod&#232;le...</value></data>
+  <data name="templates.status.applied" xml:space="preserve"><value>Mod&#232;le appliqu&#233;. Site cr&#233;&#233; &#224;&#160;: {0}</value></data>
+  <data name="templates.status.apply_failed" xml:space="preserve"><value>&#201;chec de l'application&#160;: {0}</value></data>
+  <!-- UI text -->
+  <data name="audit.searching" xml:space="preserve"><value>Recherche en cours...</value></data>
+  <!-- Report text -->
+  <data name="report.text.users_parens" xml:space="preserve"><value>utilisateur(s)</value></data>
+  <data name="report.text.files_unit" xml:space="preserve"><value>fichiers</value></data>
+  <data name="report.text.sites_unit" xml:space="preserve"><value>sites</value></data>
 </root>

SharepointToolbox/Localization/Strings.resx

@@ -82,6 +82,103 @@
   <data name="tab.duplicates" xml:space="preserve">
     <value>Duplicates</value>
   </data>
+  <data name="tab.versions" xml:space="preserve">
+    <value>Versions</value>
+  </data>
+  <data name="versions.tab" xml:space="preserve">
+    <value>Version cleanup</value>
+  </data>
+  <data name="versions.grp.libs" xml:space="preserve">
+    <value>Libraries</value>
+  </data>
+  <data name="versions.grp.policy" xml:space="preserve">
+    <value>Retention policy</value>
+  </data>
+  <data name="versions.btn.pickLibs" xml:space="preserve">
+    <value>Select libraries...</value>
+  </data>
+  <data name="versions.btn.clearLibs" xml:space="preserve">
+    <value>Reset (all libraries)</value>
+  </data>
+  <data name="versions.btn.run" xml:space="preserve">
+    <value>Delete old versions</value>
+  </data>
+  <data name="versions.lbl.keepLast" xml:space="preserve">
+    <value>Keep last:</value>
+  </data>
+  <data name="versions.chk.keepFirst" xml:space="preserve">
+    <value>Also keep the very first version</value>
+  </data>
+  <data name="versions.chk.confirm" xml:space="preserve">
+    <value>Ask for confirmation before running</value>
+  </data>
+  <data name="versions.note" xml:space="preserve">
+    <value>Only historical versions are removed. The current published version is always kept. The action cannot be undone.</value>
+  </data>
+  <data name="versions.libs.all" xml:space="preserve">
+    <value>All libraries (no filter)</value>
+  </data>
+  <data name="versions.libs.count" xml:space="preserve">
+    <value>{0} library/libraries selected</value>
+  </data>
+  <data name="versions.confirm" xml:space="preserve">
+    <value>Delete historical file versions, keeping the last {0} {1}?
+This cannot be undone.</value>
+  </data>
+  <data name="versions.confirm.keepFirst" xml:space="preserve">
+    <value>(plus the first version)</value>
+  </data>
+  <data name="versions.err.keepLast" xml:space="preserve">
+    <value>"Keep last" must be 0 or greater.</value>
+  </data>
+  <data name="versions.summary.files" xml:space="preserve">
+    <value>Files trimmed:</value>
+  </data>
+  <data name="versions.summary.deleted" xml:space="preserve">
+    <value>Versions deleted:</value>
+  </data>
+  <data name="versions.summary.freed" xml:space="preserve">
+    <value>Bytes freed:</value>
+  </data>
+  <data name="versions.col.library" xml:space="preserve">
+    <value>Library</value>
+  </data>
+  <data name="versions.col.file" xml:space="preserve">
+    <value>File</value>
+  </data>
+  <data name="versions.col.before" xml:space="preserve">
+    <value>Before</value>
+  </data>
+  <data name="versions.col.deleted" xml:space="preserve">
+    <value>Deleted</value>
+  </data>
+  <data name="versions.col.remaining" xml:space="preserve">
+    <value>Remaining</value>
+  </data>
+  <data name="versions.col.freed" xml:space="preserve">
+    <value>Freed</value>
+  </data>
+  <data name="versions.col.path" xml:space="preserve">
+    <value>Path</value>
+  </data>
+  <data name="versions.col.error" xml:space="preserve">
+    <value>Error</value>
+  </data>
+  <data name="librarypicker.title" xml:space="preserve">
+    <value>Select libraries</value>
+  </data>
+  <data name="librarypicker.loading" xml:space="preserve">
+    <value>Loading libraries...</value>
+  </data>
+  <data name="librarypicker.loaded" xml:space="preserve">
+    <value>{0} libraries loaded.</value>
+  </data>
+  <data name="librarypicker.selectAll" xml:space="preserve">
+    <value>Select all</value>
+  </data>
+  <data name="librarypicker.selectNone" xml:space="preserve">
+    <value>Select none</value>
+  </data>
   <data name="tab.templates" xml:space="preserve">
     <value>Templates</value>
   </data>
@@ -109,6 +206,18 @@
   <data name="settings.lang.fr" xml:space="preserve">
     <value>French</value>
   </data>
+  <data name="settings.theme" xml:space="preserve">
+    <value>Theme</value>
+  </data>
+  <data name="settings.theme.system" xml:space="preserve">
+    <value>Use system setting</value>
+  </data>
+  <data name="settings.theme.light" xml:space="preserve">
+    <value>Light</value>
+  </data>
+  <data name="settings.theme.dark" xml:space="preserve">
+    <value>Dark</value>
+  </data>
   <data name="settings.folder" xml:space="preserve">
     <value>Data output folder</value>
   </data>
@@ -124,18 +233,36 @@
   <data name="profile.clientid" xml:space="preserve">
     <value>Client ID</value>
   </data>
+  <data name="profile.clientid.hint" xml:space="preserve">
+    <value>Optional — leave blank to register the app automatically</value>
+  </data>
   <data name="profile.add" xml:space="preserve">
     <value>Add</value>
   </data>
-  <data name="profile.rename" xml:space="preserve">
+  <data name="profile.save" xml:space="preserve">
-    <value>Rename</value>
+    <value>Save</value>
   </data>
   <data name="profile.delete" xml:space="preserve">
     <value>Delete</value>
   </data>
+  <data name="profile.add.tooltip" xml:space="preserve">
+    <value>Create a new profile from the values entered above.</value>
+  </data>
+  <data name="profile.save.tooltip" xml:space="preserve">
+    <value>Save changes to the selected profile.</value>
+  </data>
+  <data name="profile.delete.tooltip" xml:space="preserve">
+    <value>Delete the selected profile.</value>
+  </data>
+  <data name="profile.register.warning" xml:space="preserve">
+    <value>Registering an app may prompt you to sign in up to {0} times. Continue?</value>
+  </data>
   <data name="status.ready" xml:space="preserve">
     <value>Ready</value>
   </data>
+  <data name="status.complete" xml:space="preserve">
+    <value>Complete</value>
+  </data>
   <data name="status.cancelled" xml:space="preserve">
     <value>Operation cancelled</value>
   </data>
@@ -179,6 +306,28 @@
   <data name="stor.col.share" xml:space="preserve"><value>Share of Total</value></data>
   <data name="stor.rad.csv" xml:space="preserve"><value>CSV</value></data>
   <data name="stor.rad.html" xml:space="preserve"><value>HTML</value></data>
+  <data name="stor.col.kind" xml:space="preserve"><value>Kind</value></data>
+  <data name="stor.kind.library" xml:space="preserve"><value>Library</value></data>
+  <data name="stor.kind.hidden" xml:space="preserve"><value>Hidden Library</value></data>
+  <data name="stor.kind.preservation" xml:space="preserve"><value>Preservation Hold</value></data>
+  <data name="stor.kind.attachments" xml:space="preserve"><value>List Attachments</value></data>
+  <data name="stor.kind.recyclebin" xml:space="preserve"><value>Recycle Bin</value></data>
+  <data name="stor.kind.subsite" xml:space="preserve"><value>Subsite</value></data>
+  <data name="grp.scan.sources" xml:space="preserve"><value>Scan Sources</value></data>
+  <data name="grp.report.filter" xml:space="preserve"><value>Show in Report</value></data>
+  <data name="chk.scan.hidden" xml:space="preserve"><value>Hidden Libraries</value></data>
+  <data name="chk.scan.preservation" xml:space="preserve"><value>Preservation Hold</value></data>
+  <data name="chk.scan.attachments" xml:space="preserve"><value>List Attachments</value></data>
+  <data name="chk.scan.recyclebin" xml:space="preserve"><value>Recycle Bin</value></data>
+  <data name="chk.show.libraries" xml:space="preserve"><value>Libraries</value></data>
+  <data name="chk.show.hidden" xml:space="preserve"><value>Hidden Libraries</value></data>
+  <data name="chk.show.preservation" xml:space="preserve"><value>Preservation Hold</value></data>
+  <data name="chk.show.attachments" xml:space="preserve"><value>List Attachments</value></data>
+  <data name="chk.show.recyclebin" xml:space="preserve"><value>Recycle Bin</value></data>
+  <data name="chk.show.subsites" xml:space="preserve"><value>Subsites</value></data>
+  <data name="chk.combine.recyclebin" xml:space="preserve"><value>Combine Recycle Bin Stages (show total)</value></data>
+  <data name="storage.lbl.spo_reported_colon" xml:space="preserve"><value>SPO reported total: </value></data>
+  <data name="storage.lbl.recyclebin_colon" xml:space="preserve"><value>Recycle Bin: </value></data>
   <!-- Phase 3: File Search Tab -->
   <data name="grp.search.filters" xml:space="preserve"><value>Search Filters</value></data>
   <data name="lbl.detail.level" xml:space="preserve"><value>Detail level:</value></data>
@@ -354,6 +503,27 @@
   <data name="audit.btn.exportHtml" xml:space="preserve">
     <value>Export HTML</value>
   </data>
+  <data name="export.split.label" xml:space="preserve">
+    <value>Split</value>
+  </data>
+  <data name="export.split.single" xml:space="preserve">
+    <value>Single file</value>
+  </data>
+  <data name="export.split.bySite" xml:space="preserve">
+    <value>By site</value>
+  </data>
+  <data name="export.split.byUser" xml:space="preserve">
+    <value>By user</value>
+  </data>
+  <data name="export.html.layout.label" xml:space="preserve">
+    <value>HTML layout</value>
+  </data>
+  <data name="export.html.layout.separate" xml:space="preserve">
+    <value>Separate files</value>
+  </data>
+  <data name="export.html.layout.tabbed" xml:space="preserve">
+    <value>Single tabbed file</value>
+  </data>
   <data name="audit.summary.total" xml:space="preserve">
     <value>Total Accesses</value>
   </data>
@@ -434,4 +604,183 @@
   <data name="settings.ownership.auto" xml:space="preserve"><value>Automatically take site collection admin ownership on access denied</value></data>
   <data name="settings.ownership.description" xml:space="preserve"><value>When enabled, the app will automatically elevate to site collection admin when a scan encounters an access denied error. Requires Tenant Admin permissions.</value></data>
   <data name="permissions.elevated.tooltip" xml:space="preserve"><value>This site was automatically elevated — ownership was taken to complete the scan</value></data>
+  <!-- Report export localization -->
+  <data name="report.title.user_access" xml:space="preserve"><value>User Access Audit Report</value></data>
+  <data name="report.title.user_access_consolidated" xml:space="preserve"><value>User Access Audit Report (Consolidated)</value></data>
+  <data name="report.title.permissions" xml:space="preserve"><value>SharePoint Permissions Report</value></data>
+  <data name="report.title.permissions_simplified" xml:space="preserve"><value>SharePoint Permissions Report (Simplified)</value></data>
+  <data name="report.title.storage" xml:space="preserve"><value>SharePoint Storage Metrics</value></data>
+  <data name="report.title.duplicates" xml:space="preserve"><value>SharePoint Duplicate Detection Report</value></data>
+  <data name="report.title.duplicates_short" xml:space="preserve"><value>Duplicate Detection Report</value></data>
+  <data name="report.title.search" xml:space="preserve"><value>SharePoint File Search Results</value></data>
+  <data name="report.title.search_short" xml:space="preserve"><value>File Search Results</value></data>
+  <data name="report.title.versions" xml:space="preserve"><value>SharePoint Version Cleanup Report</value></data>
+  <data name="report.title.versions_short" xml:space="preserve"><value>Version Cleanup Report</value></data>
+  <data name="report.stat.total_accesses" xml:space="preserve"><value>Total Accesses</value></data>
+  <data name="report.stat.users_audited" xml:space="preserve"><value>Users Audited</value></data>
+  <data name="report.stat.sites_scanned" xml:space="preserve"><value>Sites Scanned</value></data>
+  <data name="report.stat.high_privilege" xml:space="preserve"><value>High Privilege</value></data>
+  <data name="report.stat.external_users" xml:space="preserve"><value>External Users</value></data>
+  <data name="report.stat.total_entries" xml:space="preserve"><value>Total Entries</value></data>
+  <data name="report.stat.unique_permission_sets" xml:space="preserve"><value>Unique Permission Sets</value></data>
+  <data name="report.stat.distinct_users_groups" xml:space="preserve"><value>Distinct Users/Groups</value></data>
+  <data name="report.stat.libraries" xml:space="preserve"><value>Libraries</value></data>
+  <data name="report.stat.files" xml:space="preserve"><value>Files</value></data>
+  <data name="report.stat.total_size" xml:space="preserve"><value>Total Size</value></data>
+  <data name="report.stat.version_size" xml:space="preserve"><value>Version Size</value></data>
+  <data name="report.badge.guest" xml:space="preserve"><value>Guest</value></data>
+  <data name="report.badge.direct" xml:space="preserve"><value>Direct</value></data>
+  <data name="report.badge.group" xml:space="preserve"><value>Group</value></data>
+  <data name="report.badge.inherited" xml:space="preserve"><value>Inherited</value></data>
+  <data name="report.badge.unique" xml:space="preserve"><value>Unique</value></data>
+  <data name="report.view.by_user" xml:space="preserve"><value>By User</value></data>
+  <data name="report.view.by_site" xml:space="preserve"><value>By Site</value></data>
+  <data name="report.filter.placeholder_results" xml:space="preserve"><value>Filter results...</value></data>
+  <data name="report.filter.placeholder_permissions" xml:space="preserve"><value>Filter permissions...</value></data>
+  <data name="report.filter.placeholder_rows" xml:space="preserve"><value>Filter rows…</value></data>
+  <data name="report.filter.label" xml:space="preserve"><value>Filter:</value></data>
+  <data name="report.col.site" xml:space="preserve"><value>Site</value></data>
+  <data name="report.col.sites" xml:space="preserve"><value>Sites</value></data>
+  <data name="report.col.object_type" xml:space="preserve"><value>Object Type</value></data>
+  <data name="report.col.object" xml:space="preserve"><value>Object</value></data>
+  <data name="report.col.permission_level" xml:space="preserve"><value>Permission Level</value></data>
+  <data name="report.col.access_type" xml:space="preserve"><value>Access Type</value></data>
+  <data name="report.col.granted_through" xml:space="preserve"><value>Granted Through</value></data>
+  <data name="report.col.user" xml:space="preserve"><value>User</value></data>
+  <data name="report.col.title" xml:space="preserve"><value>Title</value></data>
+  <data name="report.col.url" xml:space="preserve"><value>URL</value></data>
+  <data name="report.col.users_groups" xml:space="preserve"><value>Users/Groups</value></data>
+  <data name="report.col.simplified" xml:space="preserve"><value>Simplified</value></data>
+  <data name="report.col.risk" xml:space="preserve"><value>Risk</value></data>
+  <data name="report.col.library_folder" xml:space="preserve"><value>Library / Folder</value></data>
+  <data name="report.col.last_modified" xml:space="preserve"><value>Last Modified</value></data>
+  <data name="report.col.name" xml:space="preserve"><value>Name</value></data>
+  <data name="report.col.library" xml:space="preserve"><value>Library</value></data>
+  <data name="report.col.path" xml:space="preserve"><value>Path</value></data>
+  <data name="report.col.size" xml:space="preserve"><value>Size</value></data>
+  <data name="report.col.created" xml:space="preserve"><value>Created</value></data>
+  <data name="report.col.modified" xml:space="preserve"><value>Modified</value></data>
+  <data name="report.col.created_by" xml:space="preserve"><value>Created By</value></data>
+  <data name="report.col.modified_by" xml:space="preserve"><value>Modified By</value></data>
+  <data name="report.col.file_name" xml:space="preserve"><value>File Name</value></data>
+  <data name="report.col.extension" xml:space="preserve"><value>Extension</value></data>
+  <data name="report.col.file_type" xml:space="preserve"><value>File Type</value></data>
+  <data name="report.col.file_count" xml:space="preserve"><value>File Count</value></data>
+  <data name="report.col.error" xml:space="preserve"><value>Error</value></data>
+  <data name="report.col.timestamp" xml:space="preserve"><value>Timestamp</value></data>
+  <data name="report.col.number" xml:space="preserve"><value>#</value></data>
+  <data name="report.col.group" xml:space="preserve"><value>Group</value></data>
+  <data name="report.col.total_size_mb" xml:space="preserve"><value>Total Size (MB)</value></data>
+  <data name="report.col.version_size_mb" xml:space="preserve"><value>Version Size (MB)</value></data>
+  <data name="report.col.size_mb" xml:space="preserve"><value>Size (MB)</value></data>
+  <data name="report.col.size_bytes" xml:space="preserve"><value>Size (bytes)</value></data>
+  <data name="report.text.accesses" xml:space="preserve"><value>accesses</value></data>
+  <data name="report.text.access_es" xml:space="preserve"><value>access(es)</value></data>
+  <data name="report.text.sites_parens" xml:space="preserve"><value>site(s)</value></data>
+  <data name="report.text.permissions_parens" xml:space="preserve"><value>permission(s)</value></data>
+  <data name="report.text.copies" xml:space="preserve"><value>copies</value></data>
+  <data name="report.text.duplicate_groups_found" xml:space="preserve"><value>duplicate group(s) found.</value></data>
+  <data name="report.text.results_parens" xml:space="preserve"><value>result(s)</value></data>
+  <data name="report.text.of" xml:space="preserve"><value>of</value></data>
+  <data name="report.text.shown" xml:space="preserve"><value>shown</value></data>
+  <data name="report.text.generated" xml:space="preserve"><value>Generated</value></data>
+  <data name="report.text.generated_colon" xml:space="preserve"><value>Generated:</value></data>
+  <data name="report.text.members_unavailable" xml:space="preserve"><value>members unavailable</value></data>
+  <data name="report.text.link" xml:space="preserve"><value>Link</value></data>
+  <data name="report.text.no_ext" xml:space="preserve"><value>(no ext)</value></data>
+  <data name="report.text.no_extension" xml:space="preserve"><value>(no extension)</value></data>
+  <data name="report.text.high_priv" xml:space="preserve"><value>high-priv</value></data>
+  <data name="report.section.storage_by_file_type" xml:space="preserve"><value>Storage by File Type</value></data>
+  <data name="report.section.library_details" xml:space="preserve"><value>Library Details</value></data>
+  <!-- Site picker dialog -->
+  <data name="sitepicker.title" xml:space="preserve"><value>Select Sites</value></data>
+  <data name="sitepicker.filter" xml:space="preserve"><value>Filter:</value></data>
+  <data name="sitepicker.type" xml:space="preserve"><value>Type:</value></data>
+  <data name="sitepicker.type.all" xml:space="preserve"><value>All</value></data>
+  <data name="sitepicker.type.team" xml:space="preserve"><value>Team sites (MS Teams)</value></data>
+  <data name="sitepicker.type.communication" xml:space="preserve"><value>Communication</value></data>
+  <data name="sitepicker.type.classic" xml:space="preserve"><value>Classic</value></data>
+  <data name="sitepicker.type.other" xml:space="preserve"><value>Other</value></data>
+  <data name="sitepicker.size" xml:space="preserve"><value>Size (MB):</value></data>
+  <data name="sitepicker.size.min" xml:space="preserve"><value>min</value></data>
+  <data name="sitepicker.size.max" xml:space="preserve"><value>max</value></data>
+  <data name="sitepicker.col.title" xml:space="preserve"><value>Title</value></data>
+  <data name="sitepicker.col.url" xml:space="preserve"><value>URL</value></data>
+  <data name="sitepicker.col.type" xml:space="preserve"><value>Type</value></data>
+  <data name="sitepicker.col.size" xml:space="preserve"><value>Size</value></data>
+  <data name="sitepicker.btn.load" xml:space="preserve"><value>Load Sites</value></data>
+  <data name="sitepicker.btn.selectAll" xml:space="preserve"><value>Select All</value></data>
+  <data name="sitepicker.btn.deselectAll" xml:space="preserve"><value>Deselect All</value></data>
+  <data name="sitepicker.btn.ok" xml:space="preserve"><value>OK</value></data>
+  <data name="sitepicker.btn.cancel" xml:space="preserve"><value>Cancel</value></data>
+  <data name="sitepicker.status.loading" xml:space="preserve"><value>Loading sites...</value></data>
+  <data name="sitepicker.status.loaded" xml:space="preserve"><value>{0} sites loaded.</value></data>
+  <data name="sitepicker.status.shown" xml:space="preserve"><value>{0} / {1} sites shown.</value></data>
+  <data name="sitepicker.status.error" xml:space="preserve"><value>Error: {0}</value></data>
+  <data name="sitepicker.kind.teamsite" xml:space="preserve"><value>Team site</value></data>
+  <data name="sitepicker.kind.communication" xml:space="preserve"><value>Communication</value></data>
+  <data name="sitepicker.kind.classic" xml:space="preserve"><value>Classic</value></data>
+  <data name="sitepicker.kind.other" xml:space="preserve"><value>Other</value></data>
+  <!-- Common UI -->
+  <data name="common.valid" xml:space="preserve"><value>Valid</value></data>
+  <data name="common.errors" xml:space="preserve"><value>Errors</value></data>
+  <data name="common.close" xml:space="preserve"><value>Close</value></data>
+  <data name="common.new_folder" xml:space="preserve"><value>+ New Folder</value></data>
+  <data name="common.guest" xml:space="preserve"><value>Guest</value></data>
+  <!-- InputDialog -->
+  <data name="input.title" xml:space="preserve"><value>Input</value></data>
+  <!-- ProfileManagementDialog -->
+  <data name="profmgmt.title" xml:space="preserve"><value>Manage Profiles</value></data>
+  <data name="profmgmt.group" xml:space="preserve"><value>Profiles</value></data>
+  <!-- Duplicates columns -->
+  <data name="duplicates.col.group" xml:space="preserve"><value>Group</value></data>
+  <data name="duplicates.col.copies" xml:space="preserve"><value>Copies</value></data>
+  <!-- Folder structure levels -->
+  <data name="folderstruct.col.level1" xml:space="preserve"><value>Level 1</value></data>
+  <data name="folderstruct.col.level2" xml:space="preserve"><value>Level 2</value></data>
+  <data name="folderstruct.col.level3" xml:space="preserve"><value>Level 3</value></data>
+  <data name="folderstruct.col.level4" xml:space="preserve"><value>Level 4</value></data>
+  <!-- Permissions extra columns -->
+  <data name="perm.col.unique_perms" xml:space="preserve"><value>Unique Perms</value></data>
+  <data name="perm.col.permission_levels" xml:space="preserve"><value>Permission Levels</value></data>
+  <data name="perm.col.principal_type" xml:space="preserve"><value>Principal Type</value></data>
+  <!-- Storage summary labels -->
+  <data name="storage.lbl.total_size_colon" xml:space="preserve"><value>Total Size: </value></data>
+  <data name="storage.lbl.version_size_colon" xml:space="preserve"><value>Version Size: </value></data>
+  <data name="storage.lbl.files_colon" xml:space="preserve"><value>Files: </value></data>
+  <!-- Templates columns -->
+  <data name="templates.col.source" xml:space="preserve"><value>Source</value></data>
+  <data name="templates.col.captured" xml:space="preserve"><value>Captured</value></data>
+  <!-- Transfer view -->
+  <data name="transfer.text.files_selected" xml:space="preserve"><value> file(s) selected</value></data>
+  <data name="transfer.chk.include_source" xml:space="preserve"><value>Include source folder at destination</value></data>
+  <data name="transfer.chk.include_source.tooltip" xml:space="preserve"><value>When on, recreate the source folder under the destination. When off, drop contents directly into the destination folder.</value></data>
+  <data name="transfer.chk.copy_contents" xml:space="preserve"><value>Copy folder contents</value></data>
+  <data name="transfer.chk.copy_contents.tooltip" xml:space="preserve"><value>When on (default), transfer files inside the folder. When off, only the folder is created at the destination.</value></data>
+  <!-- Shared ViewModel errors and statuses -->
+  <data name="err.no_tenant" xml:space="preserve"><value>No tenant connected.</value></data>
+  <data name="err.no_tenant_connected" xml:space="preserve"><value>No tenant selected. Please connect to a tenant first.</value></data>
+  <data name="err.no_profile_selected" xml:space="preserve"><value>No tenant profile selected. Please connect first.</value></data>
+  <data name="err.no_sites_selected" xml:space="preserve"><value>Select at least one site from the toolbar.</value></data>
+  <data name="err.no_users_selected" xml:space="preserve"><value>Add at least one user to audit.</value></data>
+  <data name="err.no_valid_rows" xml:space="preserve"><value>No valid rows to process. Import a CSV first.</value></data>
+  <data name="err.template_name_required" xml:space="preserve"><value>Template name is required.</value></data>
+  <data name="err.site_title_required" xml:space="preserve"><value>New site title is required.</value></data>
+  <data name="err.site_alias_required" xml:space="preserve"><value>New site alias is required.</value></data>
+  <data name="err.transfer_source_required" xml:space="preserve"><value>Source site and library must be selected.</value></data>
+  <data name="err.transfer_dest_required" xml:space="preserve"><value>Destination site and library must be selected.</value></data>
+  <data name="err.library_title_required" xml:space="preserve"><value>Library title is required.</value></data>
+  <!-- Templates status -->
+  <data name="templates.status.capturing" xml:space="preserve"><value>Capturing template...</value></data>
+  <data name="templates.status.success" xml:space="preserve"><value>Template captured successfully.</value></data>
+  <data name="templates.status.capture_failed" xml:space="preserve"><value>Capture failed: {0}</value></data>
+  <data name="templates.status.applying" xml:space="preserve"><value>Applying template...</value></data>
+  <data name="templates.status.applied" xml:space="preserve"><value>Template applied. Site created at: {0}</value></data>
+  <data name="templates.status.apply_failed" xml:space="preserve"><value>Apply failed: {0}</value></data>
+  <!-- UI text -->
+  <data name="audit.searching" xml:space="preserve"><value>Searching...</value></data>
+  <!-- Report text -->
+  <data name="report.text.users_parens" xml:space="preserve"><value>user(s)</value></data>
+  <data name="report.text.files_unit" xml:space="preserve"><value>files</value></data>
+  <data name="report.text.sites_unit" xml:space="preserve"><value>sites</value></data>
 </root>

SharepointToolbox/MainWindow.xaml

@@ -8,6 +8,10 @@
         xmlns:views="clr-namespace:SharepointToolbox.Views.Tabs"
         mc:Ignorable="d"
         Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[app.title]}"
+        Icon="pack://application:,,,/Resources/SPToolbox-logo-ico.png"
+        Background="{DynamicResource AppBgBrush}"
+        Foreground="{DynamicResource TextBrush}"
+        TextOptions.TextFormattingMode="Ideal"
         MinWidth="900" MinHeight="600" Height="700" Width="1100">
   <DockPanel>
     <!-- Toolbar -->
@@ -15,8 +19,6 @@
       <ComboBox Width="220" ItemsSource="{Binding TenantProfiles}"
                 SelectedItem="{Binding SelectedProfile}"
                 DisplayMemberPath="Name" />
-      <Button Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[toolbar.connect]}"
-              Command="{Binding ConnectCommand}" />
       <Button Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[toolbar.manage]}"
               Command="{Binding ManageProfilesCommand}" />
       <Separator />
@@ -28,7 +30,7 @@
               ToolTip="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[toolbar.selectSites.tooltip]}" />
       <TextBlock Text="{Binding GlobalSitesSelectedLabel}"
                  VerticalAlignment="Center" Margin="6,0,0,0"
-                 Foreground="Gray" />
+                 Foreground="{DynamicResource TextMutedBrush}" />
     </ToolBar>
 
     <!-- StatusBar: tenant name | operation status text | progress % -->
@@ -60,6 +62,9 @@
       <TabItem x:Name="DuplicatesTabItem"
                Header="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[tab.duplicates]}">
       </TabItem>
+      <TabItem x:Name="VersionsTabItem"
+               Header="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[tab.versions]}">
+      </TabItem>
       <TabItem x:Name="TransferTabItem"
                Header="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[tab.transfer]}">
       </TabItem>

SharepointToolbox/MainWindow.xaml.cs

@@ -40,6 +40,9 @@ public partial class MainWindow : Window
         // Replace Duplicates tab placeholder with the DI-resolved DuplicatesView
         DuplicatesTabItem.Content = serviceProvider.GetRequiredService<DuplicatesView>();
 
+        // Versions cleanup tab
+        VersionsTabItem.Content = serviceProvider.GetRequiredService<VersionCleanupView>();
+
         // Phase 4: Replace stub tabs with DI-resolved Views
         TransferTabItem.Content = serviceProvider.GetRequiredService<TransferView>();
         BulkMembersTabItem.Content = serviceProvider.GetRequiredService<BulkMembersView>();

SharepointToolbox/Services/AppRegistrationService.cs

@@ -11,12 +11,41 @@ namespace SharepointToolbox.Services;
 /// Manages Azure AD app registration and removal using the Microsoft Graph API.
 /// All operations use <see cref="GraphClientFactory"/> for token acquisition.
 /// </summary>
+/// <remarks>
+/// <para>GraphServiceClient lifecycle: a fresh client is created per public call
+/// (<see cref="IsGlobalAdminAsync"/>, <see cref="RegisterAsync"/>,
+/// <see cref="RollbackAsync"/>, <see cref="RemoveAsync"/>). This is intentional —
+/// each call may use different scopes (RegistrationScopes vs. default) and target
+/// a different tenant, so a cached per-service instance would bind the wrong
+/// authority. The factory itself caches the underlying MSAL PCA and token cache,
+/// so client construction is cheap (no network hit when tokens are valid).</para>
+/// <para>Do not cache a GraphServiceClient at call sites — always go through
+/// <see cref="GraphClientFactory"/> so tenant pinning and scope selection stay
+/// correct.</para>
+/// </remarks>
 public class AppRegistrationService : IAppRegistrationService
 {
+    // Entra built-in directory role template IDs are global constants shared across all tenants.
+    // GlobalAdminTemplateId: "Global Administrator" directoryRoleTemplate.
+    // See https://learn.microsoft.com/entra/identity/role-based-access-control/permissions-reference#global-administrator
     private const string GlobalAdminTemplateId = "62e90394-69f5-4237-9190-012177145e10";
+
+    // First-party Microsoft service appIds (constant across tenants).
     private const string GraphAppId = "00000003-0000-0000-c000-000000000000";
     private const string SharePointAppId = "00000003-0000-0ff1-ce00-000000000000";
 
+    // Explicit scopes for the registration flow. The bootstrap client
+    // (Microsoft Graph Command Line Tools) does not pre-consent these, so
+    // requesting `.default` returns a token without them → POST /applications
+    // fails with 403 even for a Global Admin. Requesting them explicitly
+    // triggers the admin-consent prompt on first use.
+    private static readonly string[] RegistrationScopes = new[]
+    {
+        "https://graph.microsoft.com/Application.ReadWrite.All",
+        "https://graph.microsoft.com/DelegatedPermissionGrant.ReadWrite.All",
+        "https://graph.microsoft.com/Directory.Read.All",
+    };
+
     private readonly AppGraphClientFactory _graphFactory;
     private readonly AppMsalClientFactory _msalFactory;
     private readonly ISessionManager _sessionManager;
@@ -35,38 +64,33 @@ public class AppRegistrationService : IAppRegistrationService
     }
 
     /// <inheritdoc/>
-    public async Task<bool> IsGlobalAdminAsync(string clientId, CancellationToken ct)
+    public async Task<bool> IsGlobalAdminAsync(string clientId, string tenantUrl, CancellationToken ct)
     {
-        try
+        // No $filter: isof() on directoryObject requires advanced query params
-        {
+        // (ConsistencyLevel: eventual + $count=true) and fails with 400 otherwise.
-            var graphClient = await _graphFactory.CreateClientAsync(clientId, ct);
+        // The user's membership list is small; filtering client-side is fine.
-            var roles = await graphClient.Me.TransitiveMemberOf.GetAsync(req =>
+        var tenantId = ResolveTenantId(tenantUrl);
-            {
+        var graphClient = await _graphFactory.CreateClientAsync(clientId, tenantId, ct);
-                req.QueryParameters.Filter = "isof('microsoft.graph.directoryRole')";
+        var memberships = await graphClient.Me.TransitiveMemberOf.GetAsync(cancellationToken: ct);
-            }, ct);
 
-            return roles?.Value?
+        return memberships?.Value?
-                .OfType<DirectoryRole>()
+            .OfType<DirectoryRole>()
-                .Any(r => string.Equals(r.RoleTemplateId, GlobalAdminTemplateId,
+            .Any(r => string.Equals(r.RoleTemplateId, GlobalAdminTemplateId,
-                    StringComparison.OrdinalIgnoreCase)) ?? false;
+                StringComparison.OrdinalIgnoreCase)) ?? false;
-        }
-        catch (Exception ex)
-        {
-            _logger.LogWarning(ex, "IsGlobalAdminAsync failed — treating as non-admin. ClientId={ClientId}", clientId);
-            return false;
-        }
     }
 
     /// <inheritdoc/>
     public async Task<AppRegistrationResult> RegisterAsync(
         string clientId,
+        string tenantUrl,
         string tenantDisplayName,
         CancellationToken ct)
     {
+        var tenantId = ResolveTenantId(tenantUrl);
         Application? createdApp = null;
         try
         {
-            var graphClient = await _graphFactory.CreateClientAsync(clientId, ct);
+            var graphClient = await _graphFactory.CreateClientAsync(clientId, tenantId, RegistrationScopes, ct);
 
             // Step 1: Create Application object
             var appRequest = new Application
@@ -78,7 +102,10 @@ public class AppRegistrationService : IAppRegistrationService
                 {
                     RedirectUris = new List<string>
                     {
-                        "https://login.microsoftonline.com/common/oauth2/nativeclient"
+                        // Loopback URI for MSAL desktop default (any port accepted by Entra).
+                        "http://localhost",
+                        // Legacy native-client URI for embedded WebView fallback.
+                        "https://login.microsoftonline.com/common/oauth2/nativeclient",
                     }
                 },
                 RequiredResourceAccess = BuildRequiredResourceAccess()
@@ -131,34 +158,45 @@ public class AppRegistrationService : IAppRegistrationService
             _logger.LogInformation("App registration complete. AppId={AppId}", createdApp.AppId);
             return AppRegistrationResult.Success(createdApp.AppId!);
         }
+        catch (Microsoft.Graph.Models.ODataErrors.ODataError odataEx)
+            when (odataEx.ResponseStatusCode == 401 || odataEx.ResponseStatusCode == 403)
+        {
+            _logger.LogWarning(odataEx,
+                "RegisterAsync refused by Graph (status {Status}) — user lacks role/consent. Surfacing fallback.",
+                odataEx.ResponseStatusCode);
+            await RollbackAsync(createdApp, clientId, tenantId, ct);
+            return AppRegistrationResult.FallbackRequired();
+        }
         catch (Exception ex)
         {
             _logger.LogError(ex, "RegisterAsync failed. Attempting rollback.");
-
+            await RollbackAsync(createdApp, clientId, tenantId, ct);
-            if (createdApp?.Id is not null)
-            {
-                try
-                {
-                    var graphClient = await _graphFactory.CreateClientAsync(clientId, ct);
-                    await graphClient.Applications[createdApp.Id].DeleteAsync(cancellationToken: ct);
-                    _logger.LogInformation("Rollback: deleted Application {ObjectId}", createdApp.Id);
-                }
-                catch (Exception rollbackEx)
-                {
-                    _logger.LogWarning(rollbackEx, "Rollback failed for Application {ObjectId}", createdApp.Id);
-                }
-            }
-
             return AppRegistrationResult.Failure(ex.Message);
         }
     }
 
+    private async Task RollbackAsync(Application? createdApp, string clientId, string tenantId, CancellationToken ct)
+    {
+        if (createdApp?.Id is null) return;
+        try
+        {
+            var graphClient = await _graphFactory.CreateClientAsync(clientId, tenantId, RegistrationScopes, ct);
+            await graphClient.Applications[createdApp.Id].DeleteAsync(cancellationToken: ct);
+            _logger.LogInformation("Rollback: deleted Application {ObjectId}", createdApp.Id);
+        }
+        catch (Exception rollbackEx)
+        {
+            _logger.LogWarning(rollbackEx, "Rollback failed for Application {ObjectId}", createdApp.Id);
+        }
+    }
+
     /// <inheritdoc/>
-    public async Task RemoveAsync(string clientId, string appId, CancellationToken ct)
+    public async Task RemoveAsync(string clientId, string tenantUrl, string appId, CancellationToken ct)
     {
         try
         {
-            var graphClient = await _graphFactory.CreateClientAsync(clientId, ct);
+            var tenantId = ResolveTenantId(tenantUrl);
+            var graphClient = await _graphFactory.CreateClientAsync(clientId, tenantId, RegistrationScopes, ct);
             await graphClient.Applications[$"(appId='{appId}')"].DeleteAsync(cancellationToken: ct);
             _logger.LogInformation("Removed Application appId={AppId}", appId);
         }
@@ -168,6 +206,32 @@ public class AppRegistrationService : IAppRegistrationService
         }
     }
 
+    /// <summary>
+    /// Derives a tenant identifier (domain) from a SharePoint tenant URL so MSAL
+    /// can pin the authority to the correct tenant. Examples:
+    ///   https://contoso.sharepoint.com       → contoso.onmicrosoft.com
+    ///   https://contoso-admin.sharepoint.com → contoso.onmicrosoft.com
+    /// Throws <see cref="ArgumentException"/> when the URL is not a recognisable
+    /// SharePoint URL — falling back to /common would silently route registration
+    /// to the signed-in user's home tenant, which is the bug this guards against.
+    /// </summary>
+    internal static string ResolveTenantId(string tenantUrl)
+    {
+        if (!Uri.TryCreate(tenantUrl, UriKind.Absolute, out var uri))
+            throw new ArgumentException($"Invalid tenant URL: '{tenantUrl}'", nameof(tenantUrl));
+
+        var host = uri.Host;
+        var firstDot = host.IndexOf('.');
+        if (firstDot <= 0)
+            throw new ArgumentException($"Cannot derive tenant from host '{host}'", nameof(tenantUrl));
+
+        var prefix = host.Substring(0, firstDot);
+        if (prefix.EndsWith("-admin", StringComparison.OrdinalIgnoreCase))
+            prefix = prefix.Substring(0, prefix.Length - "-admin".Length);
+
+        return $"{prefix}.onmicrosoft.com";
+    }
+
     /// <inheritdoc/>
     public async Task ClearMsalSessionAsync(string clientId, string tenantUrl)
     {

SharepointToolbox/Services/BulkOperationRunner.cs

@@ -7,29 +7,72 @@ public static class BulkOperationRunner
     /// <summary>
     /// Runs a bulk operation with continue-on-error semantics, per-item result tracking,
     /// and cancellation support. OperationCanceledException propagates immediately.
+    ///
+    /// Progress is reported AFTER each item completes (success or failure), so the bar
+    /// reflects actual work done rather than work queued. A final "Complete" report
+    /// guarantees 100% when the total was determinate.
+    ///
+    /// Set <paramref name="maxConcurrency"/> > 1 to run items in parallel. Callers must
+    /// ensure processItem is safe to invoke concurrently (e.g. each invocation uses its
+    /// own CSOM ClientContext — a shared CSOM context is NOT thread-safe).
     /// </summary>
     public static async Task<BulkOperationSummary<TItem>> RunAsync<TItem>(
         IReadOnlyList<TItem> items,
         Func<TItem, int, CancellationToken, Task> processItem,
         IProgress<OperationProgress> progress,
-        CancellationToken ct)
+        CancellationToken ct,
+        int maxConcurrency = 1)
     {
-        var results = new List<BulkItemResult<TItem>>();
+        if (items.Count == 0)
-        for (int i = 0; i < items.Count; i++)
+        {
+            progress.Report(new OperationProgress(0, 0, "Nothing to do."));
+            return new BulkOperationSummary<TItem>(Array.Empty<BulkItemResult<TItem>>());
+        }
+
+        progress.Report(new OperationProgress(0, items.Count, $"Processing 1/{items.Count}..."));
+
+        var results = new BulkItemResult<TItem>[items.Count];
+        int completed = 0;
+
+        async Task RunOne(int i, CancellationToken token)
         {
-            ct.ThrowIfCancellationRequested();
-            progress.Report(new OperationProgress(i + 1, items.Count, $"Processing {i + 1}/{items.Count}..."));
             try
             {
-                await processItem(items[i], i, ct);
+                await processItem(items[i], i, token);
-                results.Add(BulkItemResult<TItem>.Success(items[i]));
+                results[i] = BulkItemResult<TItem>.Success(items[i]);
             }
             catch (OperationCanceledException) { throw; }
             catch (Exception ex)
             {
-                results.Add(BulkItemResult<TItem>.Failed(items[i], ex.Message));
+                results[i] = BulkItemResult<TItem>.Failed(items[i], ex.Message);
+            }
+            finally
+            {
+                int done = Interlocked.Increment(ref completed);
+                progress.Report(new OperationProgress(done, items.Count,
+                    $"Processed {done}/{items.Count}"));
             }
         }
+
+        if (maxConcurrency <= 1)
+        {
+            for (int i = 0; i < items.Count; i++)
+            {
+                ct.ThrowIfCancellationRequested();
+                await RunOne(i, ct);
+            }
+        }
+        else
+        {
+            var options = new ParallelOptions
+            {
+                MaxDegreeOfParallelism = maxConcurrency,
+                CancellationToken = ct
+            };
+            await Parallel.ForEachAsync(Enumerable.Range(0, items.Count), options,
+                async (i, token) => await RunOne(i, token));
+        }
+
         progress.Report(new OperationProgress(items.Count, items.Count, "Complete."));
         return new BulkOperationSummary<TItem>(results);
     }

SharepointToolbox/Services/DuplicatesService.cs

@@ -1,7 +1,9 @@
+using System.Diagnostics;
 using Microsoft.SharePoint.Client;
 using Microsoft.SharePoint.Client.Search.Query;
 using SharepointToolbox.Core.Helpers;
 using SharepointToolbox.Core.Models;
+using SharepointToolbox.Services.Export;
 
 namespace SharepointToolbox.Services;
 
@@ -13,9 +15,27 @@ namespace SharepointToolbox.Services;
 /// </summary>
 public class DuplicatesService : IDuplicatesService
 {
+    // SharePoint Search REST API caps RowLimit at 500 per request; larger values are silently clamped.
     private const int BatchSize = 500;
+
+    // SharePoint Search hard ceiling — StartRow > 50,000 returns an error regardless of pagination state.
+    // See https://learn.microsoft.com/sharepoint/dev/general-development/customizing-search-results-in-sharepoint
     private const int MaxStartRow = 50_000;
 
+    /// <summary>
+    /// Scans a site for duplicate files or folders and groups matches by the
+    /// composite key configured in <paramref name="options"/> (name plus any
+    /// of size / created / modified / subfolder-count / file-count).
+    /// File mode uses the SharePoint Search API — it is fast but capped at
+    /// 50,000 rows (see <see cref="MaxStartRow"/>). Folder mode uses paginated
+    /// CSOM CAML over every document library on the site. Groups with fewer
+    /// than two items are dropped before return.
+    /// </summary>
+    /// <param name="ctx">Authenticated <see cref="ClientContext"/> for the target site.</param>
+    /// <param name="options">Scope (Files/Folders), optional library filter, and match-key toggles.</param>
+    /// <param name="progress">Receives row-count progress during collection.</param>
+    /// <param name="ct">Cancellation token — honoured between paged requests.</param>
+    /// <returns>Duplicate groups ordered by descending size, then name.</returns>
     public async Task<IReadOnlyList<DuplicateGroup>> ScanDuplicatesAsync(
         ClientContext ctx,
         DuplicateScanOptions options,
@@ -70,6 +90,8 @@ public class DuplicatesService : IDuplicatesService
         IProgress<OperationProgress> progress,
         CancellationToken ct)
     {
+        var (siteUrl, siteTitle) = await LoadSiteIdentityAsync(ctx, progress, ct);
+
         // KQL: all documents, optionally scoped to a library
         var kqlParts = new List<string> { "ContentType:Document" };
         if (!string.IsNullOrEmpty(options.Library))
@@ -102,10 +124,25 @@ public class DuplicatesService : IDuplicatesService
                 .FirstOrDefault(t => t.TableType == KnownTableTypes.RelevantResults);
             if (table == null || table.RowCount == 0) break;
 
-            foreach (System.Collections.Hashtable row in table.ResultRows)
+            foreach (var rawRow in table.ResultRows)
             {
-                var dict = row.Cast<System.Collections.DictionaryEntry>()
+                // CSOM has returned ResultRows as either Hashtable or
-                    .ToDictionary(e => e.Key.ToString()!, e => e.Value ?? (object)string.Empty);
+                // Dictionary<string,object> across versions — accept both.
+                IDictionary<string, object> dict;
+                if (rawRow is IDictionary<string, object> generic)
+                {
+                    dict = generic;
+                }
+                else if (rawRow is System.Collections.IDictionary legacy)
+                {
+                    dict = new Dictionary<string, object>();
+                    foreach (System.Collections.DictionaryEntry e in legacy)
+                        dict[e.Key.ToString()!] = e.Value ?? string.Empty;
+                }
+                else
+                {
+                    continue;
+                }
 
                 string path = GetStr(dict, "Path");
                 if (path.Contains("/_vti_history/", StringComparison.OrdinalIgnoreCase))
@@ -132,7 +169,9 @@ public class DuplicatesService : IDuplicatesService
                     Library   = library,
                     SizeBytes = size,
                     Created   = created,
-                    Modified  = modified
+                    Modified  = modified,
+                    SiteUrl   = siteUrl,
+                    SiteTitle = siteTitle
                 });
             }
 
@@ -156,10 +195,16 @@ public class DuplicatesService : IDuplicatesService
     {
         // Load all document libraries on the site
         ctx.Load(ctx.Web,
+            w => w.Title,
             w => w.Lists.Include(
                 l => l.Title, l => l.Hidden, l => l.BaseType));
         await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
 
+        var siteUrl = ctx.Url;
+        var siteTitle = string.IsNullOrWhiteSpace(ctx.Web.Title)
+            ? ReportSplitHelper.DeriveSiteLabel(siteUrl)
+            : ctx.Web.Title;
+
         var libs = ctx.Web.Lists
             .Where(l => !l.Hidden && l.BaseType == BaseType.DocumentLibrary)
             .ToList();
@@ -172,19 +217,15 @@ public class DuplicatesService : IDuplicatesService
                 .ToList();
         }
 
+        // No WHERE clause — a WHERE on non-indexed fields (FSObjType) throws the
+        // list-view threshold on libraries > 5,000 items even with pagination.
+        // Filter for folders client-side via FileSystemObjectType below.
         var camlQuery = new CamlQuery
         {
             ViewXml = """
                 <View Scope='RecursiveAll'>
-                  <Query>
+                  <Query></Query>
-                    <Where>
+                  <RowLimit Paged='TRUE'>5000</RowLimit>
-                      <Eq>
-                        <FieldRef Name='FSObjType' />
-                        <Value Type='Integer'>1</Value>
-                      </Eq>
-                    </Where>
-                  </Query>
-                  <RowLimit>2000</RowLimit>
                 </View>
                 """
         };
@@ -200,6 +241,8 @@ public class DuplicatesService : IDuplicatesService
             {
                 ct.ThrowIfCancellationRequested();
 
+                if (item.FileSystemObjectType != FileSystemObjectType.Folder) continue;
+
                 var fv = item.FieldValues;
                 string name      = fv["FileLeafRef"]?.ToString() ?? string.Empty;
                 string fileRef   = fv["FileRef"]?.ToString() ?? string.Empty;
@@ -217,7 +260,9 @@ public class DuplicatesService : IDuplicatesService
                     FolderCount = subCount,
                     FileCount   = fileCount,
                     Created     = created,
-                    Modified    = modified
+                    Modified    = modified,
+                    SiteUrl     = siteUrl,
+                    SiteTitle   = siteTitle
                 });
             }
         }
@@ -246,6 +291,37 @@ public class DuplicatesService : IDuplicatesService
     private static DateTime? ParseDate(string s) =>
         DateTime.TryParse(s, out var dt) ? dt : (DateTime?)null;
 
+    private static async Task<(string Url, string Title)> LoadSiteIdentityAsync(
+        ClientContext ctx, IProgress<OperationProgress> progress, CancellationToken ct)
+    {
+        try
+        {
+            ctx.Load(ctx.Web, w => w.Title);
+            await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
+        }
+        catch (OperationCanceledException)
+        {
+            throw;
+        }
+        catch (Exception ex)
+        {
+            // Best-effort — fall back to URL-derived label
+            Debug.WriteLine($"[DuplicatesService] LoadSiteIdentityAsync: failed to load Web.Title: {ex.GetType().Name}: {ex.Message}");
+        }
+
+        var url = ctx.Url ?? string.Empty;
+        string title;
+        try { title = ctx.Web.Title; }
+        catch (Exception ex)
+        {
+            Debug.WriteLine($"[DuplicatesService] LoadSiteIdentityAsync: Web.Title getter threw: {ex.GetType().Name}: {ex.Message}");
+            title = string.Empty;
+        }
+        if (string.IsNullOrWhiteSpace(title))
+            title = ReportSplitHelper.DeriveSiteLabel(url);
+        return (url, title);
+    }
+
     private static string ExtractLibraryFromPath(string path, string siteUrl)
     {
         // Extract first path segment after the site URL as library name

SharepointToolbox/Services/Export/BulkResultCsvExportService.cs

@@ -2,20 +2,40 @@ using System.Globalization;
 using System.IO;
 using System.Text;
 using CsvHelper;
+using CsvHelper.Configuration;
 using SharepointToolbox.Core.Models;
+using SharepointToolbox.Localization;
 
 namespace SharepointToolbox.Services.Export;
 
+/// <summary>
+/// Exports the failed subset of a <see cref="BulkOperationSummary{T}"/> run
+/// to CSV. CsvHelper is used so the <typeparamref name="T"/> payload's
+/// properties become columns automatically, plus one error-message and one
+/// timestamp column appended at the end.
+/// </summary>
 public class BulkResultCsvExportService
 {
+    private static readonly CsvConfiguration CsvConfig = new(CultureInfo.InvariantCulture)
+    {
+        // Prevent CSV formula injection: prefix =, +, -, @, tab, CR with single quote
+        InjectionOptions = InjectionOptions.Escape,
+    };
+
+    /// <summary>
+    /// Builds a CSV containing only items whose <see cref="BulkItemResult{T}.IsSuccess"/>
+    /// is <c>false</c>. Columns: every public property of <typeparamref name="T"/>
+    /// followed by Error and Timestamp (ISO-8601).
+    /// </summary>
     public string BuildFailedItemsCsv<T>(IReadOnlyList<BulkItemResult<T>> failedItems)
     {
+        var TL = TranslationSource.Instance;
         using var writer = new StringWriter();
-        using var csv = new CsvWriter(writer, CultureInfo.InvariantCulture);
+        using var csv = new CsvWriter(writer, CsvConfig);
 
         csv.WriteHeader<T>();
-        csv.WriteField("Error");
+        csv.WriteField(TL["report.col.error"]);
-        csv.WriteField("Timestamp");
+        csv.WriteField(TL["report.col.timestamp"]);
         csv.NextRecord();
 
         foreach (var item in failedItems.Where(r => !r.IsSuccess))
@@ -29,12 +49,13 @@ public class BulkResultCsvExportService
         return writer.ToString();
     }
 
+    /// <summary>Writes the failed-items CSV to <paramref name="filePath"/> with UTF-8 BOM.</summary>
     public async Task WriteFailedItemsCsvAsync<T>(
         IReadOnlyList<BulkItemResult<T>> failedItems,
         string filePath,
         CancellationToken ct)
     {
         var content = BuildFailedItemsCsv(failedItems);
-        await System.IO.File.WriteAllTextAsync(filePath, content, new UTF8Encoding(true), ct);
+        await ExportFileWriter.WriteCsvAsync(filePath, content, ct);
     }
 }

SharepointToolbox/Services/Export/CsvExportService.cs

@@ -1,6 +1,7 @@
 using System.IO;
 using System.Text;
 using SharepointToolbox.Core.Models;
+using SharepointToolbox.Localization;
 
 namespace SharepointToolbox.Services.Export;
 
@@ -10,8 +11,11 @@ namespace SharepointToolbox.Services.Export;
 /// </summary>
 public class CsvExportService
 {
-    private const string Header =
+    private static string BuildHeader()
-        "\"Object\",\"Title\",\"URL\",\"HasUniquePermissions\",\"Users\",\"UserLogins\",\"Type\",\"Permissions\",\"GrantedThrough\"";
+    {
+        var T = TranslationSource.Instance;
+        return $"\"{T["report.col.object"]}\",\"{T["report.col.title"]}\",\"{T["report.col.url"]}\",\"HasUniquePermissions\",\"Users\",\"UserLogins\",\"Type\",\"Permissions\",\"GrantedThrough\"";
+    }
 
     /// <summary>
     /// Builds a CSV string from the supplied permission entries.
@@ -20,7 +24,7 @@ public class CsvExportService
     public string BuildCsv(IReadOnlyList<PermissionEntry> entries)
     {
         var sb = new StringBuilder();
-        sb.AppendLine(Header);
+        sb.AppendLine(BuildHeader());
 
         // Merge: group by (Users, PermissionLevels, GrantedThrough) — port of PS Merge-PermissionRows
         var merged = entries
@@ -55,14 +59,17 @@ public class CsvExportService
     public async Task WriteAsync(IReadOnlyList<PermissionEntry> entries, string filePath, CancellationToken ct)
     {
         var csv = BuildCsv(entries);
-        await File.WriteAllTextAsync(filePath, csv, new UTF8Encoding(encoderShouldEmitUTF8Identifier: true), ct);
+        await ExportFileWriter.WriteCsvAsync(filePath, csv, ct);
     }
 
     /// <summary>
     /// Header for simplified CSV export — includes "SimplifiedLabels" and "RiskLevel" columns.
     /// </summary>
-    private const string SimplifiedHeader =
+    private static string BuildSimplifiedHeader()
-        "\"Object\",\"Title\",\"URL\",\"HasUniquePermissions\",\"Users\",\"UserLogins\",\"Type\",\"Permissions\",\"SimplifiedLabels\",\"RiskLevel\",\"GrantedThrough\"";
+    {
+        var T = TranslationSource.Instance;
+        return $"\"{T["report.col.object"]}\",\"{T["report.col.title"]}\",\"{T["report.col.url"]}\",\"HasUniquePermissions\",\"Users\",\"UserLogins\",\"Type\",\"Permissions\",\"SimplifiedLabels\",\"RiskLevel\",\"GrantedThrough\"";
+    }
 
     /// <summary>
     /// Builds a CSV string from simplified permission entries.
@@ -72,7 +79,7 @@ public class CsvExportService
     public string BuildCsv(IReadOnlyList<SimplifiedPermissionEntry> entries)
     {
         var sb = new StringBuilder();
-        sb.AppendLine(SimplifiedHeader);
+        sb.AppendLine(BuildSimplifiedHeader());
 
         var merged = entries
             .GroupBy(e => (e.Users, e.PermissionLevels, e.GrantedThrough))
@@ -109,13 +116,57 @@ public class CsvExportService
     public async Task WriteAsync(IReadOnlyList<SimplifiedPermissionEntry> entries, string filePath, CancellationToken ct)
     {
         var csv = BuildCsv(entries);
-        await File.WriteAllTextAsync(filePath, csv, new UTF8Encoding(encoderShouldEmitUTF8Identifier: true), ct);
+        await ExportFileWriter.WriteCsvAsync(filePath, csv, ct);
     }
 
-    /// <summary>RFC 4180 CSV field escaping: wrap in double quotes, double internal quotes.</summary>
+    /// <summary>
-    private static string Csv(string value)
+    /// Writes permission entries with optional per-site partitioning.
+    /// Single → writes one file at <paramref name="basePath"/>.
+    /// BySite → one file per site-collection URL, suffixed on the base path.
+    /// </summary>
+    public Task WriteAsync(
+        IReadOnlyList<PermissionEntry> entries,
+        string basePath,
+        ReportSplitMode splitMode,
+        CancellationToken ct)
+        => ReportSplitHelper.WritePartitionedAsync(
+            entries, basePath, splitMode,
+            PartitionBySite,
+            (part, path, c) => WriteAsync(part, path, c),
+            ct);
+
+    /// <summary>Simplified-entry split variant.</summary>
+    public Task WriteAsync(
+        IReadOnlyList<SimplifiedPermissionEntry> entries,
+        string basePath,
+        ReportSplitMode splitMode,
+        CancellationToken ct)
+        => ReportSplitHelper.WritePartitionedAsync(
+            entries, basePath, splitMode,
+            PartitionBySite,
+            (part, path, c) => WriteAsync(part, path, c),
+            ct);
+
+    internal static IEnumerable<(string Label, IReadOnlyList<PermissionEntry> Partition)> PartitionBySite(
+        IReadOnlyList<PermissionEntry> entries)
     {
-        if (string.IsNullOrEmpty(value)) return "\"\"";
+        return entries
-        return $"\"{value.Replace("\"", "\"\"")}\"";
+            .GroupBy(e => ReportSplitHelper.DeriveSiteCollectionUrl(e.Url), StringComparer.OrdinalIgnoreCase)
+            .Select(g => (
+                Label: ReportSplitHelper.DeriveSiteLabel(g.Key),
+                Partition: (IReadOnlyList<PermissionEntry>)g.ToList()));
     }
+
+    internal static IEnumerable<(string Label, IReadOnlyList<SimplifiedPermissionEntry> Partition)> PartitionBySite(
+        IReadOnlyList<SimplifiedPermissionEntry> entries)
+    {
+        return entries
+            .GroupBy(e => ReportSplitHelper.DeriveSiteCollectionUrl(e.Url), StringComparer.OrdinalIgnoreCase)
+            .Select(g => (
+                Label: ReportSplitHelper.DeriveSiteLabel(g.Key),
+                Partition: (IReadOnlyList<SimplifiedPermissionEntry>)g.ToList()));
+    }
+
+    /// <summary>RFC 4180 CSV field escaping with formula-injection guard.</summary>
+    private static string Csv(string value) => CsvSanitizer.Escape(value);
 }

SharepointToolbox/Services/Export/CsvSanitizer.cs

@@ -0,0 +1,47 @@
+namespace SharepointToolbox.Services.Export;
+
+/// <summary>
+/// CSV field sanitization. Adds RFC 4180 quoting plus formula-injection
+/// protection: Excel and other spreadsheet apps treat cells starting with
+/// '=', '+', '-', '@', tab, or CR as formulas. Prefixing with a single
+/// quote neutralizes the formula while remaining readable.
+/// </summary>
+internal static class CsvSanitizer
+{
+    /// <summary>
+    /// Escapes a value for inclusion in a CSV row. Always wraps in double
+    /// quotes. Doubles internal quotes per RFC 4180. Prepends an apostrophe
+    /// when the value begins with a character a spreadsheet would evaluate.
+    /// </summary>
+    public static string Escape(string? value)
+    {
+        if (string.IsNullOrEmpty(value)) return "\"\"";
+        var safe = NeutralizeFormulaPrefix(value).Replace("\"", "\"\"");
+        return $"\"{safe}\"";
+    }
+
+    /// <summary>
+    /// Minimal quoting variant: only wraps in quotes when the value contains
+    /// a delimiter, quote, or newline. Still guards against formula injection.
+    /// </summary>
+    public static string EscapeMinimal(string? value)
+    {
+        if (string.IsNullOrEmpty(value)) return string.Empty;
+        var safe = NeutralizeFormulaPrefix(value);
+        if (safe.Contains(',') || safe.Contains('"') || safe.Contains('\n') || safe.Contains('\r'))
+            return $"\"{safe.Replace("\"", "\"\"")}\"";
+        return safe;
+    }
+
+    private static string NeutralizeFormulaPrefix(string value)
+    {
+        if (value.Length == 0) return value;
+        char first = value[0];
+        if (first == '=' || first == '+' || first == '-' || first == '@'
+            || first == '\t' || first == '\r')
+        {
+            return "'" + value;
+        }
+        return value;
+    }
+}

SharepointToolbox/Services/Export/DuplicatesCsvExportService.cs

@@ -0,0 +1,112 @@
+using System.IO;
+using System.Text;
+using SharepointToolbox.Core.Models;
+using SharepointToolbox.Localization;
+
+namespace SharepointToolbox.Services.Export;
+
+/// <summary>
+/// Exports DuplicateGroup list to CSV. Each duplicate item becomes one row;
+/// the Group column ties copies together and a Copies column gives the group size.
+/// Header row is built at write-time so culture switches are honoured.
+/// </summary>
+public class DuplicatesCsvExportService
+{
+    /// <summary>Writes the CSV to <paramref name="filePath"/> with UTF-8 BOM (Excel-compatible).</summary>
+    public async Task WriteAsync(
+        IReadOnlyList<DuplicateGroup> groups,
+        string filePath,
+        CancellationToken ct)
+    {
+        var csv = BuildCsv(groups);
+        await ExportFileWriter.WriteCsvAsync(filePath, csv, ct);
+    }
+
+    /// <summary>
+    /// Writes one or more CSVs depending on <paramref name="splitMode"/>.
+    /// Single → <paramref name="basePath"/> as-is. BySite → one file per site,
+    /// filenames derived from <paramref name="basePath"/> with a site suffix.
+    /// </summary>
+    public Task WriteAsync(
+        IReadOnlyList<DuplicateGroup> groups,
+        string basePath,
+        ReportSplitMode splitMode,
+        CancellationToken ct)
+        => ReportSplitHelper.WritePartitionedAsync(
+            groups, basePath, splitMode,
+            PartitionBySite,
+            (part, path, c) => WriteAsync(part, path, c),
+            ct);
+
+    internal static IEnumerable<(string Label, IReadOnlyList<DuplicateGroup> Partition)> PartitionBySite(
+        IReadOnlyList<DuplicateGroup> groups)
+    {
+        return groups
+            .GroupBy(g =>
+            {
+                var first = g.Items.FirstOrDefault();
+                return (Url: first?.SiteUrl ?? string.Empty, Title: first?.SiteTitle ?? string.Empty);
+            })
+            .Select(g => (
+                Label: ReportSplitHelper.DeriveSiteLabel(g.Key.Url, g.Key.Title),
+                Partition: (IReadOnlyList<DuplicateGroup>)g.ToList()));
+    }
+
+    /// <summary>
+    /// Builds the CSV payload. Emits a header summary (group count, generated
+    /// timestamp), then one row per duplicate item with its group index and
+    /// group size. CSV fields are escaped via <see cref="CsvSanitizer.Escape"/>.
+    /// </summary>
+    public string BuildCsv(IReadOnlyList<DuplicateGroup> groups)
+    {
+        var T = TranslationSource.Instance;
+        var sb = new StringBuilder();
+
+        // Summary
+        sb.AppendLine($"\"{T["report.title.duplicates_short"]}\"");
+        sb.AppendLine($"\"{T["report.text.duplicate_groups_found"]}\",\"{groups.Count}\"");
+        sb.AppendLine($"\"{T["report.text.generated"]}\",\"{DateTime.Now:yyyy-MM-dd HH:mm:ss}\"");
+        sb.AppendLine();
+
+        // Header
+        sb.AppendLine(string.Join(",", new[]
+        {
+            Csv(T["report.col.number"]),
+            Csv(T["report.col.group"]),
+            Csv(T["report.text.copies"]),
+            Csv(T["report.col.site"]),
+            Csv(T["report.col.name"]),
+            Csv(T["report.col.library"]),
+            Csv(T["report.col.path"]),
+            Csv(T["report.col.size_bytes"]),
+            Csv(T["report.col.created"]),
+            Csv(T["report.col.modified"]),
+        }));
+
+        foreach (var g in groups)
+        {
+            int i = 0;
+            foreach (var item in g.Items)
+            {
+                i++;
+                sb.AppendLine(string.Join(",", new[]
+                {
+                    Csv(i.ToString()),
+                    Csv(g.Name),
+                    Csv(g.Items.Count.ToString()),
+                    Csv(item.SiteTitle),
+                    Csv(item.Name),
+                    Csv(item.Library),
+                    Csv(item.Path),
+                    Csv(item.SizeBytes?.ToString() ?? string.Empty),
+                    Csv(item.Created?.ToString("yyyy-MM-dd") ?? string.Empty),
+                    Csv(item.Modified?.ToString("yyyy-MM-dd") ?? string.Empty),
+                }));
+            }
+        }
+
+        return sb.ToString();
+    }
+
+    private static string Csv(string value) => CsvSanitizer.Escape(value);
+}

SharepointToolbox/Services/Export/DuplicatesHtmlExportService.cs

@@ -1,4 +1,5 @@
 using SharepointToolbox.Core.Models;
+using SharepointToolbox.Localization;
 using System.Text;
 
 namespace SharepointToolbox.Services.Export;
@@ -10,17 +11,23 @@ namespace SharepointToolbox.Services.Export;
 /// </summary>
 public class DuplicatesHtmlExportService
 {
+    /// <summary>
+    /// Builds a self-contained HTML string rendering one collapsible card per
+    /// <see cref="DuplicateGroup"/>. The document ships with inline CSS and a
+    /// tiny JS toggle so no external assets are needed.
+    /// </summary>
     public string BuildHtml(IReadOnlyList<DuplicateGroup> groups, ReportBranding? branding = null)
     {
+        var T = TranslationSource.Instance;
         var sb = new StringBuilder();
 
+        sb.AppendLine("<!DOCTYPE html>");
+        sb.AppendLine("<html lang=\"en\">");
+        sb.AppendLine("<head>");
+        sb.AppendLine("<meta charset=\"UTF-8\">");
+        sb.AppendLine("<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">");
+        sb.AppendLine($"<title>{T["report.title.duplicates"]}</title>");
         sb.AppendLine("""
-            <!DOCTYPE html>
-            <html lang="en">
-            <head>
-            <meta charset="UTF-8">
-            <meta name="viewport" content="width=device-width, initial-scale=1.0">
-            <title>SharePoint Duplicate Detection Report</title>
             <style>
               body { font-family: 'Segoe UI', Arial, sans-serif; font-size: 13px; margin: 20px; background: #f5f5f5; }
               h1 { color: #0078d4; }
@@ -54,11 +61,9 @@ public class DuplicatesHtmlExportService
             <body>
             """);
         sb.Append(BrandingHtmlHelper.BuildBrandingHeader(branding));
-        sb.AppendLine("""
+        sb.AppendLine($"<h1>{T["report.title.duplicates_short"]}</h1>");
-            <h1>Duplicate Detection Report</h1>
-            """);
 
-        sb.AppendLine($"<p class=\"summary\">{groups.Count:N0} duplicate group(s) found.</p>");
+        sb.AppendLine($"<p class=\"summary\">{groups.Count:N0} {T["report.text.duplicate_groups_found"]}</p>");
 
         for (int i = 0; i < groups.Count; i++)
         {
@@ -70,19 +75,19 @@ public class DuplicatesHtmlExportService
                 <div class="group-card">
                   <div class="group-header" onclick="toggleGroup({i})">
                     <span class="group-name">{H(g.Name)}</span>
-                    <span class="badge {badgeClass}">{count} copies</span>
+                    <span class="badge {badgeClass}">{count} {T["report.text.copies"]}</span>
                   </div>
                   <div class="group-body" id="gb-{i}">
                     <table>
                       <thead>
                         <tr>
-                          <th>#</th>
+                          <th>{T["report.col.number"]}</th>
-                          <th>Name</th>
+                          <th>{T["report.col.name"]}</th>
-                          <th>Library</th>
+                          <th>{T["report.col.library"]}</th>
-                          <th>Path</th>
+                          <th>{T["report.col.path"]}</th>
-                          <th>Size</th>
+                          <th>{T["report.col.size"]}</th>
-                          <th>Created</th>
+                          <th>{T["report.col.created"]}</th>
-                          <th>Modified</th>
+                          <th>{T["report.col.modified"]}</th>
                         </tr>
                       </thead>
                       <tbody>
@@ -116,18 +121,59 @@ public class DuplicatesHtmlExportService
                 """);
         }
 
-        sb.AppendLine($"<p class=\"generated\">Generated: {DateTime.Now:yyyy-MM-dd HH:mm}</p>");
+        sb.AppendLine($"<p class=\"generated\">{T["report.text.generated_colon"]} {DateTime.Now:yyyy-MM-dd HH:mm}</p>");
         sb.AppendLine("</body></html>");
 
         return sb.ToString();
     }
 
+    /// <summary>Writes the HTML report to the specified file path using UTF-8.</summary>
     public async Task WriteAsync(IReadOnlyList<DuplicateGroup> groups, string filePath, CancellationToken ct, ReportBranding? branding = null)
     {
         var html = BuildHtml(groups, branding);
         await System.IO.File.WriteAllTextAsync(filePath, html, Encoding.UTF8, ct);
     }
 
+    /// <summary>
+    /// Writes one or more HTML reports depending on <paramref name="splitMode"/> and
+    /// <paramref name="layout"/>. Single → one file. BySite + SeparateFiles → one
+    /// file per site. BySite + SingleTabbed → one file with per-site iframe tabs.
+    /// </summary>
+    public async Task WriteAsync(
+        IReadOnlyList<DuplicateGroup> groups,
+        string basePath,
+        ReportSplitMode splitMode,
+        HtmlSplitLayout layout,
+        CancellationToken ct,
+        ReportBranding? branding = null)
+    {
+        if (splitMode != ReportSplitMode.BySite)
+        {
+            await WriteAsync(groups, basePath, ct, branding);
+            return;
+        }
+
+        var partitions = DuplicatesCsvExportService.PartitionBySite(groups).ToList();
+
+        if (layout == HtmlSplitLayout.SingleTabbed)
+        {
+            var parts = partitions
+                .Select(p => (p.Label, Html: BuildHtml(p.Partition, branding)))
+                .ToList();
+            var T = TranslationSource.Instance;
+            var tabbed = ReportSplitHelper.BuildTabbedHtml(parts, T["report.title.duplicates_short"]);
+            await System.IO.File.WriteAllTextAsync(basePath, tabbed, Encoding.UTF8, ct);
+            return;
+        }
+
+        foreach (var partition in partitions)
+        {
+            ct.ThrowIfCancellationRequested();
+            var path = ReportSplitHelper.BuildPartitionPath(basePath, partition.Label);
+            await WriteAsync(partition.Partition, path, ct, branding);
+        }
+    }
+
     private static string H(string value) =>
         System.Net.WebUtility.HtmlEncode(value ?? string.Empty);
 

SharepointToolbox/Services/Export/ExportFileWriter.cs

@@ -0,0 +1,64 @@
+using System.IO;
+using System.Text;
+
+namespace SharepointToolbox.Services.Export;
+
+/// <summary>
+/// Central file-write plumbing for export services so every CSV and HTML
+/// artefact gets a consistent encoding: CSV files are written with a UTF-8
+/// BOM (required for Excel to detect the encoding when opening a
+/// double-clicked .csv), HTML files are written without a BOM (some browsers
+/// and iframe <c>srcdoc</c> paths render the BOM as a visible character).
+/// Export services should call these helpers rather than constructing
+/// <see cref="UTF8Encoding"/> inline.
+/// </summary>
+internal static class ExportFileWriter
+{
+    private static readonly UTF8Encoding Utf8WithBom = new(encoderShouldEmitUTF8Identifier: true);
+    private static readonly UTF8Encoding Utf8NoBom   = new(encoderShouldEmitUTF8Identifier: false);
+
+    /// <summary>Writes <paramref name="csv"/> to <paramref name="filePath"/> as UTF-8 with BOM.</summary>
+    public static Task WriteCsvAsync(string filePath, string csv, CancellationToken ct)
+        => File.WriteAllTextAsync(filePath, csv, Utf8WithBom, ct);
+
+    /// <summary>Writes <paramref name="html"/> to <paramref name="filePath"/> as UTF-8 without BOM.</summary>
+    public static Task WriteHtmlAsync(string filePath, string html, CancellationToken ct)
+        => File.WriteAllTextAsync(filePath, html, Utf8NoBom, ct);
+
+    /// <summary>
+    /// Streams a <see cref="StringBuilder"/> directly to disk as UTF-8 with
+    /// BOM, chunk by chunk. Avoids the full-document <c>ToString()</c> copy
+    /// and the separate UTF-8 byte buffer that <see cref="File.WriteAllTextAsync(string, string, Encoding, CancellationToken)"/>
+    /// would otherwise allocate — meaningful for large CSV exports.
+    /// </summary>
+    public static Task WriteCsvChunksAsync(string filePath, StringBuilder builder, CancellationToken ct)
+        => WriteChunksAsync(filePath, builder, Utf8WithBom, ct);
+
+    /// <summary>
+    /// Streams a <see cref="StringBuilder"/> directly to disk as UTF-8 without
+    /// BOM. Same rationale as <see cref="WriteCsvChunksAsync"/> — for large
+    /// HTML reports it halves peak memory by skipping the intermediate string.
+    /// </summary>
+    public static Task WriteHtmlChunksAsync(string filePath, StringBuilder builder, CancellationToken ct)
+        => WriteChunksAsync(filePath, builder, Utf8NoBom, ct);
+
+    private static async Task WriteChunksAsync(string filePath, StringBuilder builder, Encoding encoding, CancellationToken ct)
+    {
+        // FileOptions.Asynchronous lets StreamWriter use true async I/O.
+        await using var fs = new FileStream(
+            filePath,
+            FileMode.Create,
+            FileAccess.Write,
+            FileShare.None,
+            bufferSize: 64 * 1024,
+            options: FileOptions.Asynchronous | FileOptions.SequentialScan);
+        await using var sw = new StreamWriter(fs, encoding, bufferSize: 64 * 1024);
+
+        foreach (var chunk in builder.GetChunks())
+        {
+            ct.ThrowIfCancellationRequested();
+            await sw.WriteAsync(chunk, ct);
+        }
+        await sw.FlushAsync(ct);
+    }
+}

SharepointToolbox/Services/Export/HtmlExportService.cs

@@ -1,102 +1,50 @@
 using System.IO;
 using System.Text;
 using SharepointToolbox.Core.Models;
+using SharepointToolbox.Localization;
+using static SharepointToolbox.Services.Export.PermissionHtmlFragments;
 
 namespace SharepointToolbox.Services.Export;
 
 /// <summary>
 /// Exports permission entries to a self-contained interactive HTML report.
-/// Ports PowerShell Export-PermissionsToHTML functionality.
+/// Ports PowerShell <c>Export-PermissionsToHTML</c> functionality.
-/// No external CSS/JS dependencies — everything is inline.
+/// No external CSS/JS dependencies — everything is inline so the file can be
+/// emailed or served from any static host. The standard and simplified
+/// variants share their document shell, stats cards, CSS, pill rendering, and
+/// inline script via <see cref="PermissionHtmlFragments"/>; this class only
+/// owns the table column sets and the simplified risk summary.
 /// </summary>
 public class HtmlExportService
 {
     /// <summary>
-    /// Builds a self-contained HTML string from the supplied permission entries.
+    /// Builds a self-contained HTML string from the supplied permission
-    /// Includes inline CSS, inline JS filter, stats cards, type badges, unique/inherited badges, and user pills.
+    /// entries. Standard report: columns are Object / Title / URL / Unique /
-    /// When <paramref name="groupMembers"/> is provided, SharePoint group pills become expandable.
+    /// Users / Permission / Granted Through. When
+    /// <paramref name="groupMembers"/> is provided, SharePoint group pills
+    /// become expandable rows listing resolved members.
     /// </summary>
-    public string BuildHtml(IReadOnlyList<PermissionEntry> entries, ReportBranding? branding = null,
+    public string BuildHtml(
+        IReadOnlyList<PermissionEntry> entries,
+        ReportBranding? branding = null,
         IReadOnlyDictionary<string, IReadOnlyList<ResolvedMember>>? groupMembers = null)
     {
-        // Compute stats
+        var T = TranslationSource.Instance;
-        var totalEntries      = entries.Count;
+        var (totalEntries, uniquePermSets, distinctUsers) = ComputeStats(
-        var uniquePermSets    = entries.Select(e => e.PermissionLevels).Distinct().Count();
+            entries.Count,
-        var distinctUsers     = entries
+            entries.Select(e => e.PermissionLevels),
-            .SelectMany(e => e.UserLogins.Split(';', StringSplitOptions.RemoveEmptyEntries))
+            entries.SelectMany(e => e.UserLogins.Split(';', StringSplitOptions.RemoveEmptyEntries)));
-            .Select(u => u.Trim())
-            .Where(u => u.Length > 0)
-            .Distinct()
-            .Count();
 
         var sb = new StringBuilder();
-
+        AppendHead(sb, T["report.title.permissions"], includeRiskCss: false);
-        // ── HTML HEAD ──────────────────────────────────────────────────────────
-        sb.AppendLine("<!DOCTYPE html>");
-        sb.AppendLine("<html lang=\"en\">");
-        sb.AppendLine("<head>");
-        sb.AppendLine("<meta charset=\"UTF-8\">");
-        sb.AppendLine("<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">");
-        sb.AppendLine("<title>SharePoint Permissions Report</title>");
-        sb.AppendLine("<style>");
-        sb.AppendLine(@"
-* { box-sizing: border-box; margin: 0; padding: 0; }
-body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: #f5f5f5; color: #333; }
-h1 { padding: 20px 24px 10px; font-size: 1.5rem; color: #1a1a2e; }
-.stats { display: flex; gap: 16px; padding: 0 24px 16px; flex-wrap: wrap; }
-.stat-card { background: #fff; border-radius: 8px; padding: 14px 20px; min-width: 160px; box-shadow: 0 1px 4px rgba(0,0,0,.1); }
-.stat-card .value { font-size: 2rem; font-weight: 700; color: #1a1a2e; }
-.stat-card .label { font-size: .8rem; color: #666; margin-top: 2px; }
-.filter-wrap { padding: 0 24px 12px; }
-#filter { width: 320px; padding: 8px 12px; border: 1px solid #ccc; border-radius: 6px; font-size: .95rem; }
-.table-wrap { overflow-x: auto; padding: 0 24px 32px; }
-table { width: 100%; border-collapse: collapse; background: #fff; border-radius: 8px; overflow: hidden; box-shadow: 0 1px 4px rgba(0,0,0,.1); }
-th { background: #1a1a2e; color: #fff; padding: 10px 14px; text-align: left; font-size: .85rem; white-space: nowrap; }
-td { padding: 9px 14px; border-bottom: 1px solid #eee; vertical-align: top; font-size: .875rem; }
-tr:last-child td { border-bottom: none; }
-tr:hover td { background: #fafafa; }
-/* Type badges */
-.badge { display: inline-block; padding: 2px 8px; border-radius: 4px; font-size: .75rem; font-weight: 600; white-space: nowrap; }
-.badge.site-coll { background: #dbeafe; color: #1e40af; }
-.badge.site      { background: #dcfce7; color: #166534; }
-.badge.list      { background: #fef9c3; color: #854d0e; }
-.badge.folder    { background: #f3f4f6; color: #374151; }
-/* Unique/Inherited badges */
-.badge.unique    { background: #dcfce7; color: #166534; }
-.badge.inherited { background: #f3f4f6; color: #374151; }
-/* User pills */
-.user-pill { display: inline-block; background: #e0e7ff; color: #3730a3; border-radius: 12px; padding: 2px 10px; font-size: .75rem; margin: 2px 3px 2px 0; white-space: nowrap; }
-.user-pill.external-user { background: #fff7ed; color: #9a3412; border: 1px solid #fed7aa; }
-.group-expandable { cursor: pointer; }
-.group-expandable:hover { opacity: 0.8; }
-a { color: #2563eb; text-decoration: none; }
-a:hover { text-decoration: underline; }
-");
-        sb.AppendLine("</style>");
-        sb.AppendLine("</head>");
-
-        // ── BODY ───────────────────────────────────────────────────────────────
         sb.AppendLine("<body>");
         sb.Append(BrandingHtmlHelper.BuildBrandingHeader(branding));
-        sb.AppendLine("<h1>SharePoint Permissions Report</h1>");
+        sb.AppendLine($"<h1>{T["report.title.permissions"]}</h1>");
-
+        AppendStatsCards(sb, totalEntries, uniquePermSets, distinctUsers);
-        // Stats cards
+        AppendFilterInput(sb);
-        sb.AppendLine("<div class=\"stats\">");
+        AppendTableOpen(sb);
-        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{totalEntries}</div><div class=\"label\">Total Entries</div></div>");
-        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{uniquePermSets}</div><div class=\"label\">Unique Permission Sets</div></div>");
-        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{distinctUsers}</div><div class=\"label\">Distinct Users/Groups</div></div>");
-        sb.AppendLine("</div>");
-
-        // Filter input
-        sb.AppendLine("<div class=\"filter-wrap\">");
-        sb.AppendLine("  <input type=\"text\" id=\"filter\" placeholder=\"Filter permissions...\" onkeyup=\"filterTable()\" />");
-        sb.AppendLine("</div>");
-
-        // Table
-        sb.AppendLine("<div class=\"table-wrap\">");
-        sb.AppendLine("<table id=\"permTable\">");
         sb.AppendLine("<thead><tr>");
-        sb.AppendLine("  <th>Object</th><th>Title</th><th>URL</th><th>Unique</th><th>Users/Groups</th><th>Permission Level</th><th>Granted Through</th>");
+        sb.AppendLine($"  <th>{T["report.col.object"]}</th><th>{T["report.col.title"]}</th><th>{T["report.col.url"]}</th><th>{T["report.badge.unique"]}</th><th>{T["report.col.users_groups"]}</th><th>{T["report.col.permission_level"]}</th><th>{T["report.col.granted_through"]}</th>");
         sb.AppendLine("</tr></thead>");
         sb.AppendLine("<tbody>");
 
@@ -105,99 +53,236 @@ a:hover { text-decoration: underline; }
         {
             var typeCss   = ObjectTypeCss(entry.ObjectType);
             var uniqueCss = entry.HasUniquePermissions ? "badge unique" : "badge inherited";
-            var uniqueLbl = entry.HasUniquePermissions ? "Unique" : "Inherited";
+            var uniqueLbl = entry.HasUniquePermissions ? T["report.badge.unique"] : T["report.badge.inherited"];
 
-            // Build user pills: zip UserLogins and Users (both semicolon-delimited)
+            var (pills, subRows) = BuildUserPillsCell(
-            var logins = entry.UserLogins.Split(';', StringSplitOptions.RemoveEmptyEntries);
+                entry.UserLogins, entry.Users, entry.PrincipalType, groupMembers,
-            var names  = entry.Users.Split(';', StringSplitOptions.RemoveEmptyEntries);
+                colSpan: 7, grpMemIdx: ref grpMemIdx);
-            var pillsBuilder = new StringBuilder();
-            var memberSubRows = new StringBuilder();
-
-            for (int i = 0; i < logins.Length; i++)
-            {
-                var login = logins[i].Trim();
-                var name  = i < names.Length ? names[i].Trim() : login;
-                var isExt = login.Contains("#EXT#", StringComparison.OrdinalIgnoreCase);
-
-                bool isExpandableGroup = entry.PrincipalType == "SharePointGroup"
-                    && groupMembers != null
-                    && groupMembers.TryGetValue(name, out var members);
-
-                if (isExpandableGroup && groupMembers != null && groupMembers.TryGetValue(name, out var resolvedMembers))
-                {
-                    var grpId = $"grpmem{grpMemIdx}";
-                    pillsBuilder.Append($"<span class=\"user-pill group-expandable\" onclick=\"toggleGroup('{grpId}')\" data-email=\"{HtmlEncode(login)}\">{HtmlEncode(name)} &#9660;</span>");
-
-                    string memberContent;
-                    if (resolvedMembers.Count > 0)
-                    {
-                        var memberParts = resolvedMembers.Select(m => $"{HtmlEncode(m.DisplayName)} &lt;{HtmlEncode(m.Login)}&gt;");
-                        memberContent = string.Join(" &bull; ", memberParts);
-                    }
-                    else
-                    {
-                        memberContent = "<em style=\"color:#888\">members unavailable</em>";
-                    }
-                    memberSubRows.AppendLine($"<tr data-group=\"{grpId}\" style=\"display:none\"><td colspan=\"7\" style=\"padding-left:2em;font-size:.8rem;color:#555\">{memberContent}</td></tr>");
-                    grpMemIdx++;
-                }
-                else
-                {
-                    var pillCss = isExt ? "user-pill external-user" : "user-pill";
-                    pillsBuilder.Append($"<span class=\"{pillCss}\" data-email=\"{HtmlEncode(login)}\">{HtmlEncode(name)}</span>");
-                }
-            }
 
             sb.AppendLine("<tr>");
             sb.AppendLine($"  <td><span class=\"{typeCss}\">{HtmlEncode(entry.ObjectType)}</span></td>");
             sb.AppendLine($"  <td>{HtmlEncode(entry.Title)}</td>");
-            sb.AppendLine($"  <td><a href=\"{HtmlEncode(entry.Url)}\" target=\"_blank\">Link</a></td>");
+            sb.AppendLine($"  <td><a href=\"{HtmlEncode(entry.Url)}\" target=\"_blank\">{T["report.text.link"]}</a></td>");
             sb.AppendLine($"  <td><span class=\"{uniqueCss}\">{uniqueLbl}</span></td>");
-            sb.AppendLine($"  <td>{pillsBuilder}</td>");
+            sb.AppendLine($"  <td>{pills}</td>");
             sb.AppendLine($"  <td>{HtmlEncode(entry.PermissionLevels)}</td>");
             sb.AppendLine($"  <td>{HtmlEncode(entry.GrantedThrough)}</td>");
             sb.AppendLine("</tr>");
-            if (memberSubRows.Length > 0)
+            if (subRows.Length > 0) sb.Append(subRows);
-                sb.Append(memberSubRows);
         }
 
-        sb.AppendLine("</tbody>");
+        AppendTableClose(sb);
-        sb.AppendLine("</table>");
+        AppendInlineJs(sb);
-        sb.AppendLine("</div>");
-
-        // Inline JS
-        sb.AppendLine("<script>");
-        sb.AppendLine(@"function filterTable() {
-  var input = document.getElementById('filter').value.toLowerCase();
-  var rows = document.querySelectorAll('#permTable tbody tr');
-  rows.forEach(function(row) {
-    if (row.hasAttribute('data-group')) return;
-    row.style.display = row.textContent.toLowerCase().indexOf(input) > -1 ? '' : 'none';
-  });
-}
-function toggleGroup(id) {
-  var rows = document.querySelectorAll('tr[data-group=""' + id + '""]');
-  rows.forEach(function(r) { r.style.display = r.style.display === 'none' ? '' : 'none'; });
-}");
-        sb.AppendLine("</script>");
         sb.AppendLine("</body>");
         sb.AppendLine("</html>");
-
         return sb.ToString();
     }
 
     /// <summary>
-    /// Writes the HTML report to the specified file path using UTF-8 without BOM.
+    /// Builds a self-contained HTML string from simplified permission entries.
+    /// Adds a risk-level summary card strip plus two columns (Simplified,
+    /// Risk) relative to <see cref="BuildHtml(IReadOnlyList{PermissionEntry}, ReportBranding?, IReadOnlyDictionary{string, IReadOnlyList{ResolvedMember}}?)"/>.
+    /// Color-coded risk badges use <see cref="RiskLevelColors(RiskLevel)"/>.
     /// </summary>
-    public async Task WriteAsync(IReadOnlyList<PermissionEntry> entries, string filePath, CancellationToken ct,
+    public string BuildHtml(
+        IReadOnlyList<SimplifiedPermissionEntry> entries,
+        ReportBranding? branding = null,
+        IReadOnlyDictionary<string, IReadOnlyList<ResolvedMember>>? groupMembers = null)
+    {
+        var T = TranslationSource.Instance;
+        var summaries = PermissionSummaryBuilder.Build(entries);
+        var (totalEntries, uniquePermSets, distinctUsers) = ComputeStats(
+            entries.Count,
+            entries.Select(e => e.PermissionLevels),
+            entries.SelectMany(e => e.UserLogins.Split(';', StringSplitOptions.RemoveEmptyEntries)));
+
+        var sb = new StringBuilder();
+        AppendHead(sb, T["report.title.permissions_simplified"], includeRiskCss: true);
+        sb.AppendLine("<body>");
+        sb.Append(BrandingHtmlHelper.BuildBrandingHeader(branding));
+        sb.AppendLine($"<h1>{T["report.title.permissions_simplified"]}</h1>");
+        AppendStatsCards(sb, totalEntries, uniquePermSets, distinctUsers);
+
+        sb.AppendLine("<div class=\"risk-cards\">");
+        foreach (var s in summaries)
+        {
+            var (bg, text, border) = RiskLevelColors(s.RiskLevel);
+            sb.AppendLine($"  <div class=\"risk-card\" style=\"background:{bg};color:{text};border-color:{border}\">");
+            sb.AppendLine($"    <div class=\"count\">{s.Count}</div>");
+            sb.AppendLine($"    <div class=\"rlabel\">{HtmlEncode(s.Label)}</div>");
+            sb.AppendLine($"    <div class=\"users\">{s.DistinctUsers} {T["report.text.users_parens"]}</div>");
+            sb.AppendLine("  </div>");
+        }
+        sb.AppendLine("</div>");
+
+        AppendFilterInput(sb);
+        AppendTableOpen(sb);
+        sb.AppendLine("<thead><tr>");
+        sb.AppendLine($"  <th>{T["report.col.object"]}</th><th>{T["report.col.title"]}</th><th>{T["report.col.url"]}</th><th>{T["report.badge.unique"]}</th><th>{T["report.col.users_groups"]}</th><th>{T["report.col.permission_level"]}</th><th>{T["report.col.simplified"]}</th><th>{T["report.col.risk"]}</th><th>{T["report.col.granted_through"]}</th>");
+        sb.AppendLine("</tr></thead>");
+        sb.AppendLine("<tbody>");
+
+        int grpMemIdx = 0;
+        foreach (var entry in entries)
+        {
+            var typeCss   = ObjectTypeCss(entry.ObjectType);
+            var uniqueCss = entry.HasUniquePermissions ? "badge unique" : "badge inherited";
+            var uniqueLbl = entry.HasUniquePermissions ? T["report.badge.unique"] : T["report.badge.inherited"];
+            var (riskBg, riskText, riskBorder) = RiskLevelColors(entry.RiskLevel);
+
+            var (pills, subRows) = BuildUserPillsCell(
+                entry.UserLogins, entry.Inner.Users, entry.Inner.PrincipalType, groupMembers,
+                colSpan: 9, grpMemIdx: ref grpMemIdx);
+
+            sb.AppendLine("<tr>");
+            sb.AppendLine($"  <td><span class=\"{typeCss}\">{HtmlEncode(entry.ObjectType)}</span></td>");
+            sb.AppendLine($"  <td>{HtmlEncode(entry.Title)}</td>");
+            sb.AppendLine($"  <td><a href=\"{HtmlEncode(entry.Url)}\" target=\"_blank\">{T["report.text.link"]}</a></td>");
+            sb.AppendLine($"  <td><span class=\"{uniqueCss}\">{uniqueLbl}</span></td>");
+            sb.AppendLine($"  <td>{pills}</td>");
+            sb.AppendLine($"  <td>{HtmlEncode(entry.PermissionLevels)}</td>");
+            sb.AppendLine($"  <td>{HtmlEncode(entry.SimplifiedLabels)}</td>");
+            sb.AppendLine($"  <td><span class=\"risk-badge\" style=\"background:{riskBg};color:{riskText};border-color:{riskBorder}\">{HtmlEncode(entry.RiskLevel.ToString())}</span></td>");
+            sb.AppendLine($"  <td>{HtmlEncode(entry.GrantedThrough)}</td>");
+            sb.AppendLine("</tr>");
+            if (subRows.Length > 0) sb.Append(subRows);
+        }
+
+        AppendTableClose(sb);
+        AppendInlineJs(sb);
+        sb.AppendLine("</body>");
+        sb.AppendLine("</html>");
+        return sb.ToString();
+    }
+
+    /// <summary>Writes the HTML report to the specified file path using UTF-8 without BOM.</summary>
+    public async Task WriteAsync(
+        IReadOnlyList<PermissionEntry> entries,
+        string filePath,
+        CancellationToken ct,
         ReportBranding? branding = null,
         IReadOnlyDictionary<string, IReadOnlyList<ResolvedMember>>? groupMembers = null)
     {
         var html = BuildHtml(entries, branding, groupMembers);
-        await File.WriteAllTextAsync(filePath, html, new UTF8Encoding(encoderShouldEmitUTF8Identifier: false), ct);
+        await ExportFileWriter.WriteHtmlAsync(filePath, html, ct);
     }
 
-    /// <summary>Returns inline CSS background and text color for a risk level.</summary>
+    /// <summary>Writes the simplified HTML report to the specified file path using UTF-8 without BOM.</summary>
+    public async Task WriteAsync(
+        IReadOnlyList<SimplifiedPermissionEntry> entries,
+        string filePath,
+        CancellationToken ct,
+        ReportBranding? branding = null,
+        IReadOnlyDictionary<string, IReadOnlyList<ResolvedMember>>? groupMembers = null)
+    {
+        var html = BuildHtml(entries, branding, groupMembers);
+        await ExportFileWriter.WriteHtmlAsync(filePath, html, ct);
+    }
+
+    /// <summary>
+    /// Split-aware write for permission entries.
+    /// Single → one file. BySite + SeparateFiles → one file per site.
+    /// BySite + SingleTabbed → one file with per-site iframe tabs.
+    /// </summary>
+    public async Task WriteAsync(
+        IReadOnlyList<PermissionEntry> entries,
+        string basePath,
+        ReportSplitMode splitMode,
+        HtmlSplitLayout layout,
+        CancellationToken ct,
+        ReportBranding? branding = null,
+        IReadOnlyDictionary<string, IReadOnlyList<ResolvedMember>>? groupMembers = null)
+    {
+        if (splitMode != ReportSplitMode.BySite)
+        {
+            await WriteAsync(entries, basePath, ct, branding, groupMembers);
+            return;
+        }
+
+        var partitions = CsvExportService.PartitionBySite(entries).ToList();
+        if (layout == HtmlSplitLayout.SingleTabbed)
+        {
+            var parts = partitions
+                .Select(p => (p.Label, Html: BuildHtml(p.Partition, branding, groupMembers)))
+                .ToList();
+            var title = TranslationSource.Instance["report.title.permissions"];
+            var tabbed = ReportSplitHelper.BuildTabbedHtml(parts, title);
+            await ExportFileWriter.WriteHtmlAsync(basePath, tabbed, ct);
+            return;
+        }
+
+        foreach (var (label, partEntries) in partitions)
+        {
+            ct.ThrowIfCancellationRequested();
+            var path = ReportSplitHelper.BuildPartitionPath(basePath, label);
+            await WriteAsync(partEntries, path, ct, branding, groupMembers);
+        }
+    }
+
+    /// <summary>Simplified-entry split variant of <see cref="WriteAsync(IReadOnlyList{PermissionEntry}, string, ReportSplitMode, HtmlSplitLayout, CancellationToken, ReportBranding?, IReadOnlyDictionary{string, IReadOnlyList{ResolvedMember}}?)"/>.</summary>
+    public async Task WriteAsync(
+        IReadOnlyList<SimplifiedPermissionEntry> entries,
+        string basePath,
+        ReportSplitMode splitMode,
+        HtmlSplitLayout layout,
+        CancellationToken ct,
+        ReportBranding? branding = null,
+        IReadOnlyDictionary<string, IReadOnlyList<ResolvedMember>>? groupMembers = null)
+    {
+        if (splitMode != ReportSplitMode.BySite)
+        {
+            await WriteAsync(entries, basePath, ct, branding, groupMembers);
+            return;
+        }
+
+        var partitions = CsvExportService.PartitionBySite(entries).ToList();
+        if (layout == HtmlSplitLayout.SingleTabbed)
+        {
+            var parts = partitions
+                .Select(p => (p.Label, Html: BuildHtml(p.Partition, branding, groupMembers)))
+                .ToList();
+            var title = TranslationSource.Instance["report.title.permissions_simplified"];
+            var tabbed = ReportSplitHelper.BuildTabbedHtml(parts, title);
+            await ExportFileWriter.WriteHtmlAsync(basePath, tabbed, ct);
+            return;
+        }
+
+        foreach (var (label, partEntries) in partitions)
+        {
+            ct.ThrowIfCancellationRequested();
+            var path = ReportSplitHelper.BuildPartitionPath(basePath, label);
+            await WriteAsync(partEntries, path, ct, branding, groupMembers);
+        }
+    }
+
+    private static (int total, int uniquePerms, int distinctUsers) ComputeStats(
+        int totalEntries,
+        IEnumerable<string> permissionLevels,
+        IEnumerable<string> userLogins)
+    {
+        var uniquePermSets = permissionLevels.Distinct().Count();
+        var distinctUsers = userLogins
+            .Select(u => u.Trim())
+            .Where(u => u.Length > 0)
+            .Distinct()
+            .Count();
+        return (totalEntries, uniquePermSets, distinctUsers);
+    }
+
+    private static void AppendTableOpen(StringBuilder sb)
+    {
+        sb.AppendLine("<div class=\"table-wrap\">");
+        sb.AppendLine("<table id=\"permTable\">");
+    }
+
+    private static void AppendTableClose(StringBuilder sb)
+    {
+        sb.AppendLine("</tbody>");
+        sb.AppendLine("</table>");
+        sb.AppendLine("</div>");
+    }
+
+    /// <summary>Returns inline CSS background, text, and border colors for a risk level.</summary>
     private static (string bg, string text, string border) RiskLevelColors(RiskLevel level) => level switch
     {
         RiskLevel.High     => ("#FEE2E2", "#991B1B", "#FECACA"),
@@ -206,228 +291,4 @@ function toggleGroup(id) {
         RiskLevel.ReadOnly => ("#DBEAFE", "#1E40AF", "#BFDBFE"),
         _                  => ("#F3F4F6", "#374151", "#E5E7EB")
     };
-
-    /// <summary>
-    /// Builds a self-contained HTML string from simplified permission entries.
-    /// Includes risk-level summary cards, color-coded rows, and simplified labels column.
-    /// When <paramref name="groupMembers"/> is provided, SharePoint group pills become expandable.
-    /// </summary>
-    public string BuildHtml(IReadOnlyList<SimplifiedPermissionEntry> entries, ReportBranding? branding = null,
-        IReadOnlyDictionary<string, IReadOnlyList<ResolvedMember>>? groupMembers = null)
-    {
-        var summaries = PermissionSummaryBuilder.Build(entries);
-
-        var totalEntries   = entries.Count;
-        var uniquePermSets = entries.Select(e => e.PermissionLevels).Distinct().Count();
-        var distinctUsers  = entries
-            .SelectMany(e => e.UserLogins.Split(';', StringSplitOptions.RemoveEmptyEntries))
-            .Select(u => u.Trim())
-            .Where(u => u.Length > 0)
-            .Distinct()
-            .Count();
-
-        var sb = new StringBuilder();
-
-        sb.AppendLine("<!DOCTYPE html>");
-        sb.AppendLine("<html lang=\"en\">");
-        sb.AppendLine("<head>");
-        sb.AppendLine("<meta charset=\"UTF-8\">");
-        sb.AppendLine("<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">");
-        sb.AppendLine("<title>SharePoint Permissions Report (Simplified)</title>");
-        sb.AppendLine("<style>");
-        sb.AppendLine(@"
-    * { box-sizing: border-box; margin: 0; padding: 0; }
-    body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: #f5f5f5; color: #333; }
-    h1 { padding: 20px 24px 10px; font-size: 1.5rem; color: #1a1a2e; }
-    .stats { display: flex; gap: 16px; padding: 0 24px 16px; flex-wrap: wrap; }
-    .stat-card { background: #fff; border-radius: 8px; padding: 14px 20px; min-width: 160px; box-shadow: 0 1px 4px rgba(0,0,0,.1); }
-    .stat-card .value { font-size: 2rem; font-weight: 700; color: #1a1a2e; }
-    .stat-card .label { font-size: .8rem; color: #666; margin-top: 2px; }
-    .risk-cards { display: flex; gap: 12px; padding: 0 24px 16px; flex-wrap: wrap; }
-    .risk-card { border-radius: 8px; padding: 12px 18px; min-width: 140px; border: 1px solid; }
-    .risk-card .count { font-size: 1.5rem; font-weight: 700; }
-    .risk-card .rlabel { font-size: .8rem; margin-top: 2px; }
-    .risk-card .users { font-size: .7rem; margin-top: 2px; opacity: 0.8; }
-    .filter-wrap { padding: 0 24px 12px; }
-    #filter { width: 320px; padding: 8px 12px; border: 1px solid #ccc; border-radius: 6px; font-size: .95rem; }
-    .table-wrap { overflow-x: auto; padding: 0 24px 32px; }
-    table { width: 100%; border-collapse: collapse; background: #fff; border-radius: 8px; overflow: hidden; box-shadow: 0 1px 4px rgba(0,0,0,.1); }
-    th { background: #1a1a2e; color: #fff; padding: 10px 14px; text-align: left; font-size: .85rem; white-space: nowrap; }
-    td { padding: 9px 14px; border-bottom: 1px solid #eee; vertical-align: top; font-size: .875rem; }
-    tr:last-child td { border-bottom: none; }
-    tr:hover td { background: rgba(0,0,0,.03); }
-    .badge { display: inline-block; padding: 2px 8px; border-radius: 4px; font-size: .75rem; font-weight: 600; white-space: nowrap; }
-    .badge.site-coll { background: #dbeafe; color: #1e40af; }
-    .badge.site      { background: #dcfce7; color: #166534; }
-    .badge.list      { background: #fef9c3; color: #854d0e; }
-    .badge.folder    { background: #f3f4f6; color: #374151; }
-    .badge.unique    { background: #dcfce7; color: #166534; }
-    .badge.inherited { background: #f3f4f6; color: #374151; }
-    .risk-badge { display: inline-block; padding: 2px 8px; border-radius: 4px; font-size: .75rem; font-weight: 600; border: 1px solid; }
-    .user-pill { display: inline-block; background: #e0e7ff; color: #3730a3; border-radius: 12px; padding: 2px 10px; font-size: .75rem; margin: 2px 3px 2px 0; white-space: nowrap; }
-    .user-pill.external-user { background: #fff7ed; color: #9a3412; border: 1px solid #fed7aa; }
-    .group-expandable { cursor: pointer; }
-    .group-expandable:hover { opacity: 0.8; }
-    a { color: #2563eb; text-decoration: none; }
-    a:hover { text-decoration: underline; }
-    ");
-        sb.AppendLine("</style>");
-        sb.AppendLine("</head>");
-
-        sb.AppendLine("<body>");
-        sb.Append(BrandingHtmlHelper.BuildBrandingHeader(branding));
-        sb.AppendLine("<h1>SharePoint Permissions Report (Simplified)</h1>");
-
-        // Stats cards
-        sb.AppendLine("<div class=\"stats\">");
-        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{totalEntries}</div><div class=\"label\">Total Entries</div></div>");
-        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{uniquePermSets}</div><div class=\"label\">Unique Permission Sets</div></div>");
-        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{distinctUsers}</div><div class=\"label\">Distinct Users/Groups</div></div>");
-        sb.AppendLine("</div>");
-
-        // Risk-level summary cards
-        sb.AppendLine("<div class=\"risk-cards\">");
-        foreach (var summary in summaries)
-        {
-            var (bg, text, border) = RiskLevelColors(summary.RiskLevel);
-            sb.AppendLine($"  <div class=\"risk-card\" style=\"background:{bg};color:{text};border-color:{border}\">");
-            sb.AppendLine($"    <div class=\"count\">{summary.Count}</div>");
-            sb.AppendLine($"    <div class=\"rlabel\">{HtmlEncode(summary.Label)}</div>");
-            sb.AppendLine($"    <div class=\"users\">{summary.DistinctUsers} user(s)</div>");
-            sb.AppendLine("  </div>");
-        }
-        sb.AppendLine("</div>");
-
-        // Filter input
-        sb.AppendLine("<div class=\"filter-wrap\">");
-        sb.AppendLine("  <input type=\"text\" id=\"filter\" placeholder=\"Filter permissions...\" onkeyup=\"filterTable()\" />");
-        sb.AppendLine("</div>");
-
-        // Table with simplified columns
-        sb.AppendLine("<div class=\"table-wrap\">");
-        sb.AppendLine("<table id=\"permTable\">");
-        sb.AppendLine("<thead><tr>");
-        sb.AppendLine("  <th>Object</th><th>Title</th><th>URL</th><th>Unique</th><th>Users/Groups</th><th>Permission Level</th><th>Simplified</th><th>Risk</th><th>Granted Through</th>");
-        sb.AppendLine("</tr></thead>");
-        sb.AppendLine("<tbody>");
-
-        int grpMemIdx = 0;
-        foreach (var entry in entries)
-        {
-            var typeCss   = ObjectTypeCss(entry.ObjectType);
-            var uniqueCss = entry.HasUniquePermissions ? "badge unique" : "badge inherited";
-            var uniqueLbl = entry.HasUniquePermissions ? "Unique" : "Inherited";
-            var (riskBg, riskText, riskBorder) = RiskLevelColors(entry.RiskLevel);
-
-            var logins = entry.UserLogins.Split(';', StringSplitOptions.RemoveEmptyEntries);
-            var names  = entry.Inner.Users.Split(';', StringSplitOptions.RemoveEmptyEntries);
-            var pillsBuilder = new StringBuilder();
-            var memberSubRows = new StringBuilder();
-
-            for (int i = 0; i < logins.Length; i++)
-            {
-                var login = logins[i].Trim();
-                var name  = i < names.Length ? names[i].Trim() : login;
-                var isExt = login.Contains("#EXT#", StringComparison.OrdinalIgnoreCase);
-
-                bool isExpandableGroup = entry.Inner.PrincipalType == "SharePointGroup"
-                    && groupMembers != null
-                    && groupMembers.TryGetValue(name, out _);
-
-                if (isExpandableGroup && groupMembers != null && groupMembers.TryGetValue(name, out var resolvedMembers))
-                {
-                    var grpId = $"grpmem{grpMemIdx}";
-                    pillsBuilder.Append($"<span class=\"user-pill group-expandable\" onclick=\"toggleGroup('{grpId}')\" data-email=\"{HtmlEncode(login)}\">{HtmlEncode(name)} &#9660;</span>");
-
-                    string memberContent;
-                    if (resolvedMembers.Count > 0)
-                    {
-                        var memberParts = resolvedMembers.Select(m => $"{HtmlEncode(m.DisplayName)} &lt;{HtmlEncode(m.Login)}&gt;");
-                        memberContent = string.Join(" &bull; ", memberParts);
-                    }
-                    else
-                    {
-                        memberContent = "<em style=\"color:#888\">members unavailable</em>";
-                    }
-                    memberSubRows.AppendLine($"<tr data-group=\"{grpId}\" style=\"display:none\"><td colspan=\"9\" style=\"padding-left:2em;font-size:.8rem;color:#555\">{memberContent}</td></tr>");
-                    grpMemIdx++;
-                }
-                else
-                {
-                    var pillCss = isExt ? "user-pill external-user" : "user-pill";
-                    pillsBuilder.Append($"<span class=\"{pillCss}\" data-email=\"{HtmlEncode(login)}\">{HtmlEncode(name)}</span>");
-                }
-            }
-
-            sb.AppendLine("<tr>");
-            sb.AppendLine($"  <td><span class=\"{typeCss}\">{HtmlEncode(entry.ObjectType)}</span></td>");
-            sb.AppendLine($"  <td>{HtmlEncode(entry.Title)}</td>");
-            sb.AppendLine($"  <td><a href=\"{HtmlEncode(entry.Url)}\" target=\"_blank\">Link</a></td>");
-            sb.AppendLine($"  <td><span class=\"{uniqueCss}\">{uniqueLbl}</span></td>");
-            sb.AppendLine($"  <td>{pillsBuilder}</td>");
-            sb.AppendLine($"  <td>{HtmlEncode(entry.PermissionLevels)}</td>");
-            sb.AppendLine($"  <td>{HtmlEncode(entry.SimplifiedLabels)}</td>");
-            sb.AppendLine($"  <td><span class=\"risk-badge\" style=\"background:{riskBg};color:{riskText};border-color:{riskBorder}\">{HtmlEncode(entry.RiskLevel.ToString())}</span></td>");
-            sb.AppendLine($"  <td>{HtmlEncode(entry.GrantedThrough)}</td>");
-            sb.AppendLine("</tr>");
-            if (memberSubRows.Length > 0)
-                sb.Append(memberSubRows);
-        }
-
-        sb.AppendLine("</tbody>");
-        sb.AppendLine("</table>");
-        sb.AppendLine("</div>");
-
-        sb.AppendLine("<script>");
-        sb.AppendLine(@"function filterTable() {
-      var input = document.getElementById('filter').value.toLowerCase();
-      var rows = document.querySelectorAll('#permTable tbody tr');
-      rows.forEach(function(row) {
-        if (row.hasAttribute('data-group')) return;
-        row.style.display = row.textContent.toLowerCase().indexOf(input) > -1 ? '' : 'none';
-      });
-    }
-    function toggleGroup(id) {
-      var rows = document.querySelectorAll('tr[data-group=""' + id + '""]');
-      rows.forEach(function(r) { r.style.display = r.style.display === 'none' ? '' : 'none'; });
-    }");
-        sb.AppendLine("</script>");
-        sb.AppendLine("</body>");
-        sb.AppendLine("</html>");
-
-        return sb.ToString();
-    }
-
-    /// <summary>
-    /// Writes the simplified HTML report to the specified file path.
-    /// </summary>
-    public async Task WriteAsync(IReadOnlyList<SimplifiedPermissionEntry> entries, string filePath, CancellationToken ct,
-        ReportBranding? branding = null,
-        IReadOnlyDictionary<string, IReadOnlyList<ResolvedMember>>? groupMembers = null)
-    {
-        var html = BuildHtml(entries, branding, groupMembers);
-        await File.WriteAllTextAsync(filePath, html, new UTF8Encoding(encoderShouldEmitUTF8Identifier: false), ct);
-    }
-
-    /// <summary>Returns the CSS class for the object-type badge.</summary>
-    private static string ObjectTypeCss(string t) => t switch
-    {
-        "Site Collection" => "badge site-coll",
-        "Site"            => "badge site",
-        "List"            => "badge list",
-        "Folder"          => "badge folder",
-        _                 => "badge"
-    };
-
-    /// <summary>Minimal HTML encoding for text content and attribute values.</summary>
-    private static string HtmlEncode(string value)
-    {
-        if (string.IsNullOrEmpty(value)) return string.Empty;
-        return value
-            .Replace("&",  "&amp;")
-            .Replace("<",  "&lt;")
-            .Replace(">",  "&gt;")
-            .Replace("\"", "&quot;")
-            .Replace("'",  "&#39;");
-    }
 }

SharepointToolbox/Services/Export/PermissionHtmlFragments.cs

@@ -0,0 +1,207 @@
+using System.Text;
+using SharepointToolbox.Core.Models;
+using SharepointToolbox.Localization;
+
+namespace SharepointToolbox.Services.Export;
+
+/// <summary>
+/// Shared HTML-rendering fragments for the permission exports (standard and
+/// simplified). Extracted so the two <see cref="HtmlExportService"/> variants
+/// share the document shell, stats cards, filter input, user-pill logic, and
+/// inline script — leaving each caller only its own table headers and row
+/// cells to render.
+/// </summary>
+internal static class PermissionHtmlFragments
+{
+    internal const string BaseCss = @"
+* { box-sizing: border-box; margin: 0; padding: 0; }
+body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: #f5f5f5; color: #333; }
+h1 { padding: 20px 24px 10px; font-size: 1.5rem; color: #1a1a2e; }
+.stats { display: flex; gap: 16px; padding: 0 24px 16px; flex-wrap: wrap; }
+.stat-card { background: #fff; border-radius: 8px; padding: 14px 20px; min-width: 160px; box-shadow: 0 1px 4px rgba(0,0,0,.1); }
+.stat-card .value { font-size: 2rem; font-weight: 700; color: #1a1a2e; }
+.stat-card .label { font-size: .8rem; color: #666; margin-top: 2px; }
+.filter-wrap { padding: 0 24px 12px; }
+#filter { width: 320px; padding: 8px 12px; border: 1px solid #ccc; border-radius: 6px; font-size: .95rem; }
+.table-wrap { overflow-x: auto; padding: 0 24px 32px; }
+table { width: 100%; border-collapse: collapse; background: #fff; border-radius: 8px; overflow: hidden; box-shadow: 0 1px 4px rgba(0,0,0,.1); }
+th { background: #1a1a2e; color: #fff; padding: 10px 14px; text-align: left; font-size: .85rem; white-space: nowrap; }
+td { padding: 9px 14px; border-bottom: 1px solid #eee; vertical-align: top; font-size: .875rem; }
+tr:last-child td { border-bottom: none; }
+tr:hover td { background: #fafafa; }
+.badge { display: inline-block; padding: 2px 8px; border-radius: 4px; font-size: .75rem; font-weight: 600; white-space: nowrap; }
+.badge.site-coll { background: #dbeafe; color: #1e40af; }
+.badge.site      { background: #dcfce7; color: #166534; }
+.badge.list      { background: #fef9c3; color: #854d0e; }
+.badge.folder    { background: #f3f4f6; color: #374151; }
+.badge.unique    { background: #dcfce7; color: #166534; }
+.badge.inherited { background: #f3f4f6; color: #374151; }
+.user-pill { display: inline-block; background: #e0e7ff; color: #3730a3; border-radius: 12px; padding: 2px 10px; font-size: .75rem; margin: 2px 3px 2px 0; white-space: nowrap; }
+.user-pill.external-user { background: #fff7ed; color: #9a3412; border: 1px solid #fed7aa; }
+.group-expandable { cursor: pointer; }
+.group-expandable:hover { opacity: 0.8; }
+a { color: #2563eb; text-decoration: none; }
+a:hover { text-decoration: underline; }
+";
+
+    internal const string RiskCardsCss = @"
+.risk-cards { display: flex; gap: 12px; padding: 0 24px 16px; flex-wrap: wrap; }
+.risk-card { border-radius: 8px; padding: 12px 18px; min-width: 140px; border: 1px solid; }
+.risk-card .count { font-size: 1.5rem; font-weight: 700; }
+.risk-card .rlabel { font-size: .8rem; margin-top: 2px; }
+.risk-card .users { font-size: .7rem; margin-top: 2px; opacity: 0.8; }
+.risk-badge { display: inline-block; padding: 2px 8px; border-radius: 4px; font-size: .75rem; font-weight: 600; border: 1px solid; }
+";
+
+    internal const string InlineJs = @"function filterTable() {
+  var input = document.getElementById('filter').value.toLowerCase();
+  var rows = document.querySelectorAll('#permTable tbody tr');
+  rows.forEach(function(row) {
+    if (row.hasAttribute('data-group')) return;
+    row.style.display = row.textContent.toLowerCase().indexOf(input) > -1 ? '' : 'none';
+  });
+}
+document.addEventListener('click', function(ev) {
+  var trigger = ev.target.closest('.group-expandable');
+  if (!trigger) return;
+  var id = trigger.getAttribute('data-group-target');
+  if (!id) return;
+  document.querySelectorAll('#permTable tbody tr').forEach(function(r) {
+    if (r.getAttribute('data-group') === id) {
+      r.style.display = r.style.display === 'none' ? '' : 'none';
+    }
+  });
+});";
+
+    /// <summary>
+    /// Appends the shared HTML head (doctype, meta, inline CSS, title) to
+    /// <paramref name="sb"/>. Pass <paramref name="includeRiskCss"/> when the
+    /// caller renders risk cards/badges (simplified report only).
+    /// </summary>
+    internal static void AppendHead(StringBuilder sb, string title, bool includeRiskCss)
+    {
+        sb.AppendLine("<!DOCTYPE html>");
+        sb.AppendLine("<html lang=\"en\">");
+        sb.AppendLine("<head>");
+        sb.AppendLine("<meta charset=\"UTF-8\">");
+        sb.AppendLine("<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">");
+        sb.AppendLine($"<title>{title}</title>");
+        sb.AppendLine("<style>");
+        sb.AppendLine(BaseCss);
+        if (includeRiskCss)
+            sb.AppendLine(RiskCardsCss);
+        sb.AppendLine("</style>");
+        sb.AppendLine("</head>");
+    }
+
+    /// <summary>
+    /// Appends the three stat cards (total entries, unique permission sets,
+    /// distinct users/groups) inside a single <c>.stats</c> row.
+    /// </summary>
+    internal static void AppendStatsCards(StringBuilder sb, int totalEntries, int uniquePermSets, int distinctUsers)
+    {
+        var T = TranslationSource.Instance;
+        sb.AppendLine("<div class=\"stats\">");
+        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{totalEntries}</div><div class=\"label\">{T["report.stat.total_entries"]}</div></div>");
+        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{uniquePermSets}</div><div class=\"label\">{T["report.stat.unique_permission_sets"]}</div></div>");
+        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{distinctUsers}</div><div class=\"label\">{T["report.stat.distinct_users_groups"]}</div></div>");
+        sb.AppendLine("</div>");
+    }
+
+    /// <summary>Appends the live-filter input bound to <c>#permTable</c>.</summary>
+    internal static void AppendFilterInput(StringBuilder sb)
+    {
+        var T = TranslationSource.Instance;
+        sb.AppendLine("<div class=\"filter-wrap\">");
+        sb.AppendLine($"  <input type=\"text\" id=\"filter\" placeholder=\"{T["report.filter.placeholder_permissions"]}\" onkeyup=\"filterTable()\" />");
+        sb.AppendLine("</div>");
+    }
+
+    /// <summary>Appends the inline &lt;script&gt; that powers filter and group toggle.</summary>
+    internal static void AppendInlineJs(StringBuilder sb)
+    {
+        sb.AppendLine("<script>");
+        sb.AppendLine(InlineJs);
+        sb.AppendLine("</script>");
+    }
+
+    /// <summary>
+    /// Renders the user-pill cell content plus any group-member sub-rows for a
+    /// single permission entry. Callers pass their row colspan so sub-rows
+    /// span the full table; <paramref name="grpMemIdx"/> must be mutated
+    /// across rows so sub-row IDs stay unique.
+    /// </summary>
+    internal static (string Pills, string MemberSubRows) BuildUserPillsCell(
+        string userLogins,
+        string userNames,
+        string? principalType,
+        IReadOnlyDictionary<string, IReadOnlyList<ResolvedMember>>? groupMembers,
+        int colSpan,
+        ref int grpMemIdx)
+    {
+        var T = TranslationSource.Instance;
+        var logins = userLogins.Split(';', StringSplitOptions.RemoveEmptyEntries);
+        var names  = userNames.Split(';', StringSplitOptions.RemoveEmptyEntries);
+        var pills = new StringBuilder();
+        var subRows = new StringBuilder();
+
+        for (int i = 0; i < logins.Length; i++)
+        {
+            var login = logins[i].Trim();
+            var name  = i < names.Length ? names[i].Trim() : login;
+            var isExt = login.Contains("#EXT#", StringComparison.OrdinalIgnoreCase);
+
+            bool isExpandable = principalType == "SharePointGroup"
+                && groupMembers != null
+                && groupMembers.TryGetValue(name, out _);
+
+            if (isExpandable && groupMembers != null && groupMembers.TryGetValue(name, out var resolved))
+            {
+                var grpId = $"grpmem{grpMemIdx}";
+                pills.Append($"<span class=\"user-pill group-expandable\" data-group-target=\"{HtmlEncode(grpId)}\" data-email=\"{HtmlEncode(login)}\">{HtmlEncode(name)} &#9660;</span>");
+
+                string memberContent;
+                if (resolved.Count > 0)
+                {
+                    var parts = resolved.Select(m => $"{HtmlEncode(m.DisplayName)} &lt;{HtmlEncode(m.Login)}&gt;");
+                    memberContent = string.Join(" &bull; ", parts);
+                }
+                else
+                {
+                    memberContent = $"<em style=\"color:#888\">{T["report.text.members_unavailable"]}</em>";
+                }
+                subRows.AppendLine($"<tr data-group=\"{HtmlEncode(grpId)}\" style=\"display:none\"><td colspan=\"{colSpan}\" style=\"padding-left:2em;font-size:.8rem;color:#555\">{memberContent}</td></tr>");
+                grpMemIdx++;
+            }
+            else
+            {
+                var cls = isExt ? "user-pill external-user" : "user-pill";
+                pills.Append($"<span class=\"{cls}\" data-email=\"{HtmlEncode(login)}\">{HtmlEncode(name)}</span>");
+            }
+        }
+
+        return (pills.ToString(), subRows.ToString());
+    }
+
+    /// <summary>Returns the CSS class for the object-type badge.</summary>
+    internal static string ObjectTypeCss(string t) => t switch
+    {
+        "Site Collection" => "badge site-coll",
+        "Site"            => "badge site",
+        "List"            => "badge list",
+        "Folder"          => "badge folder",
+        _                 => "badge"
+    };
+
+    /// <summary>Minimal HTML encoding for text content and attribute values.</summary>
+    internal static string HtmlEncode(string value)
+    {
+        if (string.IsNullOrEmpty(value)) return string.Empty;
+        return value
+            .Replace("&",  "&amp;")
+            .Replace("<",  "&lt;")
+            .Replace(">",  "&gt;")
+            .Replace("\"", "&quot;")
+            .Replace("'",  "&#39;");
+    }
+}

SharepointToolbox/Services/Export/ReportSplitHelper.cs

@@ -0,0 +1,199 @@
+using System.Diagnostics;
+using System.IO;
+using System.Net;
+using System.Text;
+
+namespace SharepointToolbox.Services.Export;
+
+/// <summary>
+/// Shared helpers for split report exports: filename partitioning, site label
+/// derivation, and bundling per-partition HTML into a single tabbed document.
+/// </summary>
+public static class ReportSplitHelper
+{
+    /// <summary>
+    /// Returns a file-safe variant of <paramref name="name"/>. Invalid filename
+    /// characters are replaced with underscores; whitespace runs are collapsed.
+    /// </summary>
+    public static string SanitizeFileName(string name)
+    {
+        if (string.IsNullOrWhiteSpace(name)) return "part";
+        var invalid = Path.GetInvalidFileNameChars();
+        var sb = new StringBuilder(name.Length);
+        foreach (var c in name)
+            sb.Append(invalid.Contains(c) || c == ' ' ? '_' : c);
+        var trimmed = sb.ToString().Trim('_');
+        if (trimmed.Length > 80) trimmed = trimmed.Substring(0, 80);
+        return trimmed.Length == 0 ? "part" : trimmed;
+    }
+
+    /// <summary>
+    /// Given a user-selected <paramref name="basePath"/> (e.g. "C:\reports\duplicates.csv"),
+    /// returns a partitioned path like "C:\reports\duplicates_{label}.csv".
+    /// </summary>
+    public static string BuildPartitionPath(string basePath, string partitionLabel)
+    {
+        var dir = Path.GetDirectoryName(basePath);
+        var stem = Path.GetFileNameWithoutExtension(basePath);
+        var ext = Path.GetExtension(basePath);
+        var safe = SanitizeFileName(partitionLabel);
+        var file = $"{stem}_{safe}{ext}";
+        return string.IsNullOrEmpty(dir) ? file : Path.Combine(dir, file);
+    }
+
+    /// <summary>
+    /// Extracts the site-collection root URL from an arbitrary SharePoint object URL.
+    /// e.g. https://t.sharepoint.com/sites/hr/Shared%20Documents/foo.docx →
+    ///      https://t.sharepoint.com/sites/hr
+    /// Falls back to scheme+host for root site collections.
+    /// </summary>
+    public static string DeriveSiteCollectionUrl(string objectUrl)
+    {
+        if (string.IsNullOrWhiteSpace(objectUrl)) return string.Empty;
+        if (!Uri.TryCreate(objectUrl, UriKind.Absolute, out var uri))
+            return objectUrl.TrimEnd('/');
+
+        var baseUrl = $"{uri.Scheme}://{uri.Host}";
+        var segments = uri.AbsolutePath.Trim('/').Split('/', StringSplitOptions.RemoveEmptyEntries);
+
+        if (segments.Length >= 2 &&
+            (segments[0].Equals("sites", StringComparison.OrdinalIgnoreCase) ||
+             segments[0].Equals("teams", StringComparison.OrdinalIgnoreCase)))
+        {
+            return $"{baseUrl}/{segments[0]}/{segments[1]}";
+        }
+        return baseUrl;
+    }
+
+    /// <summary>
+    /// Derives a short, human-friendly site label from a SharePoint site URL.
+    /// Falls back to the raw URL (sanitized) when parsing fails.
+    /// </summary>
+    public static string DeriveSiteLabel(string siteUrl, string? siteTitle = null)
+    {
+        if (!string.IsNullOrWhiteSpace(siteTitle)) return siteTitle!;
+        if (string.IsNullOrWhiteSpace(siteUrl)) return "site";
+        try
+        {
+            var uri = new Uri(siteUrl);
+            var segments = uri.AbsolutePath.Trim('/').Split('/', StringSplitOptions.RemoveEmptyEntries);
+            if (segments.Length >= 2 &&
+                (segments[0].Equals("sites", StringComparison.OrdinalIgnoreCase) ||
+                 segments[0].Equals("teams", StringComparison.OrdinalIgnoreCase)))
+            {
+                return segments[1];
+            }
+            return uri.Host;
+        }
+        catch (Exception ex) when (ex is UriFormatException or ArgumentException)
+        {
+            Debug.WriteLine($"[ReportSplitHelper] DeriveSiteLabel: malformed URL '{siteUrl}' ({ex.GetType().Name}: {ex.Message}) — falling back to raw value.");
+            return siteUrl;
+        }
+    }
+
+    /// <summary>
+    /// Generic dispatcher for split-aware export: if
+    /// <paramref name="splitMode"/> is not BySite, writes a single file via
+    /// <paramref name="writer"/>; otherwise partitions via
+    /// <paramref name="partitioner"/> and writes one file per partition,
+    /// each at a filename derived from <paramref name="basePath"/> plus the
+    /// partition label.
+    /// </summary>
+    public static async Task WritePartitionedAsync<T>(
+        IReadOnlyList<T> items,
+        string basePath,
+        ReportSplitMode splitMode,
+        Func<IReadOnlyList<T>, IEnumerable<(string Label, IReadOnlyList<T> Partition)>> partitioner,
+        Func<IReadOnlyList<T>, string, CancellationToken, Task> writer,
+        CancellationToken ct)
+    {
+        if (splitMode != ReportSplitMode.BySite)
+        {
+            await writer(items, basePath, ct);
+            return;
+        }
+
+        foreach (var (label, partition) in partitioner(items))
+        {
+            ct.ThrowIfCancellationRequested();
+            var path = BuildPartitionPath(basePath, label);
+            await writer(partition, path, ct);
+        }
+    }
+
+    /// <summary>
+    /// Bundles per-partition HTML documents into one self-contained tabbed
+    /// HTML. Each partition HTML is embedded in an &lt;iframe srcdoc&gt; so
+    /// their inline styles and scripts remain isolated.
+    /// </summary>
+    public static string BuildTabbedHtml(
+        IReadOnlyList<(string Label, string Html)> parts,
+        string title)
+    {
+        var sb = new StringBuilder();
+        sb.AppendLine("<!DOCTYPE html>");
+        sb.AppendLine("<html lang=\"en\">");
+        sb.AppendLine("<head>");
+        sb.AppendLine("<meta charset=\"UTF-8\">");
+        sb.AppendLine("<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">");
+        sb.AppendLine($"<title>{WebUtility.HtmlEncode(title)}</title>");
+        sb.AppendLine("""
+            <style>
+              html, body { margin: 0; padding: 0; height: 100%; font-family: 'Segoe UI', Arial, sans-serif; background: #1a1a2e; }
+              .tabbar { display: flex; flex-wrap: wrap; gap: 4px; background: #1a1a2e; padding: 8px; position: sticky; top: 0; z-index: 10; }
+              .tab { padding: 6px 12px; background: #2d2d4e; color: #fff; cursor: pointer; border-radius: 4px;
+                     font-size: 13px; user-select: none; white-space: nowrap; }
+              .tab:hover { background: #3d3d6e; }
+              .tab.active { background: #0078d4; }
+              .frame-host { background: #f5f5f5; }
+              iframe { width: 100%; height: calc(100vh - 52px); border: 0; display: none; background: #f5f5f5; }
+              iframe.active { display: block; }
+            </style>
+            </head>
+            <body>
+            """);
+        sb.Append("<div class=\"tabbar\">");
+        for (int i = 0; i < parts.Count; i++)
+        {
+            var cls = i == 0 ? "tab active" : "tab";
+            sb.Append($"<div class=\"{cls}\" onclick=\"showTab({i})\">{WebUtility.HtmlEncode(parts[i].Label)}</div>");
+        }
+        sb.AppendLine("</div>");
+
+        for (int i = 0; i < parts.Count; i++)
+        {
+            var cls = i == 0 ? "active" : string.Empty;
+            var escaped = EscapeForSrcdoc(parts[i].Html);
+            sb.AppendLine($"<iframe class=\"{cls}\" srcdoc=\"{escaped}\"></iframe>");
+        }
+        sb.AppendLine("""
+            <script>
+              function showTab(i) {
+                var frames = document.querySelectorAll('iframe');
+                var tabs = document.querySelectorAll('.tab');
+                for (var j = 0; j < frames.length; j++) {
+                  frames[j].classList.toggle('active', i === j);
+                  tabs[j].classList.toggle('active', i === j);
+                }
+              }
+            </script>
+            </body></html>
+            """);
+        return sb.ToString();
+    }
+
+    /// <summary>
+    /// Escapes an HTML document so it can safely appear inside an
+    /// &lt;iframe srcdoc="..."&gt; attribute. Only ampersands and double
+    /// quotes must be encoded; angle brackets are kept literal because the
+    /// parser treats srcdoc as CDATA-like content.
+    /// </summary>
+    private static string EscapeForSrcdoc(string html)
+    {
+        if (string.IsNullOrEmpty(html)) return string.Empty;
+        return html
+            .Replace("&", "&amp;")
+            .Replace("\"", "&quot;");
+    }
+}

SharepointToolbox/Services/Export/ReportSplitMode.cs

@@ -0,0 +1,16 @@
+namespace SharepointToolbox.Services.Export;
+
+/// <summary>How a report export is partitioned.</summary>
+public enum ReportSplitMode
+{
+    Single,
+    BySite,
+    ByUser
+}
+
+/// <summary>When a report is split, how HTML output is laid out.</summary>
+public enum HtmlSplitLayout
+{
+    SeparateFiles,
+    SingleTabbed
+}

SharepointToolbox/Services/Export/SearchCsvExportService.cs

@@ -1,6 +1,7 @@
 using System.IO;
 using System.Text;
 using SharepointToolbox.Core.Models;
+using SharepointToolbox.Localization;
 
 namespace SharepointToolbox.Services.Export;
 
@@ -10,12 +11,17 @@ namespace SharepointToolbox.Services.Export;
 /// </summary>
 public class SearchCsvExportService
 {
+    /// <summary>
+    /// Builds the CSV payload. Column order mirrors
+    /// <see cref="SearchHtmlExportService.BuildHtml(IReadOnlyList{SearchResult}, ReportBranding?)"/>.
+    /// </summary>
     public string BuildCsv(IReadOnlyList<SearchResult> results)
     {
+        var T = TranslationSource.Instance;
         var sb = new StringBuilder();
 
         // Header
-        sb.AppendLine("File Name,Extension,Path,Created,Created By,Modified,Modified By,Size (bytes)");
+        sb.AppendLine($"{T["report.col.file_name"]},{T["report.col.extension"]},{T["report.col.path"]},{T["report.col.created"]},{T["report.col.created_by"]},{T["report.col.modified"]},{T["report.col.modified_by"]},{T["report.col.size_bytes"]}");
 
         foreach (var r in results)
         {
@@ -33,19 +39,14 @@ public class SearchCsvExportService
         return sb.ToString();
     }
 
+    /// <summary>Writes the CSV to <paramref name="filePath"/> with UTF-8 BOM.</summary>
     public async Task WriteAsync(IReadOnlyList<SearchResult> results, string filePath, CancellationToken ct)
     {
         var csv = BuildCsv(results);
-        await System.IO.File.WriteAllTextAsync(filePath, csv, new UTF8Encoding(encoderShouldEmitUTF8Identifier: true), ct);
+        await ExportFileWriter.WriteCsvAsync(filePath, csv, ct);
     }
 
-    private static string Csv(string value)
+    private static string Csv(string value) => CsvSanitizer.EscapeMinimal(value);
-    {
-        if (string.IsNullOrEmpty(value)) return string.Empty;
-        if (value.Contains(',') || value.Contains('"') || value.Contains('\n'))
-            return $"\"{value.Replace("\"", "\"\"")}\"";
-        return value;
-    }
 
     private static string IfEmpty(string? value, string fallback = "")
         => string.IsNullOrEmpty(value) ? fallback : value!;

SharepointToolbox/Services/Export/SearchHtmlExportService.cs

@@ -1,6 +1,7 @@
 using System.IO;
 using System.Text;
 using SharepointToolbox.Core.Models;
+using SharepointToolbox.Localization;
 
 namespace SharepointToolbox.Services.Export;
 
@@ -11,17 +12,23 @@ namespace SharepointToolbox.Services.Export;
 /// </summary>
 public class SearchHtmlExportService
 {
+    /// <summary>
+    /// Builds a self-contained HTML table with inline sort/filter scripts.
+    /// Each <see cref="SearchResult"/> becomes one row; the document has no
+    /// external dependencies.
+    /// </summary>
     public string BuildHtml(IReadOnlyList<SearchResult> results, ReportBranding? branding = null)
     {
+        var T = TranslationSource.Instance;
         var sb = new StringBuilder();
 
+        sb.AppendLine("<!DOCTYPE html>");
+        sb.AppendLine("<html lang=\"en\">");
+        sb.AppendLine("<head>");
+        sb.AppendLine("<meta charset=\"UTF-8\">");
+        sb.AppendLine("<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">");
+        sb.AppendLine($"<title>{T["report.title.search"]}</title>");
         sb.AppendLine("""
-            <!DOCTYPE html>
-            <html lang="en">
-            <head>
-            <meta charset="UTF-8">
-            <meta name="viewport" content="width=device-width, initial-scale=1.0">
-            <title>SharePoint File Search Results</title>
             <style>
               body { font-family: 'Segoe UI', Arial, sans-serif; font-size: 13px; margin: 20px; background: #f5f5f5; }
               h1 { color: #0078d4; }
@@ -45,27 +52,27 @@ public class SearchHtmlExportService
             <body>
             """);
         sb.Append(BrandingHtmlHelper.BuildBrandingHeader(branding));
-        sb.AppendLine("""
+        sb.AppendLine($"""
-            <h1>File Search Results</h1>
+            <h1>{T["report.title.search_short"]}</h1>
             <div class="toolbar">
-              <label for="filterInput">Filter:</label>
+              <label for="filterInput">{T["report.filter.label"]}</label>
-              <input id="filterInput" type="text" placeholder="Filter rows…" oninput="filterTable()" />
+              <input id="filterInput" type="text" placeholder="{T["report.filter.placeholder_rows"]}" oninput="filterTable()" />
               <span id="resultCount"></span>
             </div>
             """);
 
-        sb.AppendLine("""
+        sb.AppendLine($"""
             <table id="resultsTable">
               <thead>
                 <tr>
-                  <th onclick="sortTable(0)">File Name</th>
+                  <th onclick="sortTable(0)">{T["report.col.file_name"]}</th>
-                  <th onclick="sortTable(1)">Extension</th>
+                  <th onclick="sortTable(1)">{T["report.col.extension"]}</th>
-                  <th onclick="sortTable(2)">Path</th>
+                  <th onclick="sortTable(2)">{T["report.col.path"]}</th>
-                  <th onclick="sortTable(3)">Created</th>
+                  <th onclick="sortTable(3)">{T["report.col.created"]}</th>
-                  <th onclick="sortTable(4)">Created By</th>
+                  <th onclick="sortTable(4)">{T["report.col.created_by"]}</th>
-                  <th onclick="sortTable(5)">Modified</th>
+                  <th onclick="sortTable(5)">{T["report.col.modified"]}</th>
-                  <th onclick="sortTable(6)">Modified By</th>
+                  <th onclick="sortTable(6)">{T["report.col.modified_by"]}</th>
-                  <th class="num" onclick="sortTable(7)">Size</th>
+                  <th class="num" onclick="sortTable(7)">{T["report.col.size"]}</th>
                 </tr>
               </thead>
               <tbody>
@@ -93,7 +100,7 @@ public class SearchHtmlExportService
         sb.AppendLine("  </tbody>\n</table>");
 
         int count = results.Count;
-        sb.AppendLine($"<p class=\"generated\">Generated: {DateTime.Now:yyyy-MM-dd HH:mm} — {count:N0} result(s)</p>");
+        sb.AppendLine($"<p class=\"generated\">{T["report.text.generated_colon"]} {DateTime.Now:yyyy-MM-dd HH:mm} — {count:N0} {T["report.text.results_parens"]}</p>");
 
         sb.AppendLine($$"""
             <script>
@@ -126,10 +133,10 @@ public class SearchHtmlExportService
                 rows[i].className = match ? '' : 'hidden';
                 if (match) visible++;
               }
-              document.getElementById('resultCount').innerText = q ? (visible + ' of {{count:N0}} shown') : '';
+              document.getElementById('resultCount').innerText = q ? (visible + ' {{T["report.text.of"]}} {{count:N0}} {{T["report.text.shown"]}}') : '';
             }
             window.onload = function() {
-              document.getElementById('resultCount').innerText = '{{count:N0}} result(s)';
+              document.getElementById('resultCount').innerText = '{{count:N0}} {{T["report.text.results_parens"]}}';
             };
             </script>
             </body></html>
@@ -138,6 +145,7 @@ public class SearchHtmlExportService
         return sb.ToString();
     }
 
+    /// <summary>Writes the HTML report to <paramref name="filePath"/>.</summary>
     public async Task WriteAsync(IReadOnlyList<SearchResult> results, string filePath, CancellationToken ct, ReportBranding? branding = null)
     {
         var html = BuildHtml(results, branding);

SharepointToolbox/Services/Export/StorageCsvExportService.cs

@@ -1,4 +1,6 @@
 using SharepointToolbox.Core.Models;
+using SharepointToolbox.Localization;
+using System.Globalization;
 using System.IO;
 using System.Text;
 
@@ -10,33 +12,65 @@ namespace SharepointToolbox.Services.Export;
 /// </summary>
 public class StorageCsvExportService
 {
+    /// <summary>
+    /// Builds a single-section CSV: header row plus one row per
+    /// <see cref="StorageNode"/> with library, site, file count, total size
+    /// (MB), version size (MB), and last-modified date.
+    /// </summary>
     public string BuildCsv(IReadOnlyList<StorageNode> nodes)
     {
-        var sb = new StringBuilder();
+        // Pre-size: ~110 chars/row + header avoids most StringBuilder growth.
-
+        var sb = new StringBuilder(128 + nodes.Count * 110);
-        // Header
+        WriteCsv(sb, nodes);
-        sb.AppendLine("Library,Site,Files,Total Size (MB),Version Size (MB),Last Modified");
-
-        foreach (var node in nodes)
-        {
-            sb.AppendLine(string.Join(",",
-                Csv(node.Name),
-                Csv(node.SiteTitle),
-                node.TotalFileCount.ToString(),
-                FormatMb(node.TotalSizeBytes),
-                FormatMb(node.VersionSizeBytes),
-                node.LastModified.HasValue
-                    ? Csv(node.LastModified.Value.ToString("yyyy-MM-dd"))
-                    : string.Empty));
-        }
-
         return sb.ToString();
     }
 
+    private static void WriteCsv(StringBuilder sb, IReadOnlyList<StorageNode> nodes)
+    {
+        var T = TranslationSource.Instance;
+        // Hoist resource lookups out of the row loop: ResourceManager.GetString
+        // is a culture-aware dictionary probe — caching once per export saves
+        // O(rows × columns) lookups on large tenants.
+        string colLibrary  = T["report.col.library"];
+        string colKind     = T["stor.col.kind"];
+        string colSite     = T["report.col.site"];
+        string colFiles    = T["report.stat.files"];
+        string colTotalMb  = T["report.col.total_size_mb"];
+        string colVerMb    = T["report.col.version_size_mb"];
+        string colLastMod  = T["report.col.last_modified"];
+
+        sb.Append(colLibrary).Append(',')
+          .Append(colKind).Append(',')
+          .Append(colSite).Append(',')
+          .Append(colFiles).Append(',')
+          .Append(colTotalMb).Append(',')
+          .Append(colVerMb).Append(',')
+          .AppendLine(colLastMod);
+
+        var kindLabels = BuildKindLabelCache();
+
+        foreach (var node in nodes)
+        {
+            AppendCsvField(sb, node.Name).Append(',');
+            AppendCsvField(sb, kindLabels[(int)node.Kind]).Append(',');
+            AppendCsvField(sb, node.SiteTitle).Append(',');
+            sb.Append(node.TotalFileCount).Append(',');
+            AppendMb(sb, node.TotalSizeBytes).Append(',');
+            AppendMb(sb, node.VersionSizeBytes).Append(',');
+            if (node.LastModified.HasValue)
+                AppendCsvField(sb, node.LastModified.Value.ToString("yyyy-MM-dd", CultureInfo.InvariantCulture));
+            sb.AppendLine();
+        }
+    }
+
+    /// <summary>Writes the library-level CSV to <paramref name="filePath"/> with UTF-8 BOM.</summary>
     public async Task WriteAsync(IReadOnlyList<StorageNode> nodes, string filePath, CancellationToken ct)
     {
-        var csv = BuildCsv(nodes);
+        // Stream straight to disk: skip the StringBuilder→string copy and the
-        await File.WriteAllTextAsync(filePath, csv, new UTF8Encoding(encoderShouldEmitUTF8Identifier: true), ct);
+        // separate UTF-8 buffer that File.WriteAllTextAsync materializes.
+        var sb = new StringBuilder(128 + nodes.Count * 110);
+        WriteCsv(sb, nodes);
+        await ExportFileWriter.WriteCsvChunksAsync(filePath, sb, ct);
     }
 
     /// <summary>
@@ -44,55 +78,150 @@ public class StorageCsvExportService
     /// </summary>
     public string BuildCsv(IReadOnlyList<StorageNode> nodes, IReadOnlyList<FileTypeMetric> fileTypeMetrics)
     {
-        var sb = new StringBuilder();
+        var sb = new StringBuilder(192 + nodes.Count * 100 + fileTypeMetrics.Count * 40);
-
+        WriteCsv(sb, nodes, fileTypeMetrics);
-        // Library details
-        sb.AppendLine("Library,Site,Files,Total Size (MB),Version Size (MB),Last Modified");
-        foreach (var node in nodes)
-        {
-            sb.AppendLine(string.Join(",",
-                Csv(node.Name),
-                Csv(node.SiteTitle),
-                node.TotalFileCount.ToString(),
-                FormatMb(node.TotalSizeBytes),
-                FormatMb(node.VersionSizeBytes),
-                node.LastModified.HasValue
-                    ? Csv(node.LastModified.Value.ToString("yyyy-MM-dd"))
-                    : string.Empty));
-        }
-
-        // File type breakdown
-        if (fileTypeMetrics.Count > 0)
-        {
-            sb.AppendLine();
-            sb.AppendLine("File Type,Size (MB),File Count");
-            foreach (var m in fileTypeMetrics)
-            {
-                string label = string.IsNullOrEmpty(m.Extension) ? "(no extension)" : m.Extension;
-                sb.AppendLine(string.Join(",", Csv(label), FormatMb(m.TotalSizeBytes), m.FileCount.ToString()));
-            }
-        }
-
         return sb.ToString();
     }
 
+    private static void WriteCsv(StringBuilder sb, IReadOnlyList<StorageNode> nodes, IReadOnlyList<FileTypeMetric> fileTypeMetrics)
+    {
+        var T = TranslationSource.Instance;
+        string colLibrary  = T["report.col.library"];
+        string colSite     = T["report.col.site"];
+        string colFiles    = T["report.stat.files"];
+        string colTotalMb  = T["report.col.total_size_mb"];
+        string colVerMb    = T["report.col.version_size_mb"];
+        string colLastMod  = T["report.col.last_modified"];
+
+        sb.Append(colLibrary).Append(',')
+          .Append(colSite).Append(',')
+          .Append(colFiles).Append(',')
+          .Append(colTotalMb).Append(',')
+          .Append(colVerMb).Append(',')
+          .AppendLine(colLastMod);
+
+        foreach (var node in nodes)
+        {
+            AppendCsvField(sb, node.Name).Append(',');
+            AppendCsvField(sb, node.SiteTitle).Append(',');
+            sb.Append(node.TotalFileCount).Append(',');
+            AppendMb(sb, node.TotalSizeBytes).Append(',');
+            AppendMb(sb, node.VersionSizeBytes).Append(',');
+            if (node.LastModified.HasValue)
+                AppendCsvField(sb, node.LastModified.Value.ToString("yyyy-MM-dd", CultureInfo.InvariantCulture));
+            sb.AppendLine();
+        }
+
+        if (fileTypeMetrics.Count > 0)
+        {
+            string colFileType = T["report.col.file_type"];
+            string colSizeMb   = T["report.col.size_mb"];
+            string colFileCnt  = T["report.col.file_count"];
+            string noExtLabel  = T["report.text.no_extension"];
+
+            sb.AppendLine();
+            sb.Append(colFileType).Append(',')
+              .Append(colSizeMb).Append(',')
+              .AppendLine(colFileCnt);
+
+            foreach (var m in fileTypeMetrics)
+            {
+                string label = string.IsNullOrEmpty(m.Extension) ? noExtLabel : m.Extension;
+                AppendCsvField(sb, label).Append(',');
+                AppendMb(sb, m.TotalSizeBytes).Append(',');
+                sb.Append(m.FileCount).AppendLine();
+            }
+        }
+    }
+
+    /// <summary>Writes the two-section CSV (libraries + file-type breakdown) with UTF-8 BOM.</summary>
     public async Task WriteAsync(IReadOnlyList<StorageNode> nodes, IReadOnlyList<FileTypeMetric> fileTypeMetrics, string filePath, CancellationToken ct)
     {
-        var csv = BuildCsv(nodes, fileTypeMetrics);
+        var sb = new StringBuilder(192 + nodes.Count * 100 + fileTypeMetrics.Count * 40);
-        await File.WriteAllTextAsync(filePath, csv, new UTF8Encoding(encoderShouldEmitUTF8Identifier: true), ct);
+        WriteCsv(sb, nodes, fileTypeMetrics);
+        await ExportFileWriter.WriteCsvChunksAsync(filePath, sb, ct);
+    }
+
+    /// <summary>
+    /// Writes storage metrics with optional per-site partitioning.
+    /// Single → one file. BySite → one file per SiteTitle. File-type metrics
+    /// are replicated across all partitions because the tenant-level scan
+    /// does not retain per-site breakdowns.
+    /// </summary>
+    public Task WriteAsync(
+        IReadOnlyList<StorageNode> nodes,
+        IReadOnlyList<FileTypeMetric> fileTypeMetrics,
+        string basePath,
+        ReportSplitMode splitMode,
+        CancellationToken ct)
+        => ReportSplitHelper.WritePartitionedAsync(
+            nodes, basePath, splitMode,
+            PartitionBySite,
+            (part, path, c) => WriteAsync(part, fileTypeMetrics, path, c),
+            ct);
+
+    /// <summary>
+    /// Splits the flat StorageNode list into per-site slices while preserving
+    /// the DFS hierarchy (each root library followed by its indented descendants).
+    /// Siblings sharing a SiteTitle roll up into the same partition.
+    /// </summary>
+    internal static IEnumerable<(string Label, IReadOnlyList<StorageNode> Partition)> PartitionBySite(
+        IReadOnlyList<StorageNode> nodes)
+    {
+        var buckets = new Dictionary<string, List<StorageNode>>(StringComparer.OrdinalIgnoreCase);
+        string currentSite = string.Empty;
+        foreach (var node in nodes)
+        {
+            if (node.IndentLevel == 0)
+                currentSite = string.IsNullOrWhiteSpace(node.SiteTitle)
+                    ? ReportSplitHelper.DeriveSiteLabel(node.Url)
+                    : node.SiteTitle;
+            if (!buckets.TryGetValue(currentSite, out var list))
+            {
+                list = new List<StorageNode>();
+                buckets[currentSite] = list;
+            }
+            list.Add(node);
+        }
+        return buckets.Select(kv => (kv.Key, (IReadOnlyList<StorageNode>)kv.Value));
     }
 
     // ── Helpers ───────────────────────────────────────────────────────────────
 
-    private static string FormatMb(long bytes)
+    private static StringBuilder AppendMb(StringBuilder sb, long bytes)
-        => (bytes / (1024.0 * 1024.0)).ToString("F2");
+        => sb.Append((bytes / (1024.0 * 1024.0)).ToString("F2", CultureInfo.InvariantCulture));
 
-    /// <summary>RFC 4180 CSV field quoting.</summary>
+    private static StringBuilder AppendCsvField(StringBuilder sb, string value)
-    private static string Csv(string value)
+        => sb.Append(CsvSanitizer.EscapeMinimal(value));
+
+    /// <summary>
+    /// Pre-resolves localized labels for every <see cref="StorageNodeKind"/>
+    /// once per export, indexed by the enum's int value. Avoids a
+    /// <c>ResourceManager.GetString</c> call per row in hot CSV loops.
+    /// </summary>
+    private static string[] BuildKindLabelCache()
     {
-        if (string.IsNullOrEmpty(value)) return string.Empty;
+        var values = (StorageNodeKind[])Enum.GetValues(typeof(StorageNodeKind));
-        if (value.Contains(',') || value.Contains('"') || value.Contains('\n'))
+        int max = 0;
-            return $"\"{value.Replace("\"", "\"\"")}\"";
+        foreach (var v in values) { int i = (int)v; if (i > max) max = i; }
-        return value;
+        var cache = new string[max + 1];
+        for (int i = 0; i < cache.Length; i++) cache[i] = ((StorageNodeKind)i).ToString();
+        foreach (var v in values) cache[(int)v] = KindLabel(v);
+        return cache;
+    }
+
+    private static string KindLabel(StorageNodeKind kind)
+    {
+        var T = TranslationSource.Instance;
+        return kind switch
+        {
+            StorageNodeKind.Library          => T["stor.kind.library"],
+            StorageNodeKind.HiddenLibrary    => T["stor.kind.hidden"],
+            StorageNodeKind.PreservationHold => T["stor.kind.preservation"],
+            StorageNodeKind.ListAttachments  => T["stor.kind.attachments"],
+            StorageNodeKind.RecycleBin       => T["stor.kind.recyclebin"],
+            StorageNodeKind.Subsite          => T["stor.kind.subsite"],
+            _ => kind.ToString()
+        };
     }
 }

SharepointToolbox/Services/Export/StorageHtmlExportService.cs

@@ -1,4 +1,5 @@
 using SharepointToolbox.Core.Models;
+using SharepointToolbox.Localization;
 using System.IO;
 using System.Text;
 
@@ -12,19 +13,36 @@ namespace SharepointToolbox.Services.Export;
 public class StorageHtmlExportService
 {
     private int _togIdx;
+    private string[] _kindLabels = Array.Empty<string>();
+    private string[] _kindLabelsHtml = Array.Empty<string>();
 
+    /// <summary>
+    /// Builds a self-contained HTML report with one collapsible row per
+    /// library and indented child folders. Library-only variant — use the
+    /// overload that accepts <see cref="FileTypeMetric"/>s when a file-type
+    /// breakdown section is desired.
+    /// </summary>
     public string BuildHtml(IReadOnlyList<StorageNode> nodes, ReportBranding? branding = null)
     {
-        _togIdx = 0;
+        var sb = new StringBuilder(3072 + nodes.Count * 340);
-        var sb = new StringBuilder();
+        BuildHtmlCore(sb, nodes, branding);
+        return sb.ToString();
+    }
 
+    private void BuildHtmlCore(StringBuilder sb, IReadOnlyList<StorageNode> nodes, ReportBranding? branding)
+    {
+        var T = TranslationSource.Instance;
+        _togIdx = 0;
+        _kindLabels = BuildKindLabelCache();
+        _kindLabelsHtml = BuildHtmlEncodedCache(_kindLabels);
+
+        sb.AppendLine("<!DOCTYPE html>");
+        sb.AppendLine("<html lang=\"en\">");
+        sb.AppendLine("<head>");
+        sb.AppendLine("<meta charset=\"UTF-8\">");
+        sb.AppendLine("<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">");
+        sb.AppendLine($"<title>{T["report.title.storage"]}</title>");
         sb.AppendLine("""
-            <!DOCTYPE html>
-            <html lang="en">
-            <head>
-            <meta charset="UTF-8">
-            <meta name="viewport" content="width=device-width, initial-scale=1.0">
-            <title>SharePoint Storage Metrics</title>
             <style>
               body { font-family: 'Segoe UI', Arial, sans-serif; font-size: 13px; margin: 20px; background: #f5f5f5; }
               h1 { color: #0078d4; }
@@ -50,40 +68,49 @@ public class StorageHtmlExportService
             <body>
             """);
         sb.Append(BrandingHtmlHelper.BuildBrandingHeader(branding));
-        sb.AppendLine("""
+        sb.AppendLine($"<h1>{T["report.title.storage"]}</h1>");
-            <h1>SharePoint Storage Metrics</h1>
-            """);
 
-        // Summary cards
+        // Single-pass root aggregation: replaces 4 separate enumerations
-        var rootNodes0 = nodes.Where(n => n.IndentLevel == 0).ToList();
+        // (.Where().ToList() + 3× .Sum() + a final .Where() during render).
-        long siteTotal0 = rootNodes0.Sum(n => n.TotalSizeBytes);
+        var rootNodes0 = new List<StorageNode>(Math.Min(nodes.Count, 64));
-        long versionTotal0 = rootNodes0.Sum(n => n.VersionSizeBytes);
+        long siteTotal0 = 0, versionTotal0 = 0, fileTotal0 = 0;
-        long fileTotal0 = rootNodes0.Sum(n => n.TotalFileCount);
+        foreach (var n in nodes)
+        {
+            if (n.IndentLevel != 0) continue;
+            rootNodes0.Add(n);
+            siteTotal0    += n.TotalSizeBytes;
+            versionTotal0 += n.VersionSizeBytes;
+            fileTotal0    += n.TotalFileCount;
+        }
 
         sb.AppendLine($"""
             <div style="display:flex;gap:16px;margin:16px 0;flex-wrap:wrap">
-              <div style="background:#fff;border-radius:8px;padding:14px 20px;min-width:160px;box-shadow:0 1px 4px rgba(0,0,0,.1)"><div style="font-size:1.8rem;font-weight:700;color:#0078d4">{FormatSize(siteTotal0)}</div><div style="font-size:.8rem;color:#666">Total Size</div></div>
+              <div style="background:#fff;border-radius:8px;padding:14px 20px;min-width:160px;box-shadow:0 1px 4px rgba(0,0,0,.1)"><div style="font-size:1.8rem;font-weight:700;color:#0078d4">{FormatSize(siteTotal0)}</div><div style="font-size:.8rem;color:#666">{T["report.stat.total_size"]}</div></div>
-              <div style="background:#fff;border-radius:8px;padding:14px 20px;min-width:160px;box-shadow:0 1px 4px rgba(0,0,0,.1)"><div style="font-size:1.8rem;font-weight:700;color:#0078d4">{FormatSize(versionTotal0)}</div><div style="font-size:.8rem;color:#666">Version Size</div></div>
+              <div style="background:#fff;border-radius:8px;padding:14px 20px;min-width:160px;box-shadow:0 1px 4px rgba(0,0,0,.1)"><div style="font-size:1.8rem;font-weight:700;color:#0078d4">{FormatSize(versionTotal0)}</div><div style="font-size:.8rem;color:#666">{T["report.stat.version_size"]}</div></div>
-              <div style="background:#fff;border-radius:8px;padding:14px 20px;min-width:160px;box-shadow:0 1px 4px rgba(0,0,0,.1)"><div style="font-size:1.8rem;font-weight:700;color:#0078d4">{fileTotal0:N0}</div><div style="font-size:.8rem;color:#666">Files</div></div>
+              <div style="background:#fff;border-radius:8px;padding:14px 20px;min-width:160px;box-shadow:0 1px 4px rgba(0,0,0,.1)"><div style="font-size:1.8rem;font-weight:700;color:#0078d4">{fileTotal0:N0}</div><div style="font-size:.8rem;color:#666">{T["report.stat.files"]}</div></div>
             </div>
             """);
 
-        sb.AppendLine("""
+        sb.AppendLine($"""
             <table>
               <thead>
                 <tr>
-                  <th>Library / Folder</th>
+                  <th>{T["report.col.library_folder"]}</th>
-                  <th>Site</th>
+                  <th>{T["stor.col.kind"]}</th>
-                  <th class="num">Files</th>
+                  <th>{T["report.col.site"]}</th>
-                  <th class="num">Total Size</th>
+                  <th class="num">{T["report.stat.files"]}</th>
-                  <th class="num">Version Size</th>
+                  <th class="num">{T["report.stat.total_size"]}</th>
-                  <th>Last Modified</th>
+                  <th class="num">{T["report.stat.version_size"]}</th>
+                  <th>{T["report.col.last_modified"]}</th>
                 </tr>
               </thead>
               <tbody>
             """);
 
-        foreach (var node in nodes)
+        // Render only the pre-materialized root list — recursing into
+        // Children handles descendants. Iterating the flat list would render
+        // every descendant a second time as a top-level row.
+        foreach (var node in rootNodes0)
         {
             RenderNode(sb, node);
         }
@@ -93,10 +120,8 @@ public class StorageHtmlExportService
             </table>
             """);
 
-        sb.AppendLine($"<p class=\"generated\">Generated: {DateTime.Now:yyyy-MM-dd HH:mm}</p>");
+        sb.AppendLine($"<p class=\"generated\">{T["report.text.generated_colon"]} {DateTime.Now:yyyy-MM-dd HH:mm}</p>");
         sb.AppendLine("</body></html>");
-
-        return sb.ToString();
     }
 
     /// <summary>
@@ -104,16 +129,25 @@ public class StorageHtmlExportService
     /// </summary>
     public string BuildHtml(IReadOnlyList<StorageNode> nodes, IReadOnlyList<FileTypeMetric> fileTypeMetrics, ReportBranding? branding = null)
     {
-        _togIdx = 0;
+        var sb = new StringBuilder(4096 + nodes.Count * 340 + fileTypeMetrics.Count * 220);
-        var sb = new StringBuilder();
+        BuildHtmlCore(sb, nodes, fileTypeMetrics, branding);
+        return sb.ToString();
+    }
 
+    private void BuildHtmlCore(StringBuilder sb, IReadOnlyList<StorageNode> nodes, IReadOnlyList<FileTypeMetric> fileTypeMetrics, ReportBranding? branding)
+    {
+        var T = TranslationSource.Instance;
+        _togIdx = 0;
+        _kindLabels = BuildKindLabelCache();
+        _kindLabelsHtml = BuildHtmlEncodedCache(_kindLabels);
+
+        sb.AppendLine("<!DOCTYPE html>");
+        sb.AppendLine("<html lang=\"en\">");
+        sb.AppendLine("<head>");
+        sb.AppendLine("<meta charset=\"UTF-8\">");
+        sb.AppendLine("<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">");
+        sb.AppendLine($"<title>{T["report.title.storage"]}</title>");
         sb.AppendLine("""
-            <!DOCTYPE html>
-            <html lang="en">
-            <head>
-            <meta charset="UTF-8">
-            <meta name="viewport" content="width=device-width, initial-scale=1.0">
-            <title>SharePoint Storage Metrics</title>
             <style>
               body { font-family: 'Segoe UI', Arial, sans-serif; font-size: 13px; margin: 20px; background: #f5f5f5; }
               h1 { color: #0078d4; }
@@ -150,21 +184,25 @@ public class StorageHtmlExportService
             <body>
             """);
         sb.Append(BrandingHtmlHelper.BuildBrandingHeader(branding));
-        sb.AppendLine("""
+        sb.AppendLine($"<h1>{T["report.title.storage"]}</h1>");
-            <h1>SharePoint Storage Metrics</h1>
-            """);
 
-        // ── Summary cards ──
+        // ── Summary cards (single-pass aggregation) ──
-        var rootNodes = nodes.Where(n => n.IndentLevel == 0).ToList();
+        var rootNodes = new List<StorageNode>(Math.Min(nodes.Count, 64));
-        long siteTotal = rootNodes.Sum(n => n.TotalSizeBytes);
+        long siteTotal = 0, versionTotal = 0, fileTotal = 0;
-        long versionTotal = rootNodes.Sum(n => n.VersionSizeBytes);
+        foreach (var n in nodes)
-        long fileTotal = rootNodes.Sum(n => n.TotalFileCount);
+        {
+            if (n.IndentLevel != 0) continue;
+            rootNodes.Add(n);
+            siteTotal    += n.TotalSizeBytes;
+            versionTotal += n.VersionSizeBytes;
+            fileTotal    += n.TotalFileCount;
+        }
 
         sb.AppendLine("<div class=\"stats\">");
-        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{FormatSize(siteTotal)}</div><div class=\"label\">Total Size</div></div>");
+        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{FormatSize(siteTotal)}</div><div class=\"label\">{T["report.stat.total_size"]}</div></div>");
-        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{FormatSize(versionTotal)}</div><div class=\"label\">Version Size</div></div>");
+        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{FormatSize(versionTotal)}</div><div class=\"label\">{T["report.stat.version_size"]}</div></div>");
-        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{fileTotal:N0}</div><div class=\"label\">Files</div></div>");
+        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{fileTotal:N0}</div><div class=\"label\">{T["report.stat.files"]}</div></div>");
-        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{rootNodes.Count}</div><div class=\"label\">Libraries</div></div>");
+        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{rootNodes.Count}</div><div class=\"label\">{T["report.stat.libraries"]}</div></div>");
         sb.AppendLine("</div>");
 
         // ── File type chart section ──
@@ -175,7 +213,7 @@ public class StorageHtmlExportService
             var totalFiles = fileTypeMetrics.Sum(m => m.FileCount);
 
             sb.AppendLine("<div class=\"chart-section\">");
-            sb.AppendLine($"<h2>Storage by File Type ({totalFiles:N0} files, {FormatSize(totalSize)})</h2>");
+            sb.AppendLine($"<h2>{T["report.section.storage_by_file_type"]} ({totalFiles:N0} {T["report.text.files_unit"]}, {FormatSize(totalSize)})</h2>");
 
             var colors = new[] { "#0078d4", "#2b88d8", "#106ebe", "#005a9e", "#004578",
                                  "#00bcf2", "#009e49", "#8cbd18", "#ffb900", "#d83b01" };
@@ -185,13 +223,13 @@ public class StorageHtmlExportService
             {
                 double pct = maxSize > 0 ? m.TotalSizeBytes * 100.0 / maxSize : 0;
                 string color = colors[idx % colors.Length];
-                string label = string.IsNullOrEmpty(m.Extension) ? "(no ext)" : m.Extension;
+                string label = string.IsNullOrEmpty(m.Extension) ? T["report.text.no_ext"] : m.Extension;
 
                 sb.AppendLine($"""
                     <div class="bar-row">
                       <span class="bar-label">{HtmlEncode(label)}</span>
                       <div class="bar-track"><div class="bar-fill" style="width:{pct:F1}%;background:{color}"></div></div>
-                      <span class="bar-value">{FormatSize(m.TotalSizeBytes)} &middot; {m.FileCount:N0} files</span>
+                      <span class="bar-value">{FormatSize(m.TotalSizeBytes)} &middot; {m.FileCount:N0} {T["report.text.files_unit"]}</span>
                     </div>
                     """);
                 idx++;
@@ -201,23 +239,27 @@ public class StorageHtmlExportService
         }
 
         // ── Storage table ──
-        sb.AppendLine("<h2>Library Details</h2>");
+        sb.AppendLine($"<h2>{T["report.section.library_details"]}</h2>");
-        sb.AppendLine("""
+        sb.AppendLine($"""
             <table>
               <thead>
                 <tr>
-                  <th>Library / Folder</th>
+                  <th>{T["report.col.library_folder"]}</th>
-                  <th>Site</th>
+                  <th>{T["stor.col.kind"]}</th>
-                  <th class="num">Files</th>
+                  <th>{T["report.col.site"]}</th>
-                  <th class="num">Total Size</th>
+                  <th class="num">{T["report.stat.files"]}</th>
-                  <th class="num">Version Size</th>
+                  <th class="num">{T["report.stat.total_size"]}</th>
-                  <th>Last Modified</th>
+                  <th class="num">{T["report.stat.version_size"]}</th>
+                  <th>{T["report.col.last_modified"]}</th>
                 </tr>
               </thead>
               <tbody>
             """);
 
-        foreach (var node in nodes)
+        // Render only the pre-materialized root list — recursing into
+        // Children handles descendants. Iterating the flat list would render
+        // every descendant a second time as a top-level row.
+        foreach (var node in rootNodes)
         {
             RenderNode(sb, node);
         }
@@ -227,22 +269,68 @@ public class StorageHtmlExportService
             </table>
             """);
 
-        sb.AppendLine($"<p class=\"generated\">Generated: {DateTime.Now:yyyy-MM-dd HH:mm}</p>");
+        sb.AppendLine($"<p class=\"generated\">{T["report.text.generated_colon"]} {DateTime.Now:yyyy-MM-dd HH:mm}</p>");
         sb.AppendLine("</body></html>");
-
-        return sb.ToString();
     }
 
+    /// <summary>Writes the library-only HTML report to <paramref name="filePath"/>.</summary>
     public async Task WriteAsync(IReadOnlyList<StorageNode> nodes, string filePath, CancellationToken ct, ReportBranding? branding = null)
     {
-        var html = BuildHtml(nodes, branding);
+        // Build into StringBuilder, stream chunks straight to disk —
-        await File.WriteAllTextAsync(filePath, html, Encoding.UTF8, ct);
+        // skips a full-document char-array copy from sb.ToString().
+        var sb = new StringBuilder(3072 + nodes.Count * 340);
+        BuildHtmlCore(sb, nodes, branding);
+        await ExportFileWriter.WriteHtmlChunksAsync(filePath, sb, ct);
     }
 
+    /// <summary>Writes the HTML report including the file-type breakdown chart.</summary>
     public async Task WriteAsync(IReadOnlyList<StorageNode> nodes, IReadOnlyList<FileTypeMetric> fileTypeMetrics, string filePath, CancellationToken ct, ReportBranding? branding = null)
     {
-        var html = BuildHtml(nodes, fileTypeMetrics, branding);
+        var sb = new StringBuilder(4096 + nodes.Count * 340 + fileTypeMetrics.Count * 220);
-        await File.WriteAllTextAsync(filePath, html, Encoding.UTF8, ct);
+        BuildHtmlCore(sb, nodes, fileTypeMetrics, branding);
+        await ExportFileWriter.WriteHtmlChunksAsync(filePath, sb, ct);
+    }
+
+    /// <summary>
+    /// Split-aware HTML export for storage metrics.
+    /// Single → one file. BySite + SeparateFiles → one file per site.
+    /// BySite + SingleTabbed → one HTML with per-site iframe tabs. File-type
+    /// metrics are replicated across partitions because they are not
+    /// attributed per-site by the scanner.
+    /// </summary>
+    public async Task WriteAsync(
+        IReadOnlyList<StorageNode> nodes,
+        IReadOnlyList<FileTypeMetric> fileTypeMetrics,
+        string basePath,
+        ReportSplitMode splitMode,
+        HtmlSplitLayout layout,
+        CancellationToken ct,
+        ReportBranding? branding = null)
+    {
+        if (splitMode != ReportSplitMode.BySite)
+        {
+            await WriteAsync(nodes, fileTypeMetrics, basePath, ct, branding);
+            return;
+        }
+
+        var partitions = StorageCsvExportService.PartitionBySite(nodes).ToList();
+        if (layout == HtmlSplitLayout.SingleTabbed)
+        {
+            var parts = partitions
+                .Select(p => (p.Label, Html: BuildHtml(p.Partition, fileTypeMetrics, branding)))
+                .ToList();
+            var title = TranslationSource.Instance["report.title.storage"];
+            var tabbed = ReportSplitHelper.BuildTabbedHtml(parts, title);
+            await File.WriteAllTextAsync(basePath, tabbed, Encoding.UTF8, ct);
+            return;
+        }
+
+        foreach (var (label, partNodes) in partitions)
+        {
+            ct.ThrowIfCancellationRequested();
+            var path = ReportSplitHelper.BuildPartitionPath(basePath, label);
+            await WriteAsync(partNodes, fileTypeMetrics, path, ct, branding);
+        }
     }
 
     // ── Private rendering ────────────────────────────────────────────────────
@@ -256,24 +344,11 @@ public class StorageHtmlExportService
             ? $"<button class=\"toggle-btn\" onclick=\"toggle({myIdx})\">&#9654;</button>{HtmlEncode(node.Name)}"
             : $"<span style=\"margin-left:{node.IndentLevel * 16}px\">{HtmlEncode(node.Name)}</span>";
 
-        string lastMod = node.LastModified.HasValue
+        AppendRow(sb, node, nameCell);
-            ? node.LastModified.Value.ToString("yyyy-MM-dd")
-            : string.Empty;
-
-        sb.AppendLine($"""
-              <tr>
-                <td>{nameCell}</td>
-                <td>{HtmlEncode(node.SiteTitle)}</td>
-                <td class="num">{node.TotalFileCount:N0}</td>
-                <td class="num">{FormatSize(node.TotalSizeBytes)}</td>
-                <td class="num">{FormatSize(node.VersionSizeBytes)}</td>
-                <td>{lastMod}</td>
-              </tr>
-            """);
 
         if (hasChildren)
         {
-            sb.AppendLine($"<tr id=\"sf-{myIdx}\" style=\"display:none\"><td colspan=\"6\" style=\"padding:0\">");
+            sb.AppendLine($"<tr id=\"sf-{myIdx}\" style=\"display:none\"><td colspan=\"7\" style=\"padding:0\">");
             sb.AppendLine("<table class=\"sf-tbl\"><tbody>");
             foreach (var child in node.Children)
             {
@@ -294,24 +369,11 @@ public class StorageHtmlExportService
             ? $"<span style=\"{indent}\"><button class=\"toggle-btn\" onclick=\"toggle({myIdx})\">&#9654;</button>{HtmlEncode(node.Name)}</span>"
             : $"<span style=\"{indent}\">{HtmlEncode(node.Name)}</span>";
 
-        string lastMod = node.LastModified.HasValue
+        AppendRow(sb, node, nameCell);
-            ? node.LastModified.Value.ToString("yyyy-MM-dd")
-            : string.Empty;
-
-        sb.AppendLine($"""
-              <tr>
-                <td>{nameCell}</td>
-                <td>{HtmlEncode(node.SiteTitle)}</td>
-                <td class="num">{node.TotalFileCount:N0}</td>
-                <td class="num">{FormatSize(node.TotalSizeBytes)}</td>
-                <td class="num">{FormatSize(node.VersionSizeBytes)}</td>
-                <td>{lastMod}</td>
-              </tr>
-            """);
 
         if (hasChildren)
         {
-            sb.AppendLine($"<tr id=\"sf-{myIdx}\" style=\"display:none\"><td colspan=\"6\" style=\"padding:0\">");
+            sb.AppendLine($"<tr id=\"sf-{myIdx}\" style=\"display:none\"><td colspan=\"7\" style=\"padding:0\">");
             sb.AppendLine("<table class=\"sf-tbl\"><tbody>");
             foreach (var child in node.Children)
             {
@@ -322,6 +384,35 @@ public class StorageHtmlExportService
         }
     }
 
+    /// <summary>
+    /// Appends one data row given the pre-rendered name cell. Hot path:
+    /// pulls localized kind labels from <see cref="_kindLabelsHtml"/> instead
+    /// of going through <c>ResourceManager.GetString</c> + <c>HtmlEncode</c>
+    /// per row.
+    /// </summary>
+    private void AppendRow(StringBuilder sb, StorageNode node, string nameCell)
+    {
+        int kindIdx = (int)node.Kind;
+        string kindLabel = (uint)kindIdx < (uint)_kindLabelsHtml.Length
+            ? _kindLabelsHtml[kindIdx]
+            : HtmlEncode(node.Kind.ToString());
+        string lastMod = node.LastModified.HasValue
+            ? node.LastModified.Value.ToString("yyyy-MM-dd")
+            : string.Empty;
+
+        sb.AppendLine($"""
+              <tr>
+                <td>{nameCell}</td>
+                <td>{kindLabel}</td>
+                <td>{HtmlEncode(node.SiteTitle)}</td>
+                <td class="num">{node.TotalFileCount:N0}</td>
+                <td class="num">{FormatSize(node.TotalSizeBytes)}</td>
+                <td class="num">{FormatSize(node.VersionSizeBytes)}</td>
+                <td>{lastMod}</td>
+              </tr>
+            """);
+    }
+
     private static string FormatSize(long bytes)
     {
         if (bytes >= 1_073_741_824L) return $"{bytes / 1_073_741_824.0:F2} GB";
@@ -332,4 +423,43 @@ public class StorageHtmlExportService
 
     private static string HtmlEncode(string value)
         => System.Net.WebUtility.HtmlEncode(value ?? string.Empty);
+
+    private static string KindLabel(StorageNodeKind kind)
+    {
+        var T = TranslationSource.Instance;
+        return kind switch
+        {
+            StorageNodeKind.Library          => T["stor.kind.library"],
+            StorageNodeKind.HiddenLibrary    => T["stor.kind.hidden"],
+            StorageNodeKind.PreservationHold => T["stor.kind.preservation"],
+            StorageNodeKind.ListAttachments  => T["stor.kind.attachments"],
+            StorageNodeKind.RecycleBin       => T["stor.kind.recyclebin"],
+            StorageNodeKind.Subsite          => T["stor.kind.subsite"],
+            _ => kind.ToString()
+        };
+    }
+
+    /// <summary>
+    /// Pre-resolves localized labels for every <see cref="StorageNodeKind"/>
+    /// once per export. Cached array index lookup avoids
+    /// <c>ResourceManager.GetString</c> per row in hot rendering loops.
+    /// </summary>
+    private static string[] BuildKindLabelCache()
+    {
+        var values = (StorageNodeKind[])Enum.GetValues(typeof(StorageNodeKind));
+        int max = 0;
+        foreach (var v in values) { int i = (int)v; if (i > max) max = i; }
+        var cache = new string[max + 1];
+        for (int i = 0; i < cache.Length; i++) cache[i] = ((StorageNodeKind)i).ToString();
+        foreach (var v in values) cache[(int)v] = KindLabel(v);
+        return cache;
+    }
+
+    /// <summary>HTML-encodes each entry of <paramref name="raw"/> once.</summary>
+    private static string[] BuildHtmlEncodedCache(string[] raw)
+    {
+        var encoded = new string[raw.Length];
+        for (int i = 0; i < raw.Length; i++) encoded[i] = HtmlEncode(raw[i]);
+        return encoded;
+    }
 }

SharepointToolbox/Services/Export/UserAccessCsvExportService.cs

@@ -2,6 +2,7 @@ using System.IO;
 using System.Text;
 using SharepointToolbox.Core.Helpers;
 using SharepointToolbox.Core.Models;
+using SharepointToolbox.Localization;
 
 namespace SharepointToolbox.Services.Export;
 
@@ -11,8 +12,11 @@ namespace SharepointToolbox.Services.Export;
 /// </summary>
 public class UserAccessCsvExportService
 {
-    private const string DataHeader =
+    private static string BuildDataHeader()
-        "\"Site\",\"Object Type\",\"Object\",\"URL\",\"Permission Level\",\"Access Type\",\"Granted Through\"";
+    {
+        var T = TranslationSource.Instance;
+        return $"\"{T["report.col.site"]}\",\"{T["report.col.object_type"]}\",\"{T["report.col.object"]}\",\"{T["report.col.url"]}\",\"{T["report.col.permission_level"]}\",\"{T["report.col.access_type"]}\",\"{T["report.col.granted_through"]}\"";
+    }
 
     /// <summary>
     /// Builds a CSV string for a single user's access entries.
@@ -20,22 +24,23 @@ public class UserAccessCsvExportService
     /// </summary>
     public string BuildCsv(string userDisplayName, string userLogin, IReadOnlyList<UserAccessEntry> entries)
     {
+        var T = TranslationSource.Instance;
         var sb = new StringBuilder();
 
         // Summary section
         var sitesCount = entries.Select(e => e.SiteUrl).Distinct().Count();
         var highPrivCount = entries.Count(e => e.IsHighPrivilege);
 
-        sb.AppendLine($"\"User Access Audit Report\"");
+        sb.AppendLine($"\"{T["report.title.user_access"]}\"");
-        sb.AppendLine($"\"User\",\"{Csv(userDisplayName)} ({Csv(userLogin)})\"");
+        sb.AppendLine($"\"{T["report.col.user"]}\",\"{Csv(userDisplayName)} ({Csv(userLogin)})\"");
-        sb.AppendLine($"\"Total Accesses\",\"{entries.Count}\"");
+        sb.AppendLine($"\"{T["report.stat.total_accesses"]}\",\"{entries.Count}\"");
-        sb.AppendLine($"\"Sites\",\"{sitesCount}\"");
+        sb.AppendLine($"\"{T["report.col.sites"]}\",\"{sitesCount}\"");
-        sb.AppendLine($"\"High Privilege\",\"{highPrivCount}\"");
+        sb.AppendLine($"\"{T["report.stat.high_privilege"]}\",\"{highPrivCount}\"");
-        sb.AppendLine($"\"Generated\",\"{DateTime.Now:yyyy-MM-dd HH:mm:ss}\"");
+        sb.AppendLine($"\"{T["report.text.generated"]}\",\"{DateTime.Now:yyyy-MM-dd HH:mm:ss}\"");
         sb.AppendLine(); // Blank line separating summary from data
 
         // Data rows
-        sb.AppendLine(DataHeader);
+        sb.AppendLine(BuildDataHeader());
         foreach (var entry in entries)
         {
             sb.AppendLine(string.Join(",", new[]
@@ -82,8 +87,69 @@ public class UserAccessCsvExportService
             var filePath = Path.Combine(directoryPath, fileName);
 
             var csv = BuildCsv(displayName, userLogin, entries);
-            await File.WriteAllTextAsync(filePath, csv,
+            await ExportFileWriter.WriteCsvAsync(filePath, csv, ct);
-                new UTF8Encoding(encoderShouldEmitUTF8Identifier: true), ct);
+        }
+    }
+
+    /// <summary>
+    /// Writes all entries split per site. File naming: "{base}_{siteLabel}.csv".
+    /// </summary>
+    public async Task WriteBySiteAsync(
+        IReadOnlyList<UserAccessEntry> allEntries,
+        string basePath,
+        CancellationToken ct,
+        bool mergePermissions = false)
+    {
+        foreach (var group in allEntries.GroupBy(e => (e.SiteUrl, e.SiteTitle)))
+        {
+            ct.ThrowIfCancellationRequested();
+            var label = ReportSplitHelper.DeriveSiteLabel(group.Key.SiteUrl, group.Key.SiteTitle);
+            var path = ReportSplitHelper.BuildPartitionPath(basePath, label);
+            await WriteSingleFileAsync(group.ToList(), path, ct, mergePermissions);
+        }
+    }
+
+    /// <summary>
+    /// Split-aware export dispatcher.
+    /// Single → one file at <paramref name="basePath"/>.
+    /// BySite → one file per site. ByUser → one file per user.
+    /// </summary>
+    public async Task WriteAsync(
+        IReadOnlyList<UserAccessEntry> allEntries,
+        string basePath,
+        ReportSplitMode splitMode,
+        CancellationToken ct,
+        bool mergePermissions = false)
+    {
+        switch (splitMode)
+        {
+            case ReportSplitMode.Single:
+                await WriteSingleFileAsync(allEntries, basePath, ct, mergePermissions);
+                break;
+            case ReportSplitMode.BySite:
+                await WriteBySiteAsync(allEntries, basePath, ct, mergePermissions);
+                break;
+            case ReportSplitMode.ByUser:
+                await WriteByUserAsync(allEntries, basePath, ct, mergePermissions);
+                break;
+        }
+    }
+
+    /// <summary>
+    /// Writes one CSV per user using <paramref name="basePath"/> as a filename template.
+    /// </summary>
+    public async Task WriteByUserAsync(
+        IReadOnlyList<UserAccessEntry> allEntries,
+        string basePath,
+        CancellationToken ct,
+        bool mergePermissions = false)
+    {
+        foreach (var group in allEntries.GroupBy(e => e.UserLogin))
+        {
+            ct.ThrowIfCancellationRequested();
+            var label = ReportSplitHelper.SanitizeFileName(group.Key);
+            var path = ReportSplitHelper.BuildPartitionPath(basePath, label);
+            await WriteSingleFileAsync(group.ToList(), path, ct, mergePermissions);
         }
     }
 
@@ -99,20 +165,21 @@ public class UserAccessCsvExportService
         CancellationToken ct,
         bool mergePermissions = false)
     {
+        var T = TranslationSource.Instance;
         if (mergePermissions)
         {
             var consolidated = PermissionConsolidator.Consolidate(entries);
             var sb = new StringBuilder();
 
             // Summary section
-            sb.AppendLine("\"User Access Audit Report (Consolidated)\"");
+            sb.AppendLine($"\"{T["report.title.user_access_consolidated"]}\"");
-            sb.AppendLine($"\"Users Audited\",\"{consolidated.Select(e => e.UserLogin).Distinct().Count()}\"");
+            sb.AppendLine($"\"{T["report.stat.users_audited"]}\",\"{consolidated.Select(e => e.UserLogin).Distinct().Count()}\"");
-            sb.AppendLine($"\"Total Entries\",\"{consolidated.Count}\"");
+            sb.AppendLine($"\"{T["report.stat.total_entries"]}\",\"{consolidated.Count}\"");
-            sb.AppendLine($"\"Generated\",\"{DateTime.Now:yyyy-MM-dd HH:mm:ss}\"");
+            sb.AppendLine($"\"{T["report.text.generated"]}\",\"{DateTime.Now:yyyy-MM-dd HH:mm:ss}\"");
             sb.AppendLine();
 
             // Header
-            sb.AppendLine("\"User\",\"User Login\",\"Permission Level\",\"Access Type\",\"Granted Through\",\"Locations\",\"Location Count\"");
+            sb.AppendLine($"\"{T["report.col.user"]}\",\"User Login\",\"{T["report.col.permission_level"]}\",\"{T["report.col.access_type"]}\",\"{T["report.col.granted_through"]}\",\"Locations\",\"Location Count\"");
 
             // Data rows
             foreach (var entry in consolidated)
@@ -136,14 +203,14 @@ public class UserAccessCsvExportService
 
         {
         var sb = new StringBuilder();
-        var fullHeader = "\"User\",\"User Login\"," + DataHeader;
+        var fullHeader = $"\"{T["report.col.user"]}\",\"User Login\"," + BuildDataHeader();
 
         // Summary
         var users = entries.Select(e => e.UserLogin).Distinct().ToList();
-        sb.AppendLine($"\"User Access Audit Report\"");
+        sb.AppendLine($"\"{T["report.title.user_access"]}\"");
-        sb.AppendLine($"\"Users Audited\",\"{users.Count}\"");
+        sb.AppendLine($"\"{T["report.stat.users_audited"]}\",\"{users.Count}\"");
-        sb.AppendLine($"\"Total Accesses\",\"{entries.Count}\"");
+        sb.AppendLine($"\"{T["report.stat.total_accesses"]}\",\"{entries.Count}\"");
-        sb.AppendLine($"\"Generated\",\"{DateTime.Now:yyyy-MM-dd HH:mm:ss}\"");
+        sb.AppendLine($"\"{T["report.text.generated"]}\",\"{DateTime.Now:yyyy-MM-dd HH:mm:ss}\"");
         sb.AppendLine();
 
         sb.AppendLine(fullHeader);
@@ -163,17 +230,12 @@ public class UserAccessCsvExportService
             }));
         }
 
-        await File.WriteAllTextAsync(filePath, sb.ToString(),
+        await ExportFileWriter.WriteCsvAsync(filePath, sb.ToString(), ct);
-            new UTF8Encoding(encoderShouldEmitUTF8Identifier: true), ct);
         }
     }
 
-    /// <summary>RFC 4180 CSV field escaping: wrap in double quotes, double internal quotes.</summary>
+    /// <summary>RFC 4180 CSV field escaping with formula-injection guard.</summary>
-    private static string Csv(string value)
+    private static string Csv(string value) => CsvSanitizer.Escape(value);
-    {
-        if (string.IsNullOrEmpty(value)) return "\"\"";
-        return $"\"{value.Replace("\"", "\"\"")}\"";
-    }
 
     private static string SanitizeFileName(string name)
     {

SharepointToolbox/Services/Export/UserAccessHtmlExportService.cs

@@ -2,6 +2,7 @@ using System.IO;
 using System.Text;
 using SharepointToolbox.Core.Helpers;
 using SharepointToolbox.Core.Models;
+using SharepointToolbox.Localization;
 
 namespace SharepointToolbox.Services.Export;
 
@@ -18,6 +19,70 @@ public class UserAccessHtmlExportService
     /// When <paramref name="mergePermissions"/> is true, renders a consolidated by-user
     /// report with an expandable Sites column instead of the dual by-user/by-site view.
     /// </summary>
+    /// <summary>
+    /// Split-aware HTML export. Single → one file.
+    /// BySite/ByUser + SeparateFiles → one file per site/user.
+    /// BySite/ByUser + SingleTabbed → one file with per-partition iframe tabs.
+    /// </summary>
+    public async Task WriteAsync(
+        IReadOnlyList<UserAccessEntry> entries,
+        string basePath,
+        ReportSplitMode splitMode,
+        HtmlSplitLayout layout,
+        CancellationToken ct,
+        bool mergePermissions = false,
+        ReportBranding? branding = null)
+    {
+        if (splitMode == ReportSplitMode.Single)
+        {
+            await WriteAsync(entries, basePath, ct, mergePermissions, branding);
+            return;
+        }
+
+        IEnumerable<(string Label, IReadOnlyList<UserAccessEntry> Entries)> partitions;
+        if (splitMode == ReportSplitMode.BySite)
+        {
+            partitions = entries
+                .GroupBy(e => (e.SiteUrl, e.SiteTitle))
+                .Select(g => (
+                    Label: ReportSplitHelper.DeriveSiteLabel(g.Key.SiteUrl, g.Key.SiteTitle),
+                    Entries: (IReadOnlyList<UserAccessEntry>)g.ToList()));
+        }
+        else // ByUser
+        {
+            partitions = entries
+                .GroupBy(e => e.UserLogin)
+                .Select(g => (
+                    Label: ReportSplitHelper.SanitizeFileName(g.Key),
+                    Entries: (IReadOnlyList<UserAccessEntry>)g.ToList()));
+        }
+
+        var partList = partitions.ToList();
+        if (layout == HtmlSplitLayout.SingleTabbed)
+        {
+            var parts = partList
+                .Select(p => (p.Label, Html: BuildHtml(p.Entries, mergePermissions, branding)))
+                .ToList();
+            var title = TranslationSource.Instance["report.title.user_access"];
+            var tabbed = ReportSplitHelper.BuildTabbedHtml(parts, title);
+            await ExportFileWriter.WriteHtmlAsync(basePath, tabbed, ct);
+            return;
+        }
+
+        foreach (var (label, partEntries) in partList)
+        {
+            ct.ThrowIfCancellationRequested();
+            var path = ReportSplitHelper.BuildPartitionPath(basePath, label);
+            await WriteAsync(partEntries, path, ct, mergePermissions, branding);
+        }
+    }
+
+    /// <summary>
+    /// Builds the user-access HTML report. Default layout is a per-entry
+    /// grouped-by-user table; when <paramref name="mergePermissions"/> is true
+    /// entries are consolidated via <see cref="PermissionConsolidator"/> into
+    /// a single-row-per-user format with a Locations column.
+    /// </summary>
     public string BuildHtml(IReadOnlyList<UserAccessEntry> entries, bool mergePermissions = false, ReportBranding? branding = null)
     {
         if (mergePermissions)
@@ -26,6 +91,8 @@ public class UserAccessHtmlExportService
             return BuildConsolidatedHtml(consolidated, entries, branding);
         }
 
+        var T = TranslationSource.Instance;
+
         // Compute stats
         var totalAccesses    = entries.Count;
         var usersAudited     = entries.Select(e => e.UserLogin).Distinct().Count();
@@ -41,7 +108,7 @@ public class UserAccessHtmlExportService
         sb.AppendLine("<head>");
         sb.AppendLine("<meta charset=\"UTF-8\">");
         sb.AppendLine("<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">");
-        sb.AppendLine("<title>User Access Audit Report</title>");
+        sb.AppendLine($"<title>{T["report.title.user_access"]}</title>");
         sb.AppendLine("<style>");
         sb.AppendLine(@"
 * { box-sizing: border-box; margin: 0; padding: 0; }
@@ -98,15 +165,15 @@ a:hover { text-decoration: underline; }
         // ── BODY ───────────────────────────────────────────────────────────────
         sb.AppendLine("<body>");
         sb.Append(BrandingHtmlHelper.BuildBrandingHeader(branding));
-        sb.AppendLine("<h1>User Access Audit Report</h1>");
+        sb.AppendLine($"<h1>{T["report.title.user_access"]}</h1>");
 
         // Stats cards
         sb.AppendLine("<div class=\"stats\">");
-        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{totalAccesses}</div><div class=\"label\">Total Accesses</div></div>");
+        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{totalAccesses}</div><div class=\"label\">{T["report.stat.total_accesses"]}</div></div>");
-        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{usersAudited}</div><div class=\"label\">Users Audited</div></div>");
+        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{usersAudited}</div><div class=\"label\">{T["report.stat.users_audited"]}</div></div>");
-        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{sitesScanned}</div><div class=\"label\">Sites Scanned</div></div>");
+        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{sitesScanned}</div><div class=\"label\">{T["report.stat.sites_scanned"]}</div></div>");
-        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{highPrivCount}</div><div class=\"label\">High Privilege</div></div>");
+        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{highPrivCount}</div><div class=\"label\">{T["report.stat.high_privilege"]}</div></div>");
-        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{externalCount}</div><div class=\"label\">External Users</div></div>");
+        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{externalCount}</div><div class=\"label\">{T["report.stat.external_users"]}</div></div>");
         sb.AppendLine("</div>");
 
         // Per-user summary cards
@@ -123,34 +190,34 @@ a:hover { text-decoration: underline; }
             var cardClass = uHighPriv > 0 ? "user-card has-high-priv" : "user-card";
 
             sb.AppendLine($"  <div class=\"{cardClass}\">");
-            sb.AppendLine($"    <div class=\"user-name\">{uName}{(uIsExt ? " <span class=\"guest-badge\">Guest</span>" : "")}</div>");
+            sb.AppendLine($"    <div class=\"user-name\">{uName}{(uIsExt ? $" <span class=\"guest-badge\">{T["report.badge.guest"]}</span>" : "")}</div>");
             sb.AppendLine($"    <div class=\"user-stats\">{uLogin}</div>");
-            sb.AppendLine($"    <div class=\"user-stats\">{uTotal} accesses &bull; {uSites} site(s){(uHighPriv > 0 ? $" &bull; <span style=\"color:#dc2626\">{uHighPriv} high-priv</span>" : "")}</div>");
+            sb.AppendLine($"    <div class=\"user-stats\">{uTotal} {T["report.text.accesses"]} &bull; {uSites} {T["report.text.sites_parens"]}{(uHighPriv > 0 ? $" &bull; <span style=\"color:#dc2626\">{uHighPriv} {T["report.text.high_priv"]}</span>" : "")}</div>");
             sb.AppendLine("  </div>");
         }
         sb.AppendLine("</div>");
 
         // View toggle buttons
         sb.AppendLine("<div class=\"view-toggle\">");
-        sb.AppendLine("  <button id=\"btn-user\" class=\"active\" onclick=\"toggleView('user')\">By User</button>");
+        sb.AppendLine($"  <button id=\"btn-user\" class=\"active\" onclick=\"toggleView('user')\">{T["report.view.by_user"]}</button>");
-        sb.AppendLine("  <button id=\"btn-site\" onclick=\"toggleView('site')\">By Site</button>");
+        sb.AppendLine($"  <button id=\"btn-site\" onclick=\"toggleView('site')\">{T["report.view.by_site"]}</button>");
         sb.AppendLine("</div>");
 
         // Filter input
         sb.AppendLine("<div class=\"filter-wrap\">");
-        sb.AppendLine("  <input type=\"text\" id=\"filter\" placeholder=\"Filter results...\" oninput=\"filterTable()\" />");
+        sb.AppendLine($"  <input type=\"text\" id=\"filter\" placeholder=\"{T["report.filter.placeholder_results"]}\" oninput=\"filterTable()\" />");
         sb.AppendLine("</div>");
 
         // ── BY-USER VIEW ───────────────────────────────────────────────────────
         sb.AppendLine("<div id=\"view-user\" class=\"table-wrap\">");
         sb.AppendLine("<table id=\"tbl-user\">");
         sb.AppendLine("<thead><tr>");
-        sb.AppendLine("  <th onclick=\"sortTable('user',0)\">Site</th>");
+        sb.AppendLine($"  <th onclick=\"sortTable('user',0)\">{T["report.col.site"]}</th>");
-        sb.AppendLine("  <th onclick=\"sortTable('user',1)\">Object Type</th>");
+        sb.AppendLine($"  <th onclick=\"sortTable('user',1)\">{T["report.col.object_type"]}</th>");
-        sb.AppendLine("  <th onclick=\"sortTable('user',2)\">Object</th>");
+        sb.AppendLine($"  <th onclick=\"sortTable('user',2)\">{T["report.col.object"]}</th>");
-        sb.AppendLine("  <th onclick=\"sortTable('user',3)\">Permission Level</th>");
+        sb.AppendLine($"  <th onclick=\"sortTable('user',3)\">{T["report.col.permission_level"]}</th>");
-        sb.AppendLine("  <th onclick=\"sortTable('user',4)\">Access Type</th>");
+        sb.AppendLine($"  <th onclick=\"sortTable('user',4)\">{T["report.col.access_type"]}</th>");
-        sb.AppendLine("  <th onclick=\"sortTable('user',5)\">Granted Through</th>");
+        sb.AppendLine($"  <th onclick=\"sortTable('user',5)\">{T["report.col.granted_through"]}</th>");
         sb.AppendLine("</tr></thead>");
         sb.AppendLine("<tbody id=\"tbody-user\">");
 
@@ -161,10 +228,10 @@ a:hover { text-decoration: underline; }
             var uName    = HtmlEncode(ug.First().UserDisplayName);
             var uIsExt   = ug.First().IsExternalUser;
             var uCount   = ug.Count();
-            var guestBadge = uIsExt ? " <span class=\"guest-badge\">Guest</span>" : "";
+            var guestBadge = uIsExt ? $" <span class=\"guest-badge\">{T["report.badge.guest"]}</span>" : "";
 
             sb.AppendLine($"<tr class=\"group-header\" onclick=\"toggleGroup('{groupId}')\">");
-            sb.AppendLine($"  <td colspan=\"6\">{uName}{guestBadge} &mdash; {uCount} access(es)</td>");
+            sb.AppendLine($"  <td colspan=\"6\">{uName}{guestBadge} &mdash; {uCount} {T["report.text.access_es"]}</td>");
             sb.AppendLine("</tr>");
 
             foreach (var entry in ug)
@@ -173,10 +240,14 @@ a:hover { text-decoration: underline; }
                 var accessBadge = AccessTypeBadge(entry.AccessType);
                 var highIcon   = entry.IsHighPrivilege ? " &#9888;" : "";
 
+                var objectCell = IsRedundantObjectTitle(entry.SiteTitle, entry.ObjectTitle)
+                    ? "&mdash;"
+                    : HtmlEncode(entry.ObjectTitle);
+
                 sb.AppendLine($"<tr data-group=\"{groupId}\">");
                 sb.AppendLine($"  <td{rowClass}>{HtmlEncode(entry.SiteTitle)}</td>");
                 sb.AppendLine($"  <td>{HtmlEncode(entry.ObjectType)}</td>");
-                sb.AppendLine($"  <td>{HtmlEncode(entry.ObjectTitle)}</td>");
+                sb.AppendLine($"  <td>{objectCell}</td>");
                 sb.AppendLine($"  <td{rowClass}>{HtmlEncode(entry.PermissionLevel)}{highIcon}</td>");
                 sb.AppendLine($"  <td>{accessBadge}</td>");
                 sb.AppendLine($"  <td>{HtmlEncode(entry.GrantedThrough)}</td>");
@@ -192,12 +263,12 @@ a:hover { text-decoration: underline; }
         sb.AppendLine("<div id=\"view-site\" class=\"table-wrap hidden\">");
         sb.AppendLine("<table id=\"tbl-site\">");
         sb.AppendLine("<thead><tr>");
-        sb.AppendLine("  <th onclick=\"sortTable('site',0)\">User</th>");
+        sb.AppendLine($"  <th onclick=\"sortTable('site',0)\">{T["report.col.user"]}</th>");
-        sb.AppendLine("  <th onclick=\"sortTable('site',1)\">Object Type</th>");
+        sb.AppendLine($"  <th onclick=\"sortTable('site',1)\">{T["report.col.object_type"]}</th>");
-        sb.AppendLine("  <th onclick=\"sortTable('site',2)\">Object</th>");
+        sb.AppendLine($"  <th onclick=\"sortTable('site',2)\">{T["report.col.object"]}</th>");
-        sb.AppendLine("  <th onclick=\"sortTable('site',3)\">Permission Level</th>");
+        sb.AppendLine($"  <th onclick=\"sortTable('site',3)\">{T["report.col.permission_level"]}</th>");
-        sb.AppendLine("  <th onclick=\"sortTable('site',4)\">Access Type</th>");
+        sb.AppendLine($"  <th onclick=\"sortTable('site',4)\">{T["report.col.access_type"]}</th>");
-        sb.AppendLine("  <th onclick=\"sortTable('site',5)\">Granted Through</th>");
+        sb.AppendLine($"  <th onclick=\"sortTable('site',5)\">{T["report.col.granted_through"]}</th>");
         sb.AppendLine("</tr></thead>");
         sb.AppendLine("<tbody id=\"tbody-site\">");
 
@@ -210,7 +281,7 @@ a:hover { text-decoration: underline; }
             var sCount    = sg.Count();
 
             sb.AppendLine($"<tr class=\"group-header\" onclick=\"toggleGroup('{groupId}')\">");
-            sb.AppendLine($"  <td colspan=\"6\">{siteTitle} &mdash; {sCount} access(es)</td>");
+            sb.AppendLine($"  <td colspan=\"6\">{siteTitle} &mdash; {sCount} {T["report.text.access_es"]}</td>");
             sb.AppendLine("</tr>");
 
             foreach (var entry in sg)
@@ -218,12 +289,16 @@ a:hover { text-decoration: underline; }
                 var rowClass   = entry.IsHighPrivilege ? " class=\"high-priv\"" : "";
                 var accessBadge = AccessTypeBadge(entry.AccessType);
                 var highIcon   = entry.IsHighPrivilege ? " &#9888;" : "";
-                var guestBadge = entry.IsExternalUser ? " <span class=\"guest-badge\">Guest</span>" : "";
+                var guestBadge = entry.IsExternalUser ? $" <span class=\"guest-badge\">{T["report.badge.guest"]}</span>" : "";
+
+                var objectCell = IsRedundantObjectTitle(entry.SiteTitle, entry.ObjectTitle)
+                    ? "&mdash;"
+                    : HtmlEncode(entry.ObjectTitle);
 
                 sb.AppendLine($"<tr data-group=\"{groupId}\">");
                 sb.AppendLine($"  <td>{HtmlEncode(entry.UserDisplayName)}{guestBadge}</td>");
                 sb.AppendLine($"  <td>{HtmlEncode(entry.ObjectType)}</td>");
-                sb.AppendLine($"  <td>{HtmlEncode(entry.ObjectTitle)}</td>");
+                sb.AppendLine($"  <td>{objectCell}</td>");
                 sb.AppendLine($"  <td{rowClass}>{HtmlEncode(entry.PermissionLevel)}{highIcon}</td>");
                 sb.AppendLine($"  <td>{accessBadge}</td>");
                 sb.AppendLine($"  <td>{HtmlEncode(entry.GrantedThrough)}</td>");
@@ -333,7 +408,7 @@ function sortTable(view, col) {
     public async Task WriteAsync(IReadOnlyList<UserAccessEntry> entries, string filePath, CancellationToken ct, bool mergePermissions = false, ReportBranding? branding = null)
     {
         var html = BuildHtml(entries, mergePermissions, branding);
-        await File.WriteAllTextAsync(filePath, html, new UTF8Encoding(encoderShouldEmitUTF8Identifier: false), ct);
+        await ExportFileWriter.WriteHtmlAsync(filePath, html, ct);
     }
 
     /// <summary>
@@ -345,6 +420,8 @@ function sortTable(view, col) {
         IReadOnlyList<UserAccessEntry> entries,
         ReportBranding? branding)
     {
+        var T = TranslationSource.Instance;
+
         // Stats computed from the original flat list for accurate counts
         var totalAccesses = entries.Count;
         var usersAudited  = entries.Select(e => e.UserLogin).Distinct().Count();
@@ -360,7 +437,7 @@ function sortTable(view, col) {
         sb.AppendLine("<head>");
         sb.AppendLine("<meta charset=\"UTF-8\">");
         sb.AppendLine("<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">");
-        sb.AppendLine("<title>User Access Audit Report</title>");
+        sb.AppendLine($"<title>{T["report.title.user_access_consolidated"]}</title>");
         sb.AppendLine("<style>");
         sb.AppendLine(@"
 * { box-sizing: border-box; margin: 0; padding: 0; }
@@ -417,15 +494,15 @@ a:hover { text-decoration: underline; }
         // ── BODY ───────────────────────────────────────────────────────────────
         sb.AppendLine("<body>");
         sb.Append(BrandingHtmlHelper.BuildBrandingHeader(branding));
-        sb.AppendLine("<h1>User Access Audit Report</h1>");
+        sb.AppendLine($"<h1>{T["report.title.user_access_consolidated"]}</h1>");
 
         // Stats cards
         sb.AppendLine("<div class=\"stats\">");
-        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{totalAccesses}</div><div class=\"label\">Total Accesses</div></div>");
+        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{totalAccesses}</div><div class=\"label\">{T["report.stat.total_accesses"]}</div></div>");
-        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{usersAudited}</div><div class=\"label\">Users Audited</div></div>");
+        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{usersAudited}</div><div class=\"label\">{T["report.stat.users_audited"]}</div></div>");
-        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{sitesScanned}</div><div class=\"label\">Sites Scanned</div></div>");
+        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{sitesScanned}</div><div class=\"label\">{T["report.stat.sites_scanned"]}</div></div>");
-        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{highPrivCount}</div><div class=\"label\">High Privilege</div></div>");
+        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{highPrivCount}</div><div class=\"label\">{T["report.stat.high_privilege"]}</div></div>");
-        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{externalCount}</div><div class=\"label\">External Users</div></div>");
+        sb.AppendLine($"  <div class=\"stat-card\"><div class=\"value\">{externalCount}</div><div class=\"label\">{T["report.stat.external_users"]}</div></div>");
         sb.AppendLine("</div>");
 
         // Per-user summary cards (from original flat entries)
@@ -442,32 +519,32 @@ a:hover { text-decoration: underline; }
             var cardClass = uHighPriv > 0 ? "user-card has-high-priv" : "user-card";
 
             sb.AppendLine($"  <div class=\"{cardClass}\">");
-            sb.AppendLine($"    <div class=\"user-name\">{uName}{(uIsExt ? " <span class=\"guest-badge\">Guest</span>" : "")}</div>");
+            sb.AppendLine($"    <div class=\"user-name\">{uName}{(uIsExt ? $" <span class=\"guest-badge\">{T["report.badge.guest"]}</span>" : "")}</div>");
             sb.AppendLine($"    <div class=\"user-stats\">{uLogin}</div>");
-            sb.AppendLine($"    <div class=\"user-stats\">{uTotal} accesses &bull; {uSites} site(s){(uHighPriv > 0 ? $" &bull; <span style=\"color:#dc2626\">{uHighPriv} high-priv</span>" : "")}</div>");
+            sb.AppendLine($"    <div class=\"user-stats\">{uTotal} {T["report.text.accesses"]} &bull; {uSites} {T["report.text.sites_parens"]}{(uHighPriv > 0 ? $" &bull; <span style=\"color:#dc2626\">{uHighPriv} {T["report.text.high_priv"]}</span>" : "")}</div>");
             sb.AppendLine("  </div>");
         }
         sb.AppendLine("</div>");
 
         // View toggle — only By User (By Site is suppressed for consolidated view)
         sb.AppendLine("<div class=\"view-toggle\">");
-        sb.AppendLine("  <button id=\"btn-user\" class=\"active\">By User</button>");
+        sb.AppendLine($"  <button id=\"btn-user\" class=\"active\">{T["report.view.by_user"]}</button>");
         sb.AppendLine("</div>");
 
         // Filter input
         sb.AppendLine("<div class=\"filter-wrap\">");
-        sb.AppendLine("  <input type=\"text\" id=\"filter\" placeholder=\"Filter results...\" oninput=\"filterTable()\" />");
+        sb.AppendLine($"  <input type=\"text\" id=\"filter\" placeholder=\"{T["report.filter.placeholder_results"]}\" oninput=\"filterTable()\" />");
         sb.AppendLine("</div>");
 
         // ── CONSOLIDATED BY-USER TABLE ────────────────────────────────────────
         sb.AppendLine("<div id=\"view-user\" class=\"table-wrap\">");
         sb.AppendLine("<table id=\"tbl-user\">");
         sb.AppendLine("<thead><tr>");
-        sb.AppendLine("  <th>User</th>");
+        sb.AppendLine($"  <th>{T["report.col.user"]}</th>");
-        sb.AppendLine("  <th>Permission Level</th>");
+        sb.AppendLine($"  <th>{T["report.col.permission_level"]}</th>");
-        sb.AppendLine("  <th>Access Type</th>");
+        sb.AppendLine($"  <th>{T["report.col.access_type"]}</th>");
-        sb.AppendLine("  <th>Granted Through</th>");
+        sb.AppendLine($"  <th>{T["report.col.granted_through"]}</th>");
-        sb.AppendLine("  <th>Sites</th>");
+        sb.AppendLine($"  <th>{T["report.col.sites"]}</th>");
         sb.AppendLine("</tr></thead>");
         sb.AppendLine("<tbody id=\"tbody-user\">");
 
@@ -486,10 +563,10 @@ a:hover { text-decoration: underline; }
             var cuName     = HtmlEncode(cug.First().UserDisplayName);
             var cuIsExt    = cug.First().IsExternalUser;
             var cuCount    = cug.Count();
-            var guestBadge = cuIsExt ? " <span class=\"guest-badge\">Guest</span>" : "";
+            var guestBadge = cuIsExt ? $" <span class=\"guest-badge\">{T["report.badge.guest"]}</span>" : "";
 
             sb.AppendLine($"<tr class=\"group-header\" onclick=\"toggleGroup('{groupId}')\">");
-            sb.AppendLine($"  <td colspan=\"5\">{cuName}{guestBadge} &mdash; {cuCount} permission(s)</td>");
+            sb.AppendLine($"  <td colspan=\"5\">{cuName}{guestBadge} &mdash; {cuCount} {T["report.text.permissions_parens"]}</td>");
             sb.AppendLine("</tr>");
 
             foreach (var entry in cug)
@@ -508,7 +585,7 @@ a:hover { text-decoration: underline; }
                 {
                     // Single location — inline site title + object title
                     var loc0 = entry.Locations[0];
-                    var locLabel = string.IsNullOrEmpty(loc0.ObjectTitle)
+                    var locLabel = IsRedundantObjectTitle(loc0.SiteTitle, loc0.ObjectTitle)
                         ? HtmlEncode(loc0.SiteTitle)
                         : $"{HtmlEncode(loc0.SiteTitle)} &rsaquo; {HtmlEncode(loc0.ObjectTitle)}";
                     sb.AppendLine($"  <td>{locLabel}</td>");
@@ -518,13 +595,13 @@ a:hover { text-decoration: underline; }
                 {
                     // Multiple locations — expandable badge
                     var currentLocId = $"loc{locIdx++}";
-                    sb.AppendLine($"  <td><span class=\"badge\" onclick=\"toggleGroup('{currentLocId}')\" style=\"cursor:pointer\">{entry.LocationCount} sites</span></td>");
+                    sb.AppendLine($"  <td><span class=\"badge\" onclick=\"toggleGroup('{currentLocId}')\" style=\"cursor:pointer\">{entry.LocationCount} {TranslationSource.Instance["report.text.sites_unit"]}</span></td>");
                     sb.AppendLine("</tr>");
 
                     // Hidden sub-rows — one per location
                     foreach (var loc in entry.Locations)
                     {
-                        var subLabel = string.IsNullOrEmpty(loc.ObjectTitle)
+                        var subLabel = IsRedundantObjectTitle(loc.SiteTitle, loc.ObjectTitle)
                             ? $"<a href=\"{HtmlEncode(loc.SiteUrl)}\">{HtmlEncode(loc.SiteTitle)}</a>"
                             : $"<a href=\"{HtmlEncode(loc.SiteUrl)}\">{HtmlEncode(loc.SiteTitle)}</a> &rsaquo; {HtmlEncode(loc.ObjectTitle)}";
                         sb.AppendLine($"<tr data-group=\"{currentLocId}\" style=\"display:none\">");
@@ -591,13 +668,31 @@ function toggleGroup(id) {
     }
 
     /// <summary>Returns a colored badge span for the given access type.</summary>
-    private static string AccessTypeBadge(AccessType accessType) => accessType switch
+    private static string AccessTypeBadge(AccessType accessType)
     {
-        AccessType.Direct    => "<span class=\"badge access-direct\">Direct</span>",
+        var T = TranslationSource.Instance;
-        AccessType.Group     => "<span class=\"badge access-group\">Group</span>",
+        return accessType switch
-        AccessType.Inherited => "<span class=\"badge access-inherited\">Inherited</span>",
+        {
-        _                    => $"<span class=\"badge\">{HtmlEncode(accessType.ToString())}</span>"
+            AccessType.Direct    => $"<span class=\"badge access-direct\">{T["report.badge.direct"]}</span>",
-    };
+            AccessType.Group     => $"<span class=\"badge access-group\">{T["report.badge.group"]}</span>",
+            AccessType.Inherited => $"<span class=\"badge access-inherited\">{T["report.badge.inherited"]}</span>",
+            _                    => $"<span class=\"badge\">{HtmlEncode(accessType.ToString())}</span>"
+        };
+    }
+
+    /// <summary>
+    /// Returns true when the ObjectTitle adds no information beyond the SiteTitle:
+    /// empty, identical (case-insensitive), or one is a whitespace-trimmed duplicate
+    /// of the other. Used to collapse "All Company &rsaquo; All Company" to "All Company".
+    /// </summary>
+    private static bool IsRedundantObjectTitle(string siteTitle, string objectTitle)
+    {
+        if (string.IsNullOrWhiteSpace(objectTitle)) return true;
+        return string.Equals(
+            (siteTitle ?? string.Empty).Trim(),
+            objectTitle.Trim(),
+            StringComparison.OrdinalIgnoreCase);
+    }
 
     /// <summary>Minimal HTML encoding for text content and attribute values.</summary>
     private static string HtmlEncode(string value)

SharepointToolbox/Services/Export/VersionCleanupHtmlExportService.cs

@@ -0,0 +1,180 @@
+using System.Text;
+using SharepointToolbox.Core.Models;
+using SharepointToolbox.Localization;
+
+namespace SharepointToolbox.Services.Export;
+
+/// <summary>
+/// Exports VersionCleanupResult list to a self-contained sortable/filterable HTML report.
+/// Summary header shows totals (files trimmed, versions deleted, bytes freed); a single
+/// table lists every processed file with sort/filter controls. No external assets.
+/// </summary>
+public class VersionCleanupHtmlExportService
+{
+    public string BuildHtml(IReadOnlyList<VersionCleanupResult> results, ReportBranding? branding = null)
+    {
+        var T = TranslationSource.Instance;
+        var sb = new StringBuilder();
+
+        long totalBytes = results.Sum(r => r.BytesFreed);
+        int totalDeleted = results.Sum(r => r.VersionsDeleted);
+        int totalFiles = results.Count(r => r.VersionsDeleted > 0);
+
+        sb.AppendLine("<!DOCTYPE html>");
+        sb.AppendLine("<html lang=\"en\">");
+        sb.AppendLine("<head>");
+        sb.AppendLine("<meta charset=\"UTF-8\">");
+        sb.AppendLine("<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">");
+        sb.AppendLine($"<title>{T["report.title.versions"]}</title>");
+        sb.AppendLine("""
+            <style>
+              body { font-family: 'Segoe UI', Arial, sans-serif; font-size: 13px; margin: 20px; background: #f5f5f5; }
+              h1 { color: #0078d4; }
+              .summary { display: flex; gap: 24px; margin: 12px 0 16px 0; padding: 12px 16px;
+                         background: #e8f1fb; border-radius: 6px; }
+              .summary .item { display: flex; flex-direction: column; }
+              .summary .label { font-size: 11px; color: #555; text-transform: uppercase; letter-spacing: .5px; }
+              .summary .value { font-size: 18px; font-weight: 600; color: #0078d4; }
+              .toolbar { margin-bottom: 10px; display: flex; gap: 12px; align-items: center; }
+              .toolbar label { font-weight: 600; }
+              #filterInput { padding: 6px 10px; border: 1px solid #ccc; border-radius: 4px; width: 280px; font-size: 13px; }
+              #resultCount { font-size: 12px; color: #666; }
+              table { border-collapse: collapse; width: 100%; background: #fff; box-shadow: 0 1px 3px rgba(0,0,0,.15); }
+              th { background: #0078d4; color: #fff; padding: 8px 12px; text-align: left; cursor: pointer;
+                   font-weight: 600; user-select: none; white-space: nowrap; }
+              th:hover { background: #106ebe; }
+              th.sorted-asc::after  { content: ' ▲'; font-size: 10px; }
+              th.sorted-desc::after { content: ' ▼'; font-size: 10px; }
+              td { padding: 6px 12px; border-bottom: 1px solid #e0e0e0; word-break: break-all; }
+              tr:hover td { background: #f0f7ff; }
+              tr.hidden { display: none; }
+              tr.err td { background: #fff4f4; }
+              .num { text-align: right; font-variant-numeric: tabular-nums; white-space: nowrap; }
+              .err-cell { color: #b00020; }
+              .generated { font-size: 11px; color: #888; margin-top: 12px; }
+            </style>
+            </head>
+            <body>
+            """);
+        sb.Append(BrandingHtmlHelper.BuildBrandingHeader(branding));
+        sb.AppendLine($"<h1>{T["report.title.versions_short"]}</h1>");
+
+        sb.AppendLine($"""
+            <div class="summary">
+              <div class="item"><span class="label">{T["versions.summary.files"]}</span><span class="value">{totalFiles:N0}</span></div>
+              <div class="item"><span class="label">{T["versions.summary.deleted"]}</span><span class="value">{totalDeleted:N0}</span></div>
+              <div class="item"><span class="label">{T["versions.summary.freed"]}</span><span class="value">{FormatSize(totalBytes)}</span></div>
+            </div>
+            <div class="toolbar">
+              <label for="filterInput">{T["report.filter.label"]}</label>
+              <input id="filterInput" type="text" placeholder="{T["report.filter.placeholder_rows"]}" oninput="filterTable()" />
+              <span id="resultCount"></span>
+            </div>
+            """);
+
+        sb.AppendLine($"""
+            <table id="resultsTable">
+              <thead>
+                <tr>
+                  <th onclick="sortTable(0)">{T["report.col.site"]}</th>
+                  <th onclick="sortTable(1)">{T["versions.col.library"]}</th>
+                  <th onclick="sortTable(2)">{T["versions.col.file"]}</th>
+                  <th onclick="sortTable(3)">{T["versions.col.path"]}</th>
+                  <th class="num" onclick="sortTable(4)">{T["versions.col.before"]}</th>
+                  <th class="num" onclick="sortTable(5)">{T["versions.col.deleted"]}</th>
+                  <th class="num" onclick="sortTable(6)">{T["versions.col.remaining"]}</th>
+                  <th class="num" onclick="sortTable(7)">{T["versions.col.freed"]}</th>
+                  <th onclick="sortTable(8)">{T["versions.col.error"]}</th>
+                </tr>
+              </thead>
+              <tbody>
+            """);
+
+        foreach (var r in results)
+        {
+            string rowClass = string.IsNullOrEmpty(r.Error) ? string.Empty : " class=\"err\"";
+            string errCell = string.IsNullOrEmpty(r.Error)
+                ? string.Empty
+                : $"<span class=\"err-cell\">{H(r.Error)}</span>";
+
+            sb.AppendLine($"""
+                  <tr{rowClass}>
+                    <td>{H(r.SiteUrl)}</td>
+                    <td>{H(r.Library)}</td>
+                    <td>{H(r.FileName)}</td>
+                    <td>{H(r.FileServerRelativeUrl)}</td>
+                    <td class="num" data-sort="{r.VersionsBefore}">{r.VersionsBefore:N0}</td>
+                    <td class="num" data-sort="{r.VersionsDeleted}">{r.VersionsDeleted:N0}</td>
+                    <td class="num" data-sort="{r.VersionsRemaining}">{r.VersionsRemaining:N0}</td>
+                    <td class="num" data-sort="{r.BytesFreed}">{FormatSize(r.BytesFreed)}</td>
+                    <td>{errCell}</td>
+                  </tr>
+                """);
+        }
+
+        sb.AppendLine("  </tbody>\n</table>");
+
+        int count = results.Count;
+        sb.AppendLine($"<p class=\"generated\">{T["report.text.generated_colon"]} {DateTime.Now:yyyy-MM-dd HH:mm} — {count:N0} {T["report.text.results_parens"]}</p>");
+
+        sb.AppendLine($$"""
+            <script>
+            var sortDir = {};
+            function sortTable(col) {
+              var tbl = document.getElementById('resultsTable');
+              var tbody = tbl.tBodies[0];
+              var rows = Array.from(tbody.rows);
+              var asc = sortDir[col] !== 'asc';
+              sortDir[col] = asc ? 'asc' : 'desc';
+              rows.sort(function(a, b) {
+                var av = a.cells[col].dataset.sort || a.cells[col].innerText;
+                var bv = b.cells[col].dataset.sort || b.cells[col].innerText;
+                var an = parseFloat(av), bn = parseFloat(bv);
+                if (!isNaN(an) && !isNaN(bn)) return asc ? an - bn : bn - an;
+                return asc ? av.localeCompare(bv) : bv.localeCompare(av);
+              });
+              rows.forEach(function(r) { tbody.appendChild(r); });
+              var ths = tbl.tHead.rows[0].cells;
+              for (var i = 0; i < ths.length; i++) {
+                ths[i].className = (i === col) ? (asc ? 'sorted-asc' : 'sorted-desc') : '';
+              }
+            }
+            function filterTable() {
+              var q = document.getElementById('filterInput').value.toLowerCase();
+              var rows = document.getElementById('resultsTable').tBodies[0].rows;
+              var visible = 0;
+              for (var i = 0; i < rows.length; i++) {
+                var match = rows[i].innerText.toLowerCase().indexOf(q) >= 0;
+                rows[i].className = (rows[i].className.indexOf('err') >= 0 ? 'err ' : '') + (match ? '' : 'hidden');
+                if (match) visible++;
+              }
+              document.getElementById('resultCount').innerText = q ? (visible + ' {{T["report.text.of"]}} {{count:N0}} {{T["report.text.shown"]}}') : '';
+            }
+            window.onload = function() {
+              document.getElementById('resultCount').innerText = '{{count:N0}} {{T["report.text.results_parens"]}}';
+            };
+            </script>
+            </body></html>
+            """);
+
+        return sb.ToString();
+    }
+
+    /// <summary>Writes the HTML report to <paramref name="filePath"/> as UTF-8.</summary>
+    public async Task WriteAsync(IReadOnlyList<VersionCleanupResult> results, string filePath, CancellationToken ct, ReportBranding? branding = null)
+    {
+        var html = BuildHtml(results, branding);
+        await System.IO.File.WriteAllTextAsync(filePath, html, Encoding.UTF8, ct);
+    }
+
+    private static string H(string value) =>
+        System.Net.WebUtility.HtmlEncode(value ?? string.Empty);
+
+    private static string FormatSize(long bytes)
+    {
+        if (bytes >= 1_073_741_824L) return $"{bytes / 1_073_741_824.0:F2} GB";
+        if (bytes >= 1_048_576L)     return $"{bytes / 1_048_576.0:F2} MB";
+        if (bytes >= 1024L)          return $"{bytes / 1024.0:F2} KB";
+        return $"{bytes} B";
+    }
+}

SharepointToolbox/Services/FileTransferService.cs

@@ -6,8 +6,23 @@ using SharepointToolbox.Core.Models;
 
 namespace SharepointToolbox.Services;
 
+/// <summary>
+/// Orchestrates server-side file copy/move between two SharePoint libraries
+/// (same or different tenants). Uses <see cref="MoveCopyUtil"/> for the
+/// transfer itself so bytes never round-trip through the local machine.
+/// Folder creation and enumeration are done via CSOM; all ambient retries
+/// flow through <see cref="ExecuteQueryRetryHelper"/>.
+/// </summary>
 public class FileTransferService : IFileTransferService
 {
+    /// <summary>
+    /// Runs the configured <see cref="TransferJob"/>. Enumerates source files
+    /// (unless the job is folder-only), pre-creates destination folders, then
+    /// copies or moves each file according to <see cref="TransferJob.Mode"/>
+    /// and <see cref="TransferJob.ConflictPolicy"/>. Returns a per-item
+    /// summary where failures are reported individually — the method does
+    /// not abort on first error so partial transfers are recoverable.
+    /// </summary>
     public async Task<BulkOperationSummary<string>> TransferAsync(
         ClientContext sourceCtx,
         ClientContext destCtx,
@@ -15,19 +30,53 @@ public class FileTransferService : IFileTransferService
         IProgress<OperationProgress> progress,
         CancellationToken ct)
     {
-        // 1. Enumerate files from source
+        // 1. Enumerate files from source (unless contents are suppressed).
-        progress.Report(new OperationProgress(0, 0, "Enumerating source files..."));
+        IReadOnlyList<string> files;
-        var files = await EnumerateFilesAsync(sourceCtx, job, progress, ct);
+        if (job.CopyFolderContents)
+        {
+            progress.Report(new OperationProgress(0, 0, "Enumerating source files..."));
+            files = await EnumerateFilesAsync(sourceCtx, job, progress, ct);
+        }
+        else
+        {
+            files = Array.Empty<string>();
+        }
 
-        if (files.Count == 0)
+        // When CopyFolderContents is off, the job is folder-only: ensure the
+        // destination folder is created below (IncludeSourceFolder branch) and
+        // return without iterating any files.
+        if (files.Count == 0 && !job.IncludeSourceFolder)
         {
             progress.Report(new OperationProgress(0, 0, "No files found to transfer."));
             return new BulkOperationSummary<string>(new List<BulkItemResult<string>>());
         }
 
-        // 2. Build source and destination base paths
+        // 2. Build source and destination base paths. Resolve library roots via
-        var srcBasePath = BuildServerRelativePath(sourceCtx, job.SourceLibrary, job.SourceFolderPath);
+        // CSOM — constructing from title breaks for localized libraries whose
-        var dstBasePath = BuildServerRelativePath(destCtx, job.DestinationLibrary, job.DestinationFolderPath);
+        // URL segment differs (e.g. title "Documents" → URL "Shared Documents"),
+        // causing "Access denied" when CSOM tries to touch a non-existent path.
+        var srcBasePath = await ResolveLibraryPathAsync(
+            sourceCtx, job.SourceLibrary, job.SourceFolderPath, progress, ct);
+        var dstBasePath = await ResolveLibraryPathAsync(
+            destCtx, job.DestinationLibrary, job.DestinationFolderPath, progress, ct);
+
+        // When IncludeSourceFolder is set, recreate the source folder name under
+        // destination so dest/srcFolderName/... mirrors the source tree. When
+        // no SourceFolderPath is set, fall back to the source library name.
+        // Also pre-create the folder itself — per-file EnsureFolder only fires
+        // for nested paths, so flat files at the root of the source folder
+        // would otherwise copy into a missing parent and fail.
+        if (job.IncludeSourceFolder)
+        {
+            var srcFolderName = !string.IsNullOrEmpty(job.SourceFolderPath)
+                ? Path.GetFileName(job.SourceFolderPath.TrimEnd('/'))
+                : job.SourceLibrary;
+            if (!string.IsNullOrEmpty(srcFolderName))
+            {
+                dstBasePath = $"{dstBasePath}/{srcFolderName}";
+                await EnsureFolderAsync(destCtx, dstBasePath, progress, ct);
+            }
+        }
 
         // 3. Transfer each file using BulkOperationRunner
         return await BulkOperationRunner.RunAsync(
@@ -68,8 +117,14 @@ public class FileTransferService : IFileTransferService
         IProgress<OperationProgress> progress,
         CancellationToken ct)
     {
-        var srcPath = ResourcePath.FromDecodedUrl(srcFileUrl);
+        // MoveCopyUtil.CopyFileByPath expects absolute URLs (scheme + host),
-        var dstPath = ResourcePath.FromDecodedUrl(dstFileUrl);
+        // not server-relative paths. Passing "/sites/..." silently fails or
+        // returns no error yet copies nothing — especially across site
+        // collections. Prefix with the owning site's scheme+host.
+        var srcAbs  = ToAbsoluteUrl(sourceCtx, srcFileUrl);
+        var dstAbs  = ToAbsoluteUrl(destCtx, dstFileUrl);
+        var srcPath = ResourcePath.FromDecodedUrl(srcAbs);
+        var dstPath = ResourcePath.FromDecodedUrl(dstAbs);
 
         bool overwrite = job.ConflictPolicy == ConflictPolicy.Overwrite;
         var options = new MoveCopyOptions
@@ -109,41 +164,66 @@ public class FileTransferService : IFileTransferService
         ctx.Load(rootFolder, f => f.ServerRelativeUrl);
         await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
 
-        var baseFolderUrl = rootFolder.ServerRelativeUrl.TrimEnd('/');
+        var libraryRoot = rootFolder.ServerRelativeUrl.TrimEnd('/');
+
+        // Explicit per-file selection overrides folder enumeration. Paths are
+        // library-relative (e.g. "SubFolder/file.docx") and get resolved to
+        // full server-relative URLs here.
+        if (job.SelectedFilePaths.Count > 0)
+        {
+            return job.SelectedFilePaths
+                .Where(p => !string.IsNullOrWhiteSpace(p))
+                .Select(p => $"{libraryRoot}/{p.TrimStart('/')}")
+                .ToList();
+        }
+
+        var baseFolderUrl = libraryRoot;
         if (!string.IsNullOrEmpty(job.SourceFolderPath))
             baseFolderUrl = $"{baseFolderUrl}/{job.SourceFolderPath.TrimStart('/')}";
 
-        var folder = ctx.Web.GetFolderByServerRelativeUrl(baseFolderUrl);
+        // Paginated recursive CAML query — Folder.Files / Folder.Folders lazy
+        // loading hits the list-view threshold on libraries > 5,000 items.
         var files = new List<string>();
-        await CollectFilesRecursiveAsync(ctx, folder, files, progress, ct);
+
+        await foreach (var item in SharePointPaginationHelper.GetItemsInFolderAsync(
+            ctx, list, baseFolderUrl, recursive: true,
+            viewFields: new[] { "FSObjType", "FileRef", "FileDirRef" },
+            ct: ct))
+        {
+            ct.ThrowIfCancellationRequested();
+
+            if (item["FSObjType"]?.ToString() != "0") continue; // files only
+
+            var fileRef = item["FileRef"]?.ToString();
+            if (string.IsNullOrEmpty(fileRef)) continue;
+
+            // Skip files under SharePoint system folders (e.g. "Forms", "_*").
+            var dir = item["FileDirRef"]?.ToString() ?? string.Empty;
+            if (HasSystemFolderSegment(dir, baseFolderUrl)) continue;
+
+            files.Add(fileRef);
+        }
+
         return files;
     }
 
-    private async Task CollectFilesRecursiveAsync(
+    private static bool HasSystemFolderSegment(string fileDirRef, string baseFolderUrl)
-        ClientContext ctx,
-        Folder folder,
-        List<string> files,
-        IProgress<OperationProgress> progress,
-        CancellationToken ct)
     {
-        ct.ThrowIfCancellationRequested();
+        if (string.IsNullOrEmpty(fileDirRef)) return false;
+        var baseTrim = baseFolderUrl.TrimEnd('/');
+        if (!fileDirRef.StartsWith(baseTrim, StringComparison.OrdinalIgnoreCase))
+            return false;
 
-        ctx.Load(folder, f => f.Files.Include(fi => fi.ServerRelativeUrl),
+        var tail = fileDirRef.Substring(baseTrim.Length).Trim('/');
-                         f => f.Folders);
+        if (string.IsNullOrEmpty(tail)) return false;
-        await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
 
-        foreach (var file in folder.Files)
+        foreach (var seg in tail.Split('/', StringSplitOptions.RemoveEmptyEntries))
         {
-            files.Add(file.ServerRelativeUrl);
+            if (seg.StartsWith("_", StringComparison.Ordinal) ||
-        }
+                seg.Equals("Forms", StringComparison.OrdinalIgnoreCase))
-
+                return true;
-        foreach (var subFolder in folder.Folders)
-        {
-            // Skip system folders
-            if (subFolder.Name.StartsWith("_") || subFolder.Name == "Forms")
-                continue;
-            await CollectFilesRecursiveAsync(ctx, subFolder, files, progress, ct);
         }
+        return false;
     }
 
     private async Task EnsureFolderAsync(
@@ -152,28 +232,70 @@ public class FileTransferService : IFileTransferService
         IProgress<OperationProgress> progress,
         CancellationToken ct)
     {
+        folderServerRelativeUrl = folderServerRelativeUrl.TrimEnd('/');
+
+        // Already there?
         try
         {
-            var folder = ctx.Web.GetFolderByServerRelativeUrl(folderServerRelativeUrl);
+            var existing = ctx.Web.GetFolderByServerRelativeUrl(folderServerRelativeUrl);
-            ctx.Load(folder, f => f.Exists);
+            ctx.Load(existing, f => f.Exists);
             await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
-            if (folder.Exists) return;
+            if (existing.Exists) return;
         }
-        catch { /* folder doesn't exist, create it */ }
+        catch { /* not present — fall through to creation */ }
 
-        // Create folder using Folders.Add which creates intermediate folders
+        // Walk the path, creating each missing segment. `Web.Folders.Add(url)` is
-        ctx.Web.Folders.Add(folderServerRelativeUrl);
+        // ambiguous across CSOM versions (some treat the arg as relative to Web,
-        await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
+        // others server-relative), which produces bogus paths + "Access denied".
+        // Resolve the parent explicitly and add only the leaf name instead.
+        int slash = folderServerRelativeUrl.LastIndexOf('/');
+        if (slash <= 0) return;
+
+        var parentUrl = folderServerRelativeUrl.Substring(0, slash);
+        var leafName = folderServerRelativeUrl.Substring(slash + 1);
+        if (string.IsNullOrEmpty(leafName)) return;
+
+        // Recurse to guarantee the parent exists first.
+        await EnsureFolderAsync(ctx, parentUrl, progress, ct);
+
+        var parent = ctx.Web.GetFolderByServerRelativeUrl(parentUrl);
+        parent.Folders.Add(leafName);
+        try
+        {
+            await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
+        }
+        catch (Exception ex)
+        {
+            Log.Warning("EnsureFolder failed at {Parent}/{Leaf}: {Error}",
+                parentUrl, leafName, ex.Message);
+            throw;
+        }
     }
 
-    private static string BuildServerRelativePath(ClientContext ctx, string library, string folderPath)
+    private static string ToAbsoluteUrl(ClientContext ctx, string pathOrUrl)
     {
-        // Extract site-relative URL from context URL
+        if (pathOrUrl.StartsWith("http://", StringComparison.OrdinalIgnoreCase) ||
+            pathOrUrl.StartsWith("https://", StringComparison.OrdinalIgnoreCase))
+            return pathOrUrl;
+
         var uri = new Uri(ctx.Url);
-        var siteRelative = uri.AbsolutePath.TrimEnd('/');
+        return $"{uri.Scheme}://{uri.Host}{(pathOrUrl.StartsWith("/") ? "" : "/")}{pathOrUrl}";
-        var basePath = $"{siteRelative}/{library}";
+    }
-        if (!string.IsNullOrEmpty(folderPath))
+
-            basePath = $"{basePath}/{folderPath.TrimStart('/')}";
+    private static async Task<string> ResolveLibraryPathAsync(
+        ClientContext ctx,
+        string libraryTitle,
+        string relativeFolderPath,
+        IProgress<OperationProgress> progress,
+        CancellationToken ct)
+    {
+        var list = ctx.Web.Lists.GetByTitle(libraryTitle);
+        ctx.Load(list, l => l.RootFolder.ServerRelativeUrl);
+        await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
+
+        var basePath = list.RootFolder.ServerRelativeUrl.TrimEnd('/');
+        if (!string.IsNullOrEmpty(relativeFolderPath))
+            basePath = $"{basePath}/{relativeFolderPath.TrimStart('/')}";
         return basePath;
     }
 }

SharepointToolbox/Services/IAppRegistrationService.cs

@@ -9,23 +9,25 @@ public interface IAppRegistrationService
 {
     /// <summary>
     /// Returns true if the currently-authenticated user has the Global Administrator
-    /// directory role (checked via transitiveMemberOf for nested-group coverage).
+    /// directory role in the target tenant (checked via transitiveMemberOf for
-    /// Returns false on any failure, including 403, rather than throwing.
+    /// nested-group coverage). Throws on Graph/network failure so the UI can
+    /// distinguish a confirmed non-admin from a call that could not complete.
     /// </summary>
-    Task<bool> IsGlobalAdminAsync(string clientId, CancellationToken ct);
+    Task<bool> IsGlobalAdminAsync(string clientId, string tenantUrl, CancellationToken ct);
 
     /// <summary>
     /// Creates an Azure AD Application + ServicePrincipal + OAuth2PermissionGrants
-    /// atomically. On any intermediate failure the Application is deleted before
+    /// atomically in the tenant identified by <paramref name="tenantUrl"/>.
-    /// returning a Failure result (best-effort rollback).
+    /// On any intermediate failure the Application is deleted before returning
+    /// a Failure result (best-effort rollback).
     /// </summary>
-    Task<AppRegistrationResult> RegisterAsync(string clientId, string tenantDisplayName, CancellationToken ct);
+    Task<AppRegistrationResult> RegisterAsync(string clientId, string tenantUrl, string tenantDisplayName, CancellationToken ct);
 
     /// <summary>
-    /// Deletes the registered application by its appId.
+    /// Deletes the registered application by its appId in the given tenant.
     /// Logs a warning on failure but does not throw.
     /// </summary>
-    Task RemoveAsync(string clientId, string appId, CancellationToken ct);
+    Task RemoveAsync(string clientId, string tenantUrl, string appId, CancellationToken ct);
 
     /// <summary>
     /// Clears the live SessionManager context, evicts all in-memory MSAL accounts,

SharepointToolbox/Services/IStorageService.cs

@@ -6,8 +6,11 @@ namespace SharepointToolbox.Services;
 public interface IStorageService
 {
     /// <summary>
-    /// Collects storage metrics per library/folder using SharePoint StorageMetrics API.
+    /// Collects storage metrics for a site, capturing every storage source
-    /// Returns a tree of StorageNode objects with aggregate size data.
+    /// SharePoint reports (visible + hidden libraries, Preservation Hold,
+    /// list attachments, recycle bin, and optionally subsites). Each
+    /// <see cref="StorageNode"/> carries a <see cref="StorageNodeKind"/> so
+    /// callers can filter what appears in the report.
     /// </summary>
     Task<IReadOnlyList<StorageNode>> CollectStorageAsync(
         ClientContext ctx,
@@ -18,9 +21,6 @@ public interface IStorageService
     /// <summary>
     /// Enumerates files across all non-hidden document libraries in the site
     /// and aggregates storage consumption grouped by file extension.
-    /// Uses CSOM CamlQuery to retrieve FileLeafRef and File_x0020_Size per file.
-    /// This is a separate operation from CollectStorageAsync -- it provides
-    /// file-type breakdown data for chart visualization.
     /// </summary>
     Task<IReadOnlyList<FileTypeMetric>> CollectFileTypeMetricsAsync(
         ClientContext ctx,
@@ -29,13 +29,24 @@ public interface IStorageService
 
     /// <summary>
     /// Backfills StorageNodes that have zero TotalFileCount/TotalSizeBytes
-    /// by enumerating files per library via CamlQuery.
+    /// by enumerating files per library via CamlQuery. Only re-runs against
-    /// This works around the StorageMetrics API returning zeros when the
+    /// document-library kinds (Library, HiddenLibrary, PreservationHold).
-    /// caller lacks sufficient permissions or metrics haven't been calculated.
     /// </summary>
     Task BackfillZeroNodesAsync(
         ClientContext ctx,
         IReadOnlyList<StorageNode> nodes,
         IProgress<OperationProgress> progress,
         CancellationToken ct);
+
+    /// <summary>
+    /// Returns the SharePoint-reported total storage usage for the site
+    /// (Site.Usage.Storage). This includes everything that counts toward
+    /// the site quota — recycle bin, version history, hidden libraries,
+    /// list attachments — and serves as the ground-truth reference total.
+    /// Returns 0 if the call is denied or the property is unavailable.
+    /// </summary>
+    Task<long> GetSiteUsageStorageBytesAsync(
+        ClientContext ctx,
+        IProgress<OperationProgress> progress,
+        CancellationToken ct);
 }

SharepointToolbox/Services/IUserAccessAuditService.cs

@@ -27,5 +27,6 @@ public interface IUserAccessAuditService
         IReadOnlyList<SiteInfo> sites,
         ScanOptions options,
         IProgress<OperationProgress> progress,
-        CancellationToken ct);
+        CancellationToken ct,
+        Func<string, CancellationToken, Task<bool>>? onAccessDenied = null);
 }

SharepointToolbox/Services/IVersionCleanupService.cs

@@ -0,0 +1,28 @@
+using Microsoft.SharePoint.Client;
+using SharepointToolbox.Core.Models;
+
+namespace SharepointToolbox.Services;
+
+public interface IVersionCleanupService
+{
+    /// <summary>
+    /// Enumerates document libraries (filtered by <see cref="VersionCleanupOptions.LibraryTitles"/>
+    /// when non-empty) and deletes historical file versions per file according to
+    /// <see cref="VersionCleanupOptions.KeepLast"/> and <see cref="VersionCleanupOptions.KeepFirst"/>.
+    /// The current published version is never touched. Returns one result row per file
+    /// where at least one version was inspected.
+    /// </summary>
+    Task<IReadOnlyList<VersionCleanupResult>> DeleteOldVersionsAsync(
+        ClientContext ctx,
+        VersionCleanupOptions options,
+        IProgress<OperationProgress> progress,
+        CancellationToken ct);
+
+    /// <summary>
+    /// Lists non-hidden document libraries on the site. Used by the library picker
+    /// so callers can present a checkbox UI.
+    /// </summary>
+    Task<IReadOnlyList<string>> ListLibraryTitlesAsync(
+        ClientContext ctx,
+        CancellationToken ct);
+}

SharepointToolbox/Services/OwnershipElevationService.cs

@@ -7,6 +7,17 @@ public class OwnershipElevationService : IOwnershipElevationService
 {
     public async Task ElevateAsync(ClientContext tenantAdminCtx, string siteUrl, string loginName, CancellationToken ct)
     {
+        // Tenant.SetSiteAdmin requires a real claims/UPN login; an empty string
+        // makes the server raise "Cannot convert Org ID to Claims" and abort.
+        // When the caller doesn't specify a user, fall back to the signed-in
+        // admin (the owner of tenantAdminCtx).
+        if (string.IsNullOrWhiteSpace(loginName))
+        {
+            tenantAdminCtx.Load(tenantAdminCtx.Web.CurrentUser, u => u.LoginName);
+            await tenantAdminCtx.ExecuteQueryAsync();
+            loginName = tenantAdminCtx.Web.CurrentUser.LoginName;
+        }
+
         var tenant = new Tenant(tenantAdminCtx);
         tenant.SetSiteAdmin(siteUrl, loginName, isSiteAdmin: true);
         await tenantAdminCtx.ExecuteQueryAsync();

SharepointToolbox/Services/PermissionsService.cs

@@ -1,4 +1,5 @@
 using Microsoft.SharePoint.Client;
+using Serilog;
 using SharepointToolbox.Core.Helpers;
 using SharepointToolbox.Core.Models;
 
@@ -10,6 +11,21 @@ namespace SharepointToolbox.Services;
 /// </summary>
 public class PermissionsService : IPermissionsService
 {
+    /// <summary>
+    /// Detects the SharePoint server error raised when a RoleAssignment member
+    /// refers to a user that no longer resolves (orphaned Azure AD account).
+    /// Message surfaces in the user's locale — match on language-agnostic tokens.
+    /// </summary>
+    private static bool IsClaimsResolutionError(ServerException ex)
+    {
+        var msg = ex.Message ?? string.Empty;
+        return msg.Contains("Claims", StringComparison.OrdinalIgnoreCase)
+            || msg.Contains("Revendications", StringComparison.OrdinalIgnoreCase)
+            || msg.Contains("Org ID", StringComparison.OrdinalIgnoreCase)
+            || msg.Contains("ID org", StringComparison.OrdinalIgnoreCase)
+            || msg.Contains("OrgIdToClaims", StringComparison.OrdinalIgnoreCase);
+    }
+
     // Port of PS lines 1914-1926: system lists excluded from permission reporting
     private static readonly HashSet<string> ExcludedLists = new(StringComparer.OrdinalIgnoreCase)
     {
@@ -122,7 +138,17 @@ public class PermissionsService : IPermissionsService
                 u => u.Title,
                 u => u.LoginName,
                 u => u.IsSiteAdmin));
-        await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
+
+        try
+        {
+            await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
+        }
+        catch (ServerException ex) when (IsClaimsResolutionError(ex))
+        {
+            Log.Warning("Skipped site collection admins for {Url} — orphaned user: {Error}",
+                ctx.Web.Url, ex.Message);
+            return Enumerable.Empty<PermissionEntry>();
+        }
 
         var admins = ctx.Web.SiteUsers
             .Where(u => u.IsSiteAdmin)
@@ -280,7 +306,23 @@ public class PermissionsService : IPermissionsService
                 ra => ra.Member.LoginName,
                 ra => ra.Member.PrincipalType,
                 ra => ra.RoleDefinitionBindings.Include(rdb => rdb.Name)));
-        await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
+
+        // Orphaned AD users in RoleAssignments cause the server to throw
+        // "Cannot convert Org ID user to Claims user" during claim resolution.
+        // That kills the whole batch — skip this object so the scan continues.
+        // Only swallow the claims-resolution signature; real access-denied errors
+        // must bubble up so callers (e.g. PermissionsViewModel auto-elevation)
+        // can react to them.
+        try
+        {
+            await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
+        }
+        catch (ServerException ex) when (IsClaimsResolutionError(ex))
+        {
+            Log.Warning("Skipped {Type} '{Title}' ({Url}) — orphaned user in permissions: {Error}",
+                objectType, title, url, ex.Message);
+            return Enumerable.Empty<PermissionEntry>();
+        }
 
         // Skip inherited objects when IncludeInherited=false
         if (!options.IncludeInherited && !obj.HasUniqueRoleAssignments)

SharepointToolbox/Services/ProfileService.cs

@@ -24,8 +24,9 @@ public class ProfileService
             !Uri.TryCreate(profile.TenantUrl, UriKind.Absolute, out _))
             throw new ArgumentException("TenantUrl must be a valid absolute URL.", nameof(profile));
 
-        if (string.IsNullOrWhiteSpace(profile.ClientId))
+        // ClientId is optional at creation time: the user can register the app from within
-            throw new ArgumentException("ClientId must not be empty.", nameof(profile));
+        // the tool, which will populate ClientId/AppId on the profile afterwards.
+        profile.ClientId ??= string.Empty;
 
         var existing = (await _repository.LoadAsync()).ToList();
         existing.Add(profile);

SharepointToolbox/Services/SearchService.cs

@@ -62,10 +62,25 @@ public class SearchService : ISearchService
                 .FirstOrDefault(t => t.TableType == KnownTableTypes.RelevantResults);
             if (table == null || table.RowCount == 0) break;
 
-            foreach (System.Collections.Hashtable row in table.ResultRows)
+            foreach (var rawRow in table.ResultRows)
             {
-                var dict = row.Cast<System.Collections.DictionaryEntry>()
+                // CSOM has returned ResultRows as either Hashtable or
-                    .ToDictionary(e => e.Key.ToString()!, e => e.Value ?? (object)string.Empty);
+                // Dictionary<string,object> across versions — accept both.
+                IDictionary<string, object> dict;
+                if (rawRow is IDictionary<string, object> generic)
+                {
+                    dict = generic;
+                }
+                else if (rawRow is System.Collections.IDictionary legacy)
+                {
+                    dict = new Dictionary<string, object>();
+                    foreach (System.Collections.DictionaryEntry e in legacy)
+                        dict[e.Key.ToString()!] = e.Value ?? string.Empty;
+                }
+                else
+                {
+                    continue;
+                }
 
                 // Skip SharePoint version history paths
                 string path = Str(dict, "Path");

SharepointToolbox/Services/SettingsService.cs

@@ -43,4 +43,14 @@ public class SettingsService
         settings.AutoTakeOwnership = enabled;
         await _repository.SaveAsync(settings);
     }
+
+    public async Task SetThemeAsync(string mode)
+    {
+        if (mode is not ("System" or "Light" or "Dark"))
+            throw new ArgumentException($"Unsupported theme '{mode}'. Supported: System, Light, Dark.", nameof(mode));
+
+        var settings = await _repository.LoadAsync();
+        settings.Theme = mode;
+        await _repository.SaveAsync(settings);
+    }
 }

SharepointToolbox/Services/SharePointGroupResolver.cs

@@ -45,10 +45,37 @@ public class SharePointGroupResolver : ISharePointGroupResolver
 
         GraphServiceClient? graphClient = null;
 
+        // Preload the web's SiteGroups catalog once, so we can skip missing
+        // groups without triggering a server round-trip per name (which fills
+        // logs with "Could not resolve SP group" warnings for groups that
+        // live on other sites or were renamed/deleted).
+        var groupTitles = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        try
+        {
+            ctx.Load(ctx.Web.SiteGroups, gs => gs.Include(g => g.Title));
+            await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, null, ct);
+            foreach (var g in ctx.Web.SiteGroups)
+                groupTitles.Add(g.Title);
+        }
+        catch (Exception ex)
+        {
+            Log.Warning("Could not enumerate SiteGroups on {Url}: {Error}", ctx.Url, ex.Message);
+        }
+
         foreach (var groupName in groupNames.Distinct(StringComparer.OrdinalIgnoreCase))
         {
             ct.ThrowIfCancellationRequested();
 
+            if (!groupTitles.Contains(groupName))
+            {
+                // Group not on this web — likely scoped to another site in a
+                // multi-site scan. Keep quiet: log at Debug, return empty.
+                Log.Debug("SP group '{Group}' not present on {Url}; skipping.",
+                    groupName, ctx.Url);
+                result[groupName] = Array.Empty<ResolvedMember>();
+                continue;
+            }
+
             try
             {
                 var group = ctx.Web.SiteGroups.GetByName(groupName);

SharepointToolbox/Services/SiteListService.cs

@@ -69,7 +69,12 @@ public class SiteListService : ISiteListService
                 if (s.Status == "Active"
                     && !s.Url.Contains("-my.sharepoint.com", StringComparison.OrdinalIgnoreCase))
                 {
-                    results.Add(new SiteInfo(s.Url, s.Title));
+                    results.Add(new SiteInfo(s.Url, s.Title)
+                    {
+                        StorageUsedMb = s.StorageUsage,
+                        StorageQuotaMb = s.StorageMaximumLevel,
+                        Template = s.Template ?? string.Empty
+                    });
                 }
             }
         }

SharepointToolbox/Services/StorageService.cs

@@ -7,20 +7,39 @@ namespace SharepointToolbox.Services;
 
 /// <summary>
 /// CSOM-based storage metrics scanner.
-/// Port of PowerShell Collect-FolderStorage / Get-PnPFolderStorageMetric pattern.
+/// Captures every storage source SharePoint reports for a site:
+/// document libraries (visible + hidden), the Preservation Hold Library,
+/// list attachments, the recycle bin (1st + 2nd stage), and optionally
+/// subsites. Each <see cref="StorageNode"/> carries a <see cref="StorageNodeKind"/>
+/// so the caller can filter what appears in the report.
 /// </summary>
 public class StorageService : IStorageService
 {
+    // PreservationHoldLibrary base template id.
+    private const int PreservationHoldTemplate = 851;
+
     public async Task<IReadOnlyList<StorageNode>> CollectStorageAsync(
         ClientContext ctx,
         StorageScanOptions options,
         IProgress<OperationProgress> progress,
         CancellationToken ct)
+    {
+        var result = new List<StorageNode>();
+        await CollectForWebAsync(ctx, ctx.Web, options, result, progress, ct);
+        return result;
+    }
+
+    private async Task CollectForWebAsync(
+        ClientContext ctx,
+        Web web,
+        StorageScanOptions options,
+        List<StorageNode> result,
+        IProgress<OperationProgress> progress,
+        CancellationToken ct)
     {
         ct.ThrowIfCancellationRequested();
 
-        // Load web-level metadata in one round-trip
+        ctx.Load(web,
-        ctx.Load(ctx.Web,
             w => w.Title,
             w => w.Url,
             w => w.ServerRelativeUrl,
@@ -28,41 +47,324 @@ public class StorageService : IStorageService
                 l => l.Title,
                 l => l.Hidden,
                 l => l.BaseType,
+                l => l.BaseTemplate,
+                l => l.ItemCount,
                 l => l.RootFolder.ServerRelativeUrl));
+        if (options.IncludeSubsites)
+            ctx.Load(web.Webs, ws => ws.Include(w => w.ServerRelativeUrl, w => w.Title));
         await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
 
-        string webSrl = ctx.Web.ServerRelativeUrl.TrimEnd('/');
+        string siteTitle = web.Title;
-        string siteTitle = ctx.Web.Title;
+        var lists = web.Lists.ToList();
-
-        var result = new List<StorageNode>();
-        var libs = ctx.Web.Lists
-            .Where(l => !l.Hidden && l.BaseType == BaseType.DocumentLibrary)
-            .ToList();
 
+        // ── Document libraries (incl. hidden + Preservation Hold) ───────────
+        // Track each library's RootFolder server-relative URL so bin items can
+        // be attributed back to their source library (matches storman.aspx,
+        // which folds bin contents into the owning library's Total Size).
+        var docLibs = lists.Where(l => l.BaseType == BaseType.DocumentLibrary).ToList();
+        var libsByRoot = new Dictionary<string, StorageNode>(StringComparer.OrdinalIgnoreCase);
         int idx = 0;
-        foreach (var lib in libs)
+        foreach (var lib in docLibs)
         {
             ct.ThrowIfCancellationRequested();
             idx++;
-            progress.Report(new OperationProgress(idx, libs.Count,
+
-                $"Loading storage metrics: {lib.Title} ({idx}/{libs.Count})"));
+            StorageNodeKind kind = ClassifyLibrary(lib);
+            if (kind == StorageNodeKind.HiddenLibrary && !options.IncludeHiddenLibraries) continue;
+            if (kind == StorageNodeKind.PreservationHold && !options.IncludePreservationHold) continue;
+
+            progress.Report(new OperationProgress(idx, docLibs.Count,
+                $"Loading storage metrics: {lib.Title} ({idx}/{docLibs.Count})"));
 
             var libNode = await LoadFolderNodeAsync(
                 ctx, lib.RootFolder.ServerRelativeUrl, lib.Title,
-                siteTitle, lib.Title, 0, progress, ct);
+                siteTitle, lib.Title, 0, kind, progress, ct);
 
             if (options.FolderDepth > 0)
             {
                 await CollectSubfoldersAsync(
-                    ctx, lib.RootFolder.ServerRelativeUrl,
+                    ctx, lib, lib.RootFolder.ServerRelativeUrl,
                     libNode, 1, options.FolderDepth,
-                    siteTitle, lib.Title, progress, ct);
+                    siteTitle, lib.Title, kind, progress, ct);
             }
 
+            // CSOM Folder.StorageMetrics is unreliable across the board for
+            // larger libraries — sometimes returns the storman value, sometimes
+            // returns a fraction of it, sometimes zero. Subfolder StorageMetrics
+            // are equally inconsistent. The only CSOM path that matches storman
+            // is per-file File.Length + File.Versions[*].Size enumeration, so
+            // run it unconditionally, replacing the CSOM totals.
+            ResetNodeCounts(libNode);
+            await BackfillLibFromFilesAsync(ctx, lib, libNode, progress, ct);
+
             result.Add(libNode);
+            libsByRoot[NormalizeServerRelative(lib.RootFolder.ServerRelativeUrl)] = libNode;
         }
 
-        return result;
+        // ── List attachments (non-document-library lists) ───────────────────
+        if (options.IncludeListAttachments)
+        {
+            var nonDocLists = lists
+                .Where(l => l.BaseType != BaseType.DocumentLibrary && !l.Hidden && l.ItemCount > 0)
+                .ToList();
+
+            int aIdx = 0;
+            foreach (var list in nonDocLists)
+            {
+                ct.ThrowIfCancellationRequested();
+                aIdx++;
+                progress.Report(new OperationProgress(aIdx, nonDocLists.Count,
+                    $"Scanning list attachments: {list.Title} ({aIdx}/{nonDocLists.Count})"));
+
+                var attachNode = await TryLoadAttachmentsNodeAsync(ctx, list, siteTitle, progress, ct);
+                if (attachNode != null && attachNode.TotalSizeBytes > 0)
+                    result.Add(attachNode);
+            }
+        }
+
+        // ── Recycle bin (stage 1 + stage 2) ─────────────────────────────────
+        if (options.IncludeRecycleBin)
+        {
+            progress.Report(OperationProgress.Indeterminate(
+                $"Scanning recycle bin: {siteTitle}..."));
+
+            var (rbNodes, perDir) = await LoadRecycleBinNodesAsync(ctx, web, siteTitle, progress, ct);
+
+            // Attribute bin items to owning library (longest-prefix match on DirName)
+            // so library Total Size matches storman.aspx, which counts an item's
+            // bytes against its source library even after deletion.
+            if (perDir.Count > 0 && libsByRoot.Count > 0)
+            {
+                var libRootsByLength = libsByRoot
+                    .OrderByDescending(kv => kv.Key.Length)
+                    .ToList();
+
+                foreach (var kv in perDir)
+                {
+                    string dirNorm = NormalizeServerRelative(kv.Key);
+                    foreach (var lib in libRootsByLength)
+                    {
+                        if (dirNorm.Equals(lib.Key, StringComparison.OrdinalIgnoreCase) ||
+                            dirNorm.StartsWith(lib.Key + "/", StringComparison.OrdinalIgnoreCase))
+                        {
+                            lib.Value.TotalSizeBytes += kv.Value.Size;
+                            lib.Value.TotalFileCount += kv.Value.Count;
+                            break;
+                        }
+                    }
+                }
+            }
+
+            result.AddRange(rbNodes);
+        }
+
+        // ── Subsites (recursive) ────────────────────────────────────────────
+        if (options.IncludeSubsites)
+        {
+            var subwebs = web.Webs.ToList();
+            foreach (var sub in subwebs)
+            {
+                ct.ThrowIfCancellationRequested();
+
+                // Build a node header so subsite results are visually grouped.
+                var subResult = new List<StorageNode>();
+                await CollectForWebAsync(ctx, sub, options, subResult, progress, ct);
+                if (subResult.Count == 0) continue;
+
+                // Bin contents already rolled up into each library's TotalSizeBytes
+                // (storman behavior); summing root RecycleBin children too would
+                // double-count. Filter them out here.
+                var subRoot = new StorageNode
+                {
+                    Name           = sub.Title,
+                    Url            = ctx.Url.TrimEnd('/') + sub.ServerRelativeUrl,
+                    SiteTitle      = sub.Title,
+                    Library        = string.Empty,
+                    Kind           = StorageNodeKind.Subsite,
+                    IndentLevel    = 0,
+                    Children       = subResult,
+                    TotalSizeBytes      = subResult.Where(n => n.Kind != StorageNodeKind.RecycleBin).Sum(n => n.TotalSizeBytes),
+                    FileStreamSizeBytes = subResult.Where(n => n.Kind != StorageNodeKind.RecycleBin).Sum(n => n.FileStreamSizeBytes),
+                    TotalFileCount      = subResult.Where(n => n.Kind != StorageNodeKind.RecycleBin).Sum(n => n.TotalFileCount)
+                };
+                result.Add(subRoot);
+            }
+        }
+    }
+
+    private static StorageNodeKind ClassifyLibrary(List lib)
+    {
+        if (lib.BaseTemplate == PreservationHoldTemplate ||
+            string.Equals(lib.Title, "Preservation Hold Library", StringComparison.OrdinalIgnoreCase))
+            return StorageNodeKind.PreservationHold;
+        return lib.Hidden ? StorageNodeKind.HiddenLibrary : StorageNodeKind.Library;
+    }
+
+    private static async Task<StorageNode?> TryLoadAttachmentsNodeAsync(
+        ClientContext ctx,
+        List list,
+        string siteTitle,
+        IProgress<OperationProgress> progress,
+        CancellationToken ct)
+    {
+        // Per-list attachments live in <listRootFolder>/Attachments/<itemId>/<file>.
+        // The Attachments folder may or may not exist depending on whether any
+        // item ever had an attachment — guard with try/catch.
+        string attachmentsUrl = list.RootFolder.ServerRelativeUrl.TrimEnd('/') + "/Attachments";
+
+        try
+        {
+            var folder = ctx.Web.GetFolderByServerRelativeUrl(attachmentsUrl);
+            ctx.Load(folder,
+                f => f.Exists,
+                f => f.StorageMetrics,
+                f => f.TimeLastModified,
+                f => f.ServerRelativeUrl);
+            await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
+
+            if (!folder.Exists || folder.StorageMetrics.TotalFileCount == 0)
+                return null;
+
+            DateTime? lastMod = folder.StorageMetrics.LastModified > DateTime.MinValue
+                ? folder.StorageMetrics.LastModified
+                : folder.TimeLastModified > DateTime.MinValue
+                    ? folder.TimeLastModified
+                    : (DateTime?)null;
+
+            return new StorageNode
+            {
+                Name                = $"[Attachments] {list.Title}",
+                Url                 = ctx.Url.TrimEnd('/') + attachmentsUrl,
+                SiteTitle           = siteTitle,
+                Library             = list.Title,
+                Kind                = StorageNodeKind.ListAttachments,
+                TotalSizeBytes      = folder.StorageMetrics.TotalSize,
+                FileStreamSizeBytes = folder.StorageMetrics.TotalFileStreamSize,
+                TotalFileCount      = folder.StorageMetrics.TotalFileCount,
+                LastModified        = lastMod,
+                IndentLevel         = 0,
+                Children            = new List<StorageNode>()
+            };
+        }
+        catch
+        {
+            // Attachments folder absent for this list — not an error.
+            return null;
+        }
+    }
+
+    private static async Task<(List<StorageNode> Nodes, Dictionary<string, (long Size, int Count)> PerDir)> LoadRecycleBinNodesAsync(
+        ClientContext ctx,
+        Web web,
+        string siteTitle,
+        IProgress<OperationProgress> progress,
+        CancellationToken ct)
+    {
+        var nodes = new List<StorageNode>();
+        var perDir = new Dictionary<string, (long Size, int Count)>(StringComparer.OrdinalIgnoreCase);
+
+        try
+        {
+            // Web-scoped: ctx.Site.RecycleBin would return the entire site-collection
+            // bin and inflate totals by (1 + N_subsites) when IncludeSubsites is on.
+            var bin = web.RecycleBin;
+            ctx.Load(bin, b => b.Include(
+                i => i.Size,
+                i => i.ItemState,
+                i => i.DeletedDate,
+                i => i.DirName));
+            await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
+
+            // RecycleBinItem.DirName is web-relative on SharePoint Online
+            // (e.g. "Documents/SubFolder" without leading slash or web URL).
+            // Prepend the web's ServerRelativeUrl so the result matches
+            // List.RootFolder.ServerRelativeUrl form used by libsByRoot.
+            string webSrl = NormalizeServerRelative(web.ServerRelativeUrl);
+
+            long stage1Size = 0, stage2Size = 0;
+            int stage1Count = 0, stage2Count = 0;
+            DateTime? stage1Last = null, stage2Last = null;
+
+            foreach (var item in bin)
+            {
+                if (item.ItemState == RecycleBinItemState.SecondStageRecycleBin)
+                {
+                    stage2Size += item.Size;
+                    stage2Count++;
+                    if (stage2Last is null || item.DeletedDate > stage2Last) stage2Last = item.DeletedDate;
+                }
+                else
+                {
+                    stage1Size += item.Size;
+                    stage1Count++;
+                    if (stage1Last is null || item.DeletedDate > stage1Last) stage1Last = item.DeletedDate;
+                }
+
+                string raw = item.DirName ?? string.Empty;
+                string dirSrl;
+                if (raw.StartsWith('/'))
+                    dirSrl = NormalizeServerRelative(raw);
+                else if (string.IsNullOrEmpty(raw))
+                    dirSrl = webSrl;
+                else
+                    dirSrl = NormalizeServerRelative(webSrl + "/" + raw);
+
+                if (perDir.TryGetValue(dirSrl, out var tally))
+                    perDir[dirSrl] = (tally.Size + item.Size, tally.Count + 1);
+                else
+                    perDir[dirSrl] = (item.Size, 1);
+            }
+
+            if (stage1Count > 0)
+                nodes.Add(new StorageNode
+                {
+                    Name                = "[Recycle Bin] First-stage",
+                    SiteTitle           = siteTitle,
+                    Library             = "RecycleBin",
+                    Kind                = StorageNodeKind.RecycleBin,
+                    TotalSizeBytes      = stage1Size,
+                    FileStreamSizeBytes = stage1Size,
+                    TotalFileCount      = stage1Count,
+                    LastModified        = stage1Last,
+                    IndentLevel         = 0,
+                    Children            = new List<StorageNode>()
+                });
+
+            if (stage2Count > 0)
+                nodes.Add(new StorageNode
+                {
+                    Name                = "[Recycle Bin] Second-stage",
+                    SiteTitle           = siteTitle,
+                    Library             = "RecycleBin",
+                    Kind                = StorageNodeKind.RecycleBin,
+                    TotalSizeBytes      = stage2Size,
+                    FileStreamSizeBytes = stage2Size,
+                    TotalFileCount      = stage2Count,
+                    LastModified        = stage2Last,
+                    IndentLevel         = 0,
+                    Children            = new List<StorageNode>()
+                });
+        }
+        catch
+        {
+            // Insufficient permission to read recycle bin or feature unavailable.
+        }
+
+        return (nodes, perDir);
+    }
+
+    /// <summary>
+    /// Normalizes a server-relative path for consistent prefix matching:
+    /// trims trailing slash, ensures single leading slash. SharePoint
+    /// inconsistently returns DirName with or without leading slash across
+    /// API surfaces, so the caller cannot rely on a canonical form.
+    /// </summary>
+    private static string NormalizeServerRelative(string? path)
+    {
+        if (string.IsNullOrEmpty(path)) return string.Empty;
+        string trimmed = path.Trim().TrimEnd('/');
+        if (trimmed.Length == 0) return string.Empty;
+        return trimmed.StartsWith('/') ? trimmed : "/" + trimmed;
     }
 
     public async Task<IReadOnlyList<FileTypeMetric>> CollectFileTypeMetricsAsync(
@@ -72,7 +374,6 @@ public class StorageService : IStorageService
     {
         ct.ThrowIfCancellationRequested();
 
-        // Load all non-hidden document libraries
         ctx.Load(ctx.Web,
             w => w.Lists.Include(
                 l => l.Title,
@@ -85,7 +386,6 @@ public class StorageService : IStorageService
             .Where(l => !l.Hidden && l.BaseType == BaseType.DocumentLibrary)
             .ToList();
 
-        // Accumulate file sizes by extension across all libraries
         var extensionMap = new Dictionary<string, (long totalSize, int count)>(StringComparer.OrdinalIgnoreCase);
 
         int libIdx = 0;
@@ -96,22 +396,17 @@ public class StorageService : IStorageService
             progress.Report(new OperationProgress(libIdx, libs.Count,
                 $"Scanning files by type: {lib.Title} ({libIdx}/{libs.Count})"));
 
-            // Use CamlQuery to enumerate all files in the library
+            // No <Where> clause: filtering on FSObjType (non-indexed) on a list
-            // Paginate with 500 items per batch to avoid list view threshold issues
+            // beyond 5000 items breaches the list view threshold. Page lightly,
+            // then second-pass load File.Length + Versions[*].Size so per-type
+            // totals include version bytes (matches per-library totals).
             var query = new CamlQuery
             {
                 ViewXml = @"<View Scope='RecursiveAll'>
-                    <Query>
+                    <Query></Query>
-                        <Where>
-                            <Eq>
-                                <FieldRef Name='FSObjType' />
-                                <Value Type='Integer'>0</Value>
-                            </Eq>
-                        </Where>
-                    </Query>
                     <ViewFields>
+                        <FieldRef Name='FSObjType' />
                         <FieldRef Name='FileLeafRef' />
-                        <FieldRef Name='File_x0020_Size' />
                     </ViewFields>
                     <RowLimit Paged='TRUE'>500</RowLimit>
                 </View>"
@@ -124,20 +419,41 @@ public class StorageService : IStorageService
                 items = lib.GetItems(query);
                 ctx.Load(items, ic => ic.ListItemCollectionPosition,
                     ic => ic.Include(
-                        i => i["FileLeafRef"],
+                        i => i["FSObjType"],
-                        i => i["File_x0020_Size"]));
+                        i => i["FileLeafRef"]));
                 await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
 
+                var fileRows = new List<(ListItem Item, string Name)>();
                 foreach (var item in items)
                 {
+                    if (item["FSObjType"]?.ToString() != "0") continue;
                     string fileName = item["FileLeafRef"]?.ToString() ?? string.Empty;
-                    string sizeStr = item["File_x0020_Size"]?.ToString() ?? "0";
+                    fileRows.Add((item, fileName));
+                    ctx.Load(item.File, f => f.Length);
+                    ctx.Load(item.File.Versions, vc => vc.Include(v => v.Size));
+                }
 
-                    if (!long.TryParse(sizeStr, out long fileSize))
+                if (fileRows.Count > 0)
-                        fileSize = 0;
+                {
+                    await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
+                }
 
-                    string ext = Path.GetExtension(fileName).ToLowerInvariant();
+                foreach (var row in fileRows)
-                    // ext is "" for extensionless files, ".docx" etc. for others
+                {
+                    long current;
+                    try { current = row.Item.File.Length; }
+                    catch { continue; }
+
+                    long versions = 0;
+                    try
+                    {
+                        foreach (var v in row.Item.File.Versions)
+                            versions += v.Size;
+                    }
+                    catch { /* no version history */ }
+
+                    long fileSize = current + versions;
+                    string ext = Path.GetExtension(row.Name).ToLowerInvariant();
 
                     if (extensionMap.TryGetValue(ext, out var existing))
                         extensionMap[ext] = (existing.totalSize + fileSize, existing.count + 1);
@@ -145,132 +461,178 @@ public class StorageService : IStorageService
                         extensionMap[ext] = (fileSize, 1);
                 }
 
-                // Move to next page
                 query.ListItemCollectionPosition = items.ListItemCollectionPosition;
             }
             while (items.ListItemCollectionPosition != null);
         }
 
-        // Convert to FileTypeMetric list, sorted by size descending
         return extensionMap
             .Select(kvp => new FileTypeMetric(kvp.Key, kvp.Value.totalSize, kvp.Value.count))
             .OrderByDescending(m => m.TotalSizeBytes)
             .ToList();
     }
 
-    public async Task BackfillZeroNodesAsync(
+    /// <summary>
+    /// Per-library backfill executed inline by CollectForWebAsync when CSOM's
+    /// Folder.StorageMetrics returns zero counts. Enumerates every file via
+    /// CamlQuery and explicitly loads File.Length + File.Versions.Size so
+    /// version bytes are summed accurately — matches what storman.aspx reports.
+    /// </summary>
+    private static async Task BackfillLibFromFilesAsync(
+        ClientContext ctx,
+        List lib,
+        StorageNode libNode,
+        IProgress<OperationProgress> progress,
+        CancellationToken ct)
+    {
+        progress.Report(OperationProgress.Indeterminate(
+            $"Counting files: {libNode.Name}..."));
+
+        string libRootSrl = NormalizeServerRelative(lib.RootFolder.ServerRelativeUrl);
+
+        var folderLookup = new Dictionary<string, StorageNode>(StringComparer.OrdinalIgnoreCase);
+        BuildFolderLookup(libNode, libRootSrl, folderLookup);
+
+        // No <Where> clause: filtering on FSObjType (non-indexed) on a list
+        // beyond the 5000-item view threshold throws "The attempted operation
+        // is prohibited because it exceeds the list view threshold". Paged
+        // retrieval without Where is unaffected by the threshold; we filter
+        // out folders client-side and skip File.Length access for them.
+        // Smaller page size because each row carries the full Versions collection.
+        var query = new CamlQuery
+        {
+            ViewXml = @"<View Scope='RecursiveAll'>
+                <Query></Query>
+                <ViewFields>
+                    <FieldRef Name='FSObjType' />
+                    <FieldRef Name='FileDirRef' />
+                </ViewFields>
+                <RowLimit Paged='TRUE'>500</RowLimit>
+            </View>"
+        };
+
+        ListItemCollection items;
+        do
+        {
+            ct.ThrowIfCancellationRequested();
+            items = lib.GetItems(query);
+            ctx.Load(items, ic => ic.ListItemCollectionPosition,
+                ic => ic.Include(
+                    i => i["FSObjType"],
+                    i => i["FileDirRef"]));
+            await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
+
+            // Second pass: queue File.Length + File.Versions[*].Size only for
+            // file rows. Including these in the page 1 query throws a
+            // ServerObjectNullReferenceException on folder rows (item.File is
+            // null for folders). Filtering FSObjType client-side here keeps
+            // per-page round-trips at two regardless of file count.
+            var fileRows = new List<(ListItem Item, string DirRef)>();
+            foreach (var item in items)
+            {
+                if (item["FSObjType"]?.ToString() != "0") continue;
+                var dirRef = item["FileDirRef"]?.ToString() ?? string.Empty;
+                fileRows.Add((item, dirRef));
+                ctx.Load(item.File, f => f.Length);
+                ctx.Load(item.File.Versions, vc => vc.Include(v => v.Size));
+            }
+
+            if (fileRows.Count > 0)
+            {
+                await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
+            }
+
+            foreach (var row in fileRows)
+            {
+                long current;
+                try { current = row.Item.File.Length; }
+                catch { continue; }
+
+                long versions = 0;
+                try
+                {
+                    foreach (var v in row.Item.File.Versions)
+                        versions += v.Size;
+                }
+                catch
+                {
+                    // Versioning disabled / no version history — leave at 0.
+                }
+
+                long totalSize = current + versions;
+
+                // Attribute each file to its deepest matching folder only.
+                // Parent rollup happens once after all pages are processed,
+                // adding direct + descendants — matches storman's per-folder
+                // total. Fall back to libNode for files at lib root or in
+                // folders excluded from the tree (Forms, _-prefixed system
+                // folders, depth-limited subfolders).
+                var target = FindDeepestFolder(row.DirRef, folderLookup) ?? libNode;
+                target.TotalSizeBytes      += totalSize;
+                target.FileStreamSizeBytes += current;
+                target.TotalFileCount++;
+            }
+
+            query.ListItemCollectionPosition = items.ListItemCollectionPosition;
+        }
+        while (items.ListItemCollectionPosition != null);
+
+        // Post-pass rollup: each folder's totals become own-direct + sum of
+        // descendants. libNode ends up as total of every file in the tree.
+        RollupFolderTotals(libNode);
+    }
+
+    /// <summary>
+    /// Recursively rolls up direct-file totals into ancestor folders so each
+    /// node's reported size includes everything beneath it. Pre-condition: each
+    /// node holds only its directly-attributed files (no descendant amounts).
+    /// </summary>
+    private static void RollupFolderTotals(StorageNode node)
+    {
+        foreach (var child in node.Children)
+        {
+            RollupFolderTotals(child);
+            node.TotalSizeBytes      += child.TotalSizeBytes;
+            node.FileStreamSizeBytes += child.FileStreamSizeBytes;
+            node.TotalFileCount      += child.TotalFileCount;
+        }
+    }
+
+    /// <summary>
+    /// No-op retained for interface compatibility. Backfill now runs inline
+    /// inside <see cref="CollectStorageAsync"/> via BackfillLibFromFilesAsync,
+    /// which has access to the CSOM library reference and runs before bin
+    /// distribution so the count==0 trigger is not polluted by bin items.
+    /// </summary>
+    public Task BackfillZeroNodesAsync(
         ClientContext ctx,
         IReadOnlyList<StorageNode> nodes,
         IProgress<OperationProgress> progress,
         CancellationToken ct)
+        => Task.CompletedTask;
+
+    public async Task<long> GetSiteUsageStorageBytesAsync(
+        ClientContext ctx,
+        IProgress<OperationProgress> progress,
+        CancellationToken ct)
     {
-        // Find root-level library nodes that have any zero-valued nodes in their tree
+        try
-        var libNodes = nodes.Where(n => n.IndentLevel == 0).ToList();
-        var needsBackfill = libNodes.Where(lib =>
-            lib.TotalFileCount == 0 || HasZeroChild(lib)).ToList();
-        if (needsBackfill.Count == 0) return;
-
-        // Load libraries to get RootFolder.ServerRelativeUrl for path matching
-        ctx.Load(ctx.Web, w => w.ServerRelativeUrl,
-            w => w.Lists.Include(
-                l => l.Title, l => l.Hidden, l => l.BaseType,
-                l => l.RootFolder.ServerRelativeUrl));
-        await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
-
-        var libs = ctx.Web.Lists
-            .Where(l => !l.Hidden && l.BaseType == BaseType.DocumentLibrary)
-            .ToDictionary(l => l.Title, StringComparer.OrdinalIgnoreCase);
-
-        int idx = 0;
-        foreach (var libNode in needsBackfill)
         {
-            ct.ThrowIfCancellationRequested();
+            ctx.Load(ctx.Site, s => s.Usage);
-            idx++;
+            await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
-
+            return ctx.Site.Usage.Storage;
-            if (!libs.TryGetValue(libNode.Name, out var lib)) continue;
-
-            progress.Report(new OperationProgress(idx, needsBackfill.Count,
-                $"Counting files: {libNode.Name} ({idx}/{needsBackfill.Count})"));
-
-            string libRootSrl = lib.RootFolder.ServerRelativeUrl.TrimEnd('/');
-
-            // Build a lookup of all folder nodes in this library's tree (by server-relative path)
-            var folderLookup = new Dictionary<string, StorageNode>(StringComparer.OrdinalIgnoreCase);
-            BuildFolderLookup(libNode, libRootSrl, folderLookup);
-
-            // Reset all nodes in this tree to zero before accumulating
-            ResetNodeCounts(libNode);
-
-            // Enumerate all files with their folder path
-            var query = new CamlQuery
-            {
-                ViewXml = @"<View Scope='RecursiveAll'>
-                    <Query><Where>
-                        <Eq><FieldRef Name='FSObjType' /><Value Type='Integer'>0</Value></Eq>
-                    </Where></Query>
-                    <ViewFields>
-                        <FieldRef Name='FileDirRef' />
-                        <FieldRef Name='File_x0020_Size' />
-                    </ViewFields>
-                    <RowLimit Paged='TRUE'>500</RowLimit>
-                </View>"
-            };
-
-            ListItemCollection items;
-            do
-            {
-                ct.ThrowIfCancellationRequested();
-                items = lib.GetItems(query);
-                ctx.Load(items, ic => ic.ListItemCollectionPosition,
-                    ic => ic.Include(
-                        i => i["FileDirRef"],
-                        i => i["File_x0020_Size"]));
-                await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
-
-                foreach (var item in items)
-                {
-                    long size = 0;
-                    if (long.TryParse(item["File_x0020_Size"]?.ToString() ?? "0", out long s))
-                        size = s;
-
-                    string fileDirRef = item["FileDirRef"]?.ToString() ?? "";
-
-                    // Always count toward the library root
-                    libNode.TotalSizeBytes += size;
-                    libNode.FileStreamSizeBytes += size;
-                    libNode.TotalFileCount++;
-
-                    // Also count toward the most specific matching subfolder
-                    var matchedFolder = FindDeepestFolder(fileDirRef, folderLookup);
-                    if (matchedFolder != null && matchedFolder != libNode)
-                    {
-                        matchedFolder.TotalSizeBytes += size;
-                        matchedFolder.FileStreamSizeBytes += size;
-                        matchedFolder.TotalFileCount++;
-                    }
-                }
-
-                query.ListItemCollectionPosition = items.ListItemCollectionPosition;
-            }
-            while (items.ListItemCollectionPosition != null);
         }
-    }
+        catch
-
-    private static bool HasZeroChild(StorageNode node)
-    {
-        foreach (var child in node.Children)
         {
-            if (child.TotalFileCount == 0) return true;
+            return 0L;
-            if (HasZeroChild(child)) return true;
         }
-        return false;
     }
 
     private static void ResetNodeCounts(StorageNode node)
     {
-        node.TotalSizeBytes = 0;
+        node.TotalSizeBytes      = 0;
         node.FileStreamSizeBytes = 0;
-        node.TotalFileCount = 0;
+        node.TotalFileCount      = 0;
         foreach (var child in node.Children)
             ResetNodeCounts(child);
     }
@@ -290,8 +652,6 @@ public class StorageService : IStorageService
     private static StorageNode? FindDeepestFolder(string fileDirRef,
         Dictionary<string, StorageNode> lookup)
     {
-        // fileDirRef is the server-relative folder path, e.g. "/sites/hr/Shared Documents/Reports"
-        // Try exact match, then walk up until we find a match
         string path = fileDirRef.TrimEnd('/');
         while (!string.IsNullOrEmpty(path))
         {
@@ -304,7 +664,7 @@ public class StorageService : IStorageService
         return null;
     }
 
-    // -- Private helpers -----------------------------------------------------
+    // ── Library/folder loading helpers ──────────────────────────────────────
 
     private static async Task<StorageNode> LoadFolderNodeAsync(
         ClientContext ctx,
@@ -313,6 +673,7 @@ public class StorageService : IStorageService
         string siteTitle,
         string library,
         int indentLevel,
+        StorageNodeKind kind,
         IProgress<OperationProgress> progress,
         CancellationToken ct)
     {
@@ -338,6 +699,7 @@ public class StorageService : IStorageService
             Url                 = ctx.Url.TrimEnd('/') + serverRelativeUrl,
             SiteTitle           = siteTitle,
             Library             = library,
+            Kind                = kind,
             TotalSizeBytes      = folder.StorageMetrics.TotalSize,
             FileStreamSizeBytes = folder.StorageMetrics.TotalFileStreamSize,
             TotalFileCount      = folder.StorageMetrics.TotalFileCount,
@@ -349,45 +711,54 @@ public class StorageService : IStorageService
 
     private static async Task CollectSubfoldersAsync(
         ClientContext ctx,
+        List list,
         string parentServerRelativeUrl,
         StorageNode parentNode,
         int currentDepth,
         int maxDepth,
         string siteTitle,
         string library,
+        StorageNodeKind kind,
         IProgress<OperationProgress> progress,
         CancellationToken ct)
     {
         if (currentDepth > maxDepth) return;
         ct.ThrowIfCancellationRequested();
 
-        // Load direct child folders of this folder
+        var subfolders = new List<(string Name, string ServerRelativeUrl)>();
-        Folder parentFolder = ctx.Web.GetFolderByServerRelativeUrl(parentServerRelativeUrl);
-        ctx.Load(parentFolder,
-            f => f.Folders.Include(
-                sf => sf.Name,
-                sf => sf.ServerRelativeUrl));
-        await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
 
-        foreach (Folder subFolder in parentFolder.Folders)
+        await foreach (var item in SharePointPaginationHelper.GetItemsInFolderAsync(
+            ctx, list, parentServerRelativeUrl, recursive: false,
+            viewFields: new[] { "FSObjType", "FileLeafRef", "FileRef" },
+            ct: ct))
+        {
+            if (item["FSObjType"]?.ToString() != "1") continue;
+
+            string name = item["FileLeafRef"]?.ToString() ?? string.Empty;
+            string url  = item["FileRef"]?.ToString() ?? string.Empty;
+            if (string.IsNullOrEmpty(name) || string.IsNullOrEmpty(url)) continue;
+
+            if (name.Equals("Forms", StringComparison.OrdinalIgnoreCase) ||
+                name.StartsWith("_", StringComparison.Ordinal))
+                continue;
+
+            subfolders.Add((name, url));
+        }
+
+        foreach (var sub in subfolders)
         {
             ct.ThrowIfCancellationRequested();
 
-            // Skip SharePoint system folders
-            if (subFolder.Name.Equals("Forms", StringComparison.OrdinalIgnoreCase) ||
-                subFolder.Name.StartsWith("_", StringComparison.Ordinal))
-                continue;
-
             var childNode = await LoadFolderNodeAsync(
-                ctx, subFolder.ServerRelativeUrl, subFolder.Name,
+                ctx, sub.ServerRelativeUrl, sub.Name,
-                siteTitle, library, currentDepth, progress, ct);
+                siteTitle, library, currentDepth, kind, progress, ct);
 
             if (currentDepth < maxDepth)
             {
                 await CollectSubfoldersAsync(
-                    ctx, subFolder.ServerRelativeUrl, childNode,
+                    ctx, list, sub.ServerRelativeUrl, childNode,
                     currentDepth + 1, maxDepth,
-                    siteTitle, library, progress, ct);
+                    siteTitle, library, kind, progress, ct);
             }
 
             parentNode.Children.Add(childNode);

SharepointToolbox/Services/TemplateService.cs

@@ -93,8 +93,7 @@ public class TemplateService : ITemplateService
                 {
                     ctx.Load(list.RootFolder, f => f.ServerRelativeUrl);
                     await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
-                    libInfo.Folders = await EnumerateFoldersRecursiveAsync(
+                    libInfo.Folders = await EnumerateLibraryFoldersAsync(ctx, list, ct);
-                        ctx, list.RootFolder, string.Empty, progress, ct);
                 }
 
                 template.Libraries.Add(libInfo);
@@ -293,39 +292,72 @@ public class TemplateService : ITemplateService
         return siteUrl;
     }
 
-    private async Task<List<TemplateFolderInfo>> EnumerateFoldersRecursiveAsync(
+    /// <summary>
+    /// Enumerates every folder in a library via one paginated CAML scan, then
+    /// reconstructs the hierarchy from the server-relative paths. Replaces the
+    /// former per-level Folder.Folders lazy loading, which hits the list-view
+    /// threshold on libraries above 5,000 items.
+    /// </summary>
+    private static async Task<List<TemplateFolderInfo>> EnumerateLibraryFoldersAsync(
         ClientContext ctx,
-        Folder parentFolder,
+        List list,
-        string parentRelativePath,
-        IProgress<OperationProgress> progress,
         CancellationToken ct)
     {
         ct.ThrowIfCancellationRequested();
-        var result = new List<TemplateFolderInfo>();
 
-        ctx.Load(parentFolder, f => f.Folders.Include(sf => sf.Name, sf => sf.ServerRelativeUrl));
+        var rootUrl = list.RootFolder.ServerRelativeUrl.TrimEnd('/');
-        await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
 
-        foreach (var subFolder in parentFolder.Folders)
+        // Collect all folders flat: (relativePath, parentRelativePath).
+        var folders = new List<(string Relative, string Parent)>();
+
+        await foreach (var item in SharePointPaginationHelper.GetItemsInFolderAsync(
+            ctx, list, rootUrl, recursive: true,
+            viewFields: new[] { "FSObjType", "FileLeafRef", "FileRef", "FileDirRef" },
+            ct: ct))
         {
-            // Skip system folders
+            if (item["FSObjType"]?.ToString() != "1") continue; // folders only
-            if (subFolder.Name.StartsWith("_") || subFolder.Name == "Forms")
+
+            var name    = item["FileLeafRef"]?.ToString() ?? string.Empty;
+            var fileRef = (item["FileRef"]?.ToString() ?? string.Empty).TrimEnd('/');
+            var dirRef  = (item["FileDirRef"]?.ToString() ?? string.Empty).TrimEnd('/');
+
+            if (string.IsNullOrEmpty(name) || string.IsNullOrEmpty(fileRef)) continue;
+            if (name.StartsWith("_", StringComparison.Ordinal) ||
+                name.Equals("Forms", StringComparison.OrdinalIgnoreCase))
                 continue;
 
-            var relativePath = string.IsNullOrEmpty(parentRelativePath)
+            // Paths relative to the library root.
-                ? subFolder.Name
+            var rel = fileRef.StartsWith(rootUrl, StringComparison.OrdinalIgnoreCase)
-                : $"{parentRelativePath}/{subFolder.Name}";
+                ? fileRef.Substring(rootUrl.Length).TrimStart('/')
+                : name;
+            var parentRel = dirRef.StartsWith(rootUrl, StringComparison.OrdinalIgnoreCase)
+                ? dirRef.Substring(rootUrl.Length).TrimStart('/')
+                : string.Empty;
 
-            var folderInfo = new TemplateFolderInfo
+            folders.Add((rel, parentRel));
-            {
-                Name = subFolder.Name,
-                RelativePath = relativePath,
-                Children = await EnumerateFoldersRecursiveAsync(ctx, subFolder, relativePath, progress, ct),
-            };
-            result.Add(folderInfo);
         }
 
-        return result;
+        // Build tree keyed by relative path.
+        var nodes = folders.ToDictionary(
+            f => f.Relative,
+            f => new TemplateFolderInfo
+            {
+                Name = System.IO.Path.GetFileName(f.Relative),
+                RelativePath = f.Relative,
+                Children = new List<TemplateFolderInfo>(),
+            },
+            StringComparer.OrdinalIgnoreCase);
+
+        var roots = new List<TemplateFolderInfo>();
+        foreach (var (rel, parent) in folders)
+        {
+            if (!nodes.TryGetValue(rel, out var node)) continue;
+            if (!string.IsNullOrEmpty(parent) && nodes.TryGetValue(parent, out var p))
+                p.Children.Add(node);
+            else
+                roots.Add(node);
+        }
+        return roots;
     }
 
     private static async Task CreateFoldersFromTemplateAsync(

SharepointToolbox/Services/ThemeManager.cs

@@ -0,0 +1,135 @@
+using System.Windows;
+using Microsoft.Win32;
+using Microsoft.Extensions.Logging;
+
+namespace SharepointToolbox.Services;
+
+public enum ThemeMode { System, Light, Dark }
+
+/// <summary>
+/// Swaps the merged palette dictionary at runtime so all DynamicResource brush lookups retint live.
+/// "System" mode reads HKCU AppsUseLightTheme (0 = dark, 1 = light) and subscribes to system theme changes.
+/// </summary>
+public class ThemeManager
+{
+    private const string LightPaletteSource = "pack://application:,,,/Themes/LightPalette.xaml";
+    private const string DarkPaletteSource  = "pack://application:,,,/Themes/DarkPalette.xaml";
+    private const string PersonalizeKey = @"Software\Microsoft\Windows\CurrentVersion\Themes\Personalize";
+
+    private readonly ILogger<ThemeManager> _logger;
+    private ThemeMode _mode = ThemeMode.System;
+    private bool _systemSubscribed;
+
+    public event EventHandler? ThemeChanged;
+
+    public ThemeMode Mode => _mode;
+    public bool IsDarkActive { get; private set; }
+
+    public ThemeManager(ILogger<ThemeManager> logger)
+    {
+        _logger = logger;
+    }
+
+    public void ApplyMode(ThemeMode mode)
+    {
+        _mode = mode;
+        bool dark = ResolveDark(mode);
+        ApplyPalette(dark);
+        EnsureSystemSubscription(mode);
+    }
+
+    public void ApplyFromString(string? value)
+    {
+        var mode = (value ?? "System") switch
+        {
+            "Light" => ThemeMode.Light,
+            "Dark"  => ThemeMode.Dark,
+            _        => ThemeMode.System,
+        };
+        ApplyMode(mode);
+    }
+
+    private bool ResolveDark(ThemeMode mode) => mode switch
+    {
+        ThemeMode.Light => false,
+        ThemeMode.Dark  => true,
+        _               => ReadSystemPrefersDark(),
+    };
+
+    private bool ReadSystemPrefersDark()
+    {
+        try
+        {
+            using var key = Registry.CurrentUser.OpenSubKey(PersonalizeKey);
+            if (key?.GetValue("AppsUseLightTheme") is int v)
+                return v == 0;
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "Failed to read system theme preference, defaulting to light");
+        }
+        return false;
+    }
+
+    private void ApplyPalette(bool dark)
+    {
+        var app = Application.Current;
+        if (app is null) return;
+
+        var newPalette = new ResourceDictionary
+        {
+            Source = new Uri(dark ? DarkPaletteSource : LightPaletteSource, UriKind.Absolute)
+        };
+
+        var dicts = app.Resources.MergedDictionaries;
+        int replaced = -1;
+        for (int i = 0; i < dicts.Count; i++)
+        {
+            var src = dicts[i].Source?.OriginalString ?? string.Empty;
+            if (src.EndsWith("LightPalette.xaml", StringComparison.OrdinalIgnoreCase) ||
+                src.EndsWith("DarkPalette.xaml",  StringComparison.OrdinalIgnoreCase))
+            {
+                replaced = i;
+                break;
+            }
+        }
+
+        if (replaced >= 0)
+            dicts[replaced] = newPalette;
+        else
+            dicts.Insert(0, newPalette);
+
+        IsDarkActive = dark;
+        ThemeChanged?.Invoke(this, EventArgs.Empty);
+    }
+
+    private void EnsureSystemSubscription(ThemeMode mode)
+    {
+        if (mode == ThemeMode.System && !_systemSubscribed)
+        {
+            SystemEvents.UserPreferenceChanged += OnUserPreferenceChanged;
+            _systemSubscribed = true;
+        }
+        else if (mode != ThemeMode.System && _systemSubscribed)
+        {
+            SystemEvents.UserPreferenceChanged -= OnUserPreferenceChanged;
+            _systemSubscribed = false;
+        }
+    }
+
+    private void OnUserPreferenceChanged(object? sender, UserPreferenceChangedEventArgs e)
+    {
+        if (e.Category != UserPreferenceCategory.General) return;
+        if (_mode != ThemeMode.System) return;
+
+        var app = Application.Current;
+        if (app is null) return;
+
+        app.Dispatcher.BeginInvoke(new Action(() =>
+        {
+            bool dark = ReadSystemPrefersDark();
+            if (dark != IsDarkActive)
+                ApplyPalette(dark);
+        }));
+    }
+}

SharepointToolbox/Services/UserAccessAuditService.cs

@@ -29,7 +29,8 @@ public class UserAccessAuditService : IUserAccessAuditService
         IReadOnlyList<SiteInfo> sites,
         ScanOptions options,
         IProgress<OperationProgress> progress,
-        CancellationToken ct)
+        CancellationToken ct,
+        Func<string, CancellationToken, Task<bool>>? onAccessDenied = null)
     {
         // Normalize target logins for case-insensitive matching.
         // Users may be identified by email ("alice@contoso.com") or full claim
@@ -59,10 +60,21 @@ public class UserAccessAuditService : IUserAccessAuditService
             };
 
             var ctx = await sessionManager.GetOrCreateContextAsync(profile, ct);
-            var permEntries = await _permissionsService.ScanSiteAsync(ctx, options, progress, ct);
+            IReadOnlyList<PermissionEntry> permEntries;
+            try
+            {
+                permEntries = await _permissionsService.ScanSiteAsync(ctx, options, progress, ct);
+            }
+            catch (Microsoft.SharePoint.Client.ServerUnauthorizedAccessException) when (onAccessDenied != null)
+            {
+                var elevated = await onAccessDenied(site.Url, ct);
+                if (!elevated)
+                    throw;
+                var retryCtx = await sessionManager.GetOrCreateContextAsync(profile, ct);
+                permEntries = await _permissionsService.ScanSiteAsync(retryCtx, options, progress, ct);
+            }
 
-            var userEntries = TransformEntries(permEntries, targets, site);
+            allEntries.AddRange(TransformEntries(permEntries, targets, site));
-            allEntries.AddRange(userEntries);
         }
 
         progress.Report(new OperationProgress(sites.Count, sites.Count,

SharepointToolbox/Services/VersionCleanupService.cs

@@ -0,0 +1,189 @@
+using Microsoft.Extensions.Logging;
+using Microsoft.SharePoint.Client;
+using SharepointToolbox.Core.Helpers;
+using SharepointToolbox.Core.Models;
+
+namespace SharepointToolbox.Services;
+
+public class VersionCleanupService : IVersionCleanupService
+{
+    private readonly ILogger<VersionCleanupService> _logger;
+
+    public VersionCleanupService(ILogger<VersionCleanupService> logger)
+    {
+        _logger = logger;
+    }
+
+    public async Task<IReadOnlyList<string>> ListLibraryTitlesAsync(
+        ClientContext ctx,
+        CancellationToken ct)
+    {
+        ct.ThrowIfCancellationRequested();
+        ctx.Load(ctx.Web,
+            w => w.Lists.Include(
+                l => l.Title,
+                l => l.Hidden,
+                l => l.BaseType));
+        await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, null, ct);
+        return ctx.Web.Lists
+            .Where(l => !l.Hidden && l.BaseType == BaseType.DocumentLibrary)
+            .Select(l => l.Title)
+            .OrderBy(t => t, StringComparer.OrdinalIgnoreCase)
+            .ToList();
+    }
+
+    public async Task<IReadOnlyList<VersionCleanupResult>> DeleteOldVersionsAsync(
+        ClientContext ctx,
+        VersionCleanupOptions options,
+        IProgress<OperationProgress> progress,
+        CancellationToken ct)
+    {
+        ct.ThrowIfCancellationRequested();
+
+        if (options.KeepLast < 0)
+            throw new ArgumentOutOfRangeException(nameof(options), "KeepLast must be >= 0.");
+
+        ctx.Load(ctx.Web, w => w.Url, w => w.ServerRelativeUrl,
+            w => w.Lists.Include(
+                l => l.Title,
+                l => l.Hidden,
+                l => l.BaseType,
+                l => l.RootFolder.ServerRelativeUrl));
+        await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
+
+        var allLibs = ctx.Web.Lists
+            .Where(l => !l.Hidden && l.BaseType == BaseType.DocumentLibrary)
+            .ToList();
+
+        var titleFilter = options.LibraryTitles?.Count > 0
+            ? new HashSet<string>(options.LibraryTitles, StringComparer.OrdinalIgnoreCase)
+            : null;
+
+        var libs = titleFilter is null
+            ? allLibs
+            : allLibs.Where(l => titleFilter.Contains(l.Title)).ToList();
+
+        var results = new List<VersionCleanupResult>();
+        var siteUrl = ctx.Web.Url;
+
+        int libIdx = 0;
+        foreach (var lib in libs)
+        {
+            ct.ThrowIfCancellationRequested();
+            libIdx++;
+            progress.Report(new OperationProgress(libIdx, libs.Count,
+                $"Scanning versions: {lib.Title} ({libIdx}/{libs.Count})"));
+
+            // Enumerate files via paginated CAML so libs > 5,000 items work.
+            var files = new List<string>();
+            await foreach (var item in SharePointPaginationHelper.GetItemsInFolderAsync(
+                ctx, lib, lib.RootFolder.ServerRelativeUrl, recursive: true,
+                viewFields: new[] { "FSObjType", "FileRef" },
+                ct: ct))
+            {
+                if (item["FSObjType"]?.ToString() != "0") continue;
+                var fileRef = item["FileRef"]?.ToString();
+                if (!string.IsNullOrEmpty(fileRef))
+                    files.Add(fileRef);
+            }
+
+            int fileIdx = 0;
+            foreach (var fileRef in files)
+            {
+                ct.ThrowIfCancellationRequested();
+                fileIdx++;
+                if (fileIdx % 25 == 0 || fileIdx == files.Count)
+                {
+                    progress.Report(new OperationProgress(fileIdx, files.Count,
+                        $"{lib.Title}: {fileIdx}/{files.Count} files"));
+                }
+
+                var result = await TrimFileVersionsAsync(
+                    ctx, siteUrl, lib.Title, fileRef, options, progress, ct);
+                if (result is not null)
+                    results.Add(result);
+            }
+        }
+
+        return results;
+    }
+
+    private async Task<VersionCleanupResult?> TrimFileVersionsAsync(
+        ClientContext ctx,
+        string siteUrl,
+        string libraryTitle,
+        string fileServerRelativeUrl,
+        VersionCleanupOptions options,
+        IProgress<OperationProgress> progress,
+        CancellationToken ct)
+    {
+        try
+        {
+            var file = ctx.Web.GetFileByServerRelativeUrl(fileServerRelativeUrl);
+            ctx.Load(file, f => f.Name);
+            ctx.Load(file.Versions,
+                vs => vs.Include(
+                    v => v.VersionLabel,
+                    v => v.Created,
+                    v => v.Size));
+            await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
+
+            // file.Versions contains only HISTORICAL versions; the current published
+            // version lives on `file` itself and is never deletable here.
+            var versions = file.Versions.ToList();
+            int before = versions.Count;
+            if (before == 0) return null;
+
+            // Sort by Created ascending so [0] is the oldest historical version.
+            var ordered = versions
+                .OrderBy(v => v.Created)
+                .ToList();
+
+            // Preserve set: the last N most recent + optionally the very first.
+            var keep = new HashSet<int>();
+            int keepLast = Math.Min(options.KeepLast, ordered.Count);
+            for (int i = ordered.Count - keepLast; i < ordered.Count; i++)
+                keep.Add(i);
+            if (options.KeepFirst && ordered.Count > 0)
+                keep.Add(0);
+
+            long bytesFreed = 0;
+            int deleted = 0;
+            for (int i = 0; i < ordered.Count; i++)
+            {
+                if (keep.Contains(i)) continue;
+                var v = ordered[i];
+                bytesFreed += v.Size;
+                v.DeleteObject();
+                deleted++;
+            }
+
+            if (deleted == 0) return null;
+            await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(ctx, progress, ct);
+
+            return new VersionCleanupResult
+            {
+                SiteUrl = siteUrl,
+                Library = libraryTitle,
+                FileServerRelativeUrl = fileServerRelativeUrl,
+                FileName = System.IO.Path.GetFileName(fileServerRelativeUrl),
+                VersionsBefore = before,
+                VersionsDeleted = deleted,
+                VersionsRemaining = before - deleted,
+                BytesFreed = bytesFreed,
+            };
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "Failed to trim versions for {File}", fileServerRelativeUrl);
+            return new VersionCleanupResult
+            {
+                SiteUrl = siteUrl,
+                Library = libraryTitle,
+                FileServerRelativeUrl = fileServerRelativeUrl,
+                FileName = System.IO.Path.GetFileName(fileServerRelativeUrl),
+                Error = ex.Message,
+            };
+        }
+    }
+}

SharepointToolbox/SharepointToolbox.csproj

@@ -8,6 +8,7 @@
     <UseWPF>true</UseWPF>
     <PublishTrimmed>false</PublishTrimmed>
     <StartupObject>SharepointToolbox.App</StartupObject>
+    <ApplicationIcon>Resources\SPToolbox-logo.ico</ApplicationIcon>
     <!-- LiveCharts2 transitive deps (SkiaSharp.Views.WPF, OpenTK) lack net10.0 targets but work at runtime -->
     <NoWarn>$(NoWarn);NU1701</NoWarn>
   </PropertyGroup>
@@ -43,6 +44,8 @@
     <EmbeddedResource Include="Resources\bulk_add_members.csv" />
     <EmbeddedResource Include="Resources\bulk_create_sites.csv" />
     <EmbeddedResource Include="Resources\folder_structure.csv" />
+    <Resource Include="Resources\SPToolbox-logo-ico.png" />
+    <Resource Include="Resources\SPToolbox-logo.ico" />
   </ItemGroup>
 
   <ItemGroup>

SharepointToolbox/Themes/DarkPalette.xaml

@@ -0,0 +1,27 @@
+<ResourceDictionary xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+                    xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml">
+
+  <!-- Dark palette -->
+  <SolidColorBrush x:Key="AppBgBrush"         Color="#15181F" />
+  <SolidColorBrush x:Key="SurfaceBrush"       Color="#1E2230" />
+  <SolidColorBrush x:Key="SurfaceAltBrush"    Color="#272C3B" />
+  <SolidColorBrush x:Key="SurfaceAltBrushAlt" Color="#222636" />
+  <SolidColorBrush x:Key="BorderSoftBrush"    Color="#323849" />
+  <SolidColorBrush x:Key="BorderStrongBrush"  Color="#3F475B" />
+  <SolidColorBrush x:Key="TextBrush"          Color="#E7EAF1" />
+  <SolidColorBrush x:Key="TextMutedBrush"     Color="#9AA3B2" />
+  <SolidColorBrush x:Key="AccentBrush"        Color="#60A5FA" />
+  <SolidColorBrush x:Key="AccentHoverBrush"   Color="#3B82F6" />
+  <SolidColorBrush x:Key="AccentPressedBrush" Color="#2563EB" />
+  <SolidColorBrush x:Key="AccentSoftBrush"    Color="#1E3A5F" />
+  <SolidColorBrush x:Key="AccentForegroundBrush" Color="#0B1220" />
+  <SolidColorBrush x:Key="DangerBrush"        Color="#F87171" />
+  <SolidColorBrush x:Key="SuccessBrush"       Color="#34D399" />
+  <!-- Forced-dark text for elements painted with hardcoded light pastel backgrounds (risk tiles, colored rows). -->
+  <SolidColorBrush x:Key="OnColoredBgBrush"   Color="#1F2430" />
+  <SolidColorBrush x:Key="SelectionBrush"     Color="#2A4572" />
+  <SolidColorBrush x:Key="ScrollThumbBrush"   Color="#4A5366" />
+  <SolidColorBrush x:Key="TooltipBgBrush"     Color="#0B1220" />
+  <SolidColorBrush x:Key="TooltipFgBrush"     Color="#E7EAF1" />
+
+</ResourceDictionary>

SharepointToolbox/Themes/LightPalette.xaml

@@ -0,0 +1,26 @@
+<ResourceDictionary xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+                    xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml">
+
+  <!-- Light palette -->
+  <SolidColorBrush x:Key="AppBgBrush"         Color="#F6F7FB" />
+  <SolidColorBrush x:Key="SurfaceBrush"       Color="#FFFFFF" />
+  <SolidColorBrush x:Key="SurfaceAltBrush"    Color="#F3F4F8" />
+  <SolidColorBrush x:Key="SurfaceAltBrushAlt" Color="#FAFAFC" />
+  <SolidColorBrush x:Key="BorderSoftBrush"    Color="#E3E6EC" />
+  <SolidColorBrush x:Key="BorderStrongBrush"  Color="#CED2D9" />
+  <SolidColorBrush x:Key="TextBrush"          Color="#1F2430" />
+  <SolidColorBrush x:Key="TextMutedBrush"     Color="#5B6472" />
+  <SolidColorBrush x:Key="AccentBrush"        Color="#2563EB" />
+  <SolidColorBrush x:Key="AccentHoverBrush"   Color="#1D4ED8" />
+  <SolidColorBrush x:Key="AccentPressedBrush" Color="#1E40AF" />
+  <SolidColorBrush x:Key="AccentSoftBrush"    Color="#E8F0FE" />
+  <SolidColorBrush x:Key="AccentForegroundBrush" Color="#FFFFFF" />
+  <SolidColorBrush x:Key="DangerBrush"        Color="#DC2626" />
+  <SolidColorBrush x:Key="SuccessBrush"       Color="#047857" />
+  <SolidColorBrush x:Key="OnColoredBgBrush"   Color="#1F2430" />
+  <SolidColorBrush x:Key="SelectionBrush"     Color="#DBE7FF" />
+  <SolidColorBrush x:Key="ScrollThumbBrush"   Color="#B8BEC7" />
+  <SolidColorBrush x:Key="TooltipBgBrush"     Color="#1F2430" />
+  <SolidColorBrush x:Key="TooltipFgBrush"     Color="#FFFFFF" />
+
+</ResourceDictionary>

SharepointToolbox/ViewModels/Dialogs/SitePickerDialogLogic.cs

@@ -0,0 +1,104 @@
+using System.ComponentModel;
+using System.Globalization;
+using SharepointToolbox.Core.Models;
+using SharepointToolbox.Services;
+using SharepointToolbox.Views.Dialogs;
+
+namespace SharepointToolbox.ViewModels.Dialogs;
+
+/// <summary>
+/// Headless logic for <see cref="SitePickerDialog"/>. Loads sites via
+/// <see cref="ISiteListService"/> and applies filter/sort in memory so the
+/// dialog's code-behind stays a thin shim and the logic is unit-testable
+/// without a WPF host.
+/// </summary>
+public class SitePickerDialogLogic
+{
+    private readonly ISiteListService _siteListService;
+    private readonly TenantProfile _profile;
+
+    public SitePickerDialogLogic(ISiteListService siteListService, TenantProfile profile)
+    {
+        _siteListService = siteListService;
+        _profile = profile;
+    }
+
+    /// <summary>
+    /// Loads all accessible sites for the tenant profile and wraps them in
+    /// <see cref="SitePickerItem"/> so the dialog can bind checkboxes.
+    /// </summary>
+    public async Task<IReadOnlyList<SitePickerItem>> LoadAsync(
+        IProgress<OperationProgress> progress,
+        CancellationToken ct)
+    {
+        var sites = await _siteListService.GetSitesAsync(_profile, progress, ct);
+        return sites
+            .Select(s => new SitePickerItem(s.Url, s.Title, s.StorageUsedMb, s.StorageQuotaMb, s.Template))
+            .ToList();
+    }
+
+    /// <summary>
+    /// Filters items by free-text (title/url substring), storage-size range,
+    /// and site kind. Empty or zero-range parameters become no-ops.
+    /// </summary>
+    public static IEnumerable<SitePickerItem> ApplyFilter(
+        IEnumerable<SitePickerItem> items,
+        string text,
+        long minMb,
+        long maxMb,
+        string kindFilter)
+    {
+        var result = items;
+
+        if (!string.IsNullOrEmpty(text))
+        {
+            result = result.Where(i =>
+                i.Url.Contains(text, StringComparison.OrdinalIgnoreCase) ||
+                i.Title.Contains(text, StringComparison.OrdinalIgnoreCase));
+        }
+
+        result = result.Where(i => i.StorageUsedMb >= minMb && i.StorageUsedMb <= maxMb);
+
+        if (!string.IsNullOrEmpty(kindFilter) && kindFilter != "All")
+            result = result.Where(i => i.Kind.ToString() == kindFilter);
+
+        return result;
+    }
+
+    /// <summary>
+    /// Stable sort by a named column and direction. Unknown column names
+    /// return the input sequence unchanged.
+    /// </summary>
+    public static IEnumerable<SitePickerItem> ApplySort(
+        IEnumerable<SitePickerItem> items,
+        string column,
+        ListSortDirection direction)
+    {
+        var asc = direction == ListSortDirection.Ascending;
+        return column switch
+        {
+            "Title" => asc ? items.OrderBy(i => i.Title) : items.OrderByDescending(i => i.Title),
+            "Url" => asc ? items.OrderBy(i => i.Url) : items.OrderByDescending(i => i.Url),
+            "Kind" => asc ? items.OrderBy(i => i.KindDisplay) : items.OrderByDescending(i => i.KindDisplay),
+            "StorageUsedMb" => asc
+                ? items.OrderBy(i => i.StorageUsedMb)
+                : items.OrderByDescending(i => i.StorageUsedMb),
+            "IsSelected" => asc
+                ? items.OrderBy(i => i.IsSelected)
+                : items.OrderByDescending(i => i.IsSelected),
+            _ => items
+        };
+    }
+
+    /// <summary>
+    /// Lenient long parse: whitespace-only or unparseable input yields
+    /// <paramref name="fallback"/> instead of throwing.
+    /// </summary>
+    public static long ParseLongOrDefault(string text, long fallback)
+    {
+        if (string.IsNullOrWhiteSpace(text)) return fallback;
+        return long.TryParse(text.Trim(), NumberStyles.Integer, CultureInfo.InvariantCulture, out var v)
+            ? v
+            : fallback;
+    }
+}

SharepointToolbox/ViewModels/FeatureViewModelBase.cs

@@ -23,6 +23,9 @@ public abstract partial class FeatureViewModelBase : ObservableRecipient
     [ObservableProperty]
     private int _progressValue;
 
+    [ObservableProperty]
+    private bool _isIndeterminate;
+
     /// <summary>
     /// Sites selected in the global toolbar picker. Updated via GlobalSitesChangedMessage.
     /// Derived VMs check this in RunOperationAsync before falling back to per-tab SiteUrl.
@@ -46,24 +49,44 @@ public abstract partial class FeatureViewModelBase : ObservableRecipient
         IsRunning = true;
         StatusMessage = string.Empty;
         ProgressValue = 0;
+        IsIndeterminate = false;
         try
         {
             var progress = new Progress<OperationProgress>(p =>
             {
-                ProgressValue = p.Total > 0 ? (int)(100.0 * p.Current / p.Total) : 0;
+                // Indeterminate reports (throttle waits, inner scan steps) must not
+                // reset the determinate bar to 0%; only update the status message
+                // and flip the bar into marquee mode. The next determinate report
+                // restores % and clears the marquee flag.
+                if (p.IsIndeterminate)
+                {
+                    IsIndeterminate = true;
+                }
+                else
+                {
+                    IsIndeterminate = false;
+                    ProgressValue = p.Total > 0 ? (int)(100.0 * p.Current / p.Total) : 0;
+                }
                 StatusMessage = p.Message;
                 WeakReferenceMessenger.Default.Send(new ProgressUpdatedMessage(p));
             });
             await RunOperationAsync(_cts.Token, progress);
+            // Success path: replace any lingering "Scanning X…" with a neutral
+            // completion marker so stale in-progress labels don't stick around.
+            StatusMessage = TranslationSource.Instance["status.complete"];
+            ProgressValue = 100;
+            IsIndeterminate = false;
         }
         catch (OperationCanceledException)
         {
             StatusMessage = TranslationSource.Instance["status.cancelled"];
+            IsIndeterminate = false;
             _logger.LogInformation("Operation cancelled by user.");
         }
         catch (Exception ex)
         {
             StatusMessage = $"{TranslationSource.Instance["err.generic"]} {ex.Message}";
+            IsIndeterminate = false;
             _logger.LogError(ex, "Operation failed.");
         }
         finally

SharepointToolbox/ViewModels/MainWindowViewModel.cs

@@ -50,7 +50,6 @@ public partial class MainWindowViewModel : ObservableRecipient
             ? string.Format(Localization.TranslationSource.Instance["toolbar.globalSites.count"], GlobalSelectedSites.Count)
             : Localization.TranslationSource.Instance["toolbar.globalSites.none"];
 
-    public IAsyncRelayCommand ConnectCommand { get; }
     public IAsyncRelayCommand ClearSessionCommand { get; }
     public RelayCommand ManageProfilesCommand { get; }
     public RelayCommand OpenGlobalSitePickerCommand { get; }
@@ -64,7 +63,6 @@ public partial class MainWindowViewModel : ObservableRecipient
         _sessionManager = sessionManager;
         _logger = logger;
 
-        ConnectCommand = new AsyncRelayCommand(ConnectAsync, () => SelectedProfile != null);
         ClearSessionCommand = new AsyncRelayCommand(ClearSessionAsync, () => SelectedProfile != null);
         ManageProfilesCommand = new RelayCommand(OpenProfileManagement);
         OpenGlobalSitePickerCommand = new RelayCommand(ExecuteOpenGlobalSitePicker, () => SelectedProfile != null);
@@ -96,7 +94,6 @@ public partial class MainWindowViewModel : ObservableRecipient
         {
             WeakReferenceMessenger.Default.Send(new TenantSwitchedMessage(value));
         }
-        ConnectCommand.NotifyCanExecuteChanged();
         ClearSessionCommand.NotifyCanExecuteChanged();
         // Clear global site selection on tenant switch (sites belong to a tenant)
         GlobalSelectedSites.Clear();
@@ -121,22 +118,6 @@ public partial class MainWindowViewModel : ObservableRecipient
         }
     }
 
-    private async Task ConnectAsync()
-    {
-        if (SelectedProfile == null) return;
-        try
-        {
-            ConnectionStatus = "Connecting...";
-            await _sessionManager.GetOrCreateContextAsync(SelectedProfile, CancellationToken.None);
-            ConnectionStatus = SelectedProfile.Name;
-        }
-        catch (Exception ex)
-        {
-            ConnectionStatus = "Connection failed";
-            _logger.LogError(ex, "Failed to connect to tenant {TenantUrl}.", SelectedProfile.TenantUrl);
-        }
-    }
-
     private async Task ClearSessionAsync()
     {
         if (SelectedProfile == null) return;

SharepointToolbox/ViewModels/ProfileManagementViewModel.cs

@@ -19,6 +19,11 @@ public partial class ProfileManagementViewModel : ObservableObject
     private readonly ILogger<ProfileManagementViewModel> _logger;
     private readonly IAppRegistrationService _appRegistrationService;
 
+    // Well-known public client (Microsoft Graph Command Line Tools) used as a bootstrap
+    // when a profile has no ClientId yet, so the user can sign in as admin and have the
+    // app registration created for them.
+    private const string BootstrapClientId = "14d82eec-204b-4c2f-b7e8-296a70dab67e";
+
     [ObservableProperty]
     private TenantProfile? _selectedProfile;
 
@@ -55,7 +60,7 @@ public partial class ProfileManagementViewModel : ObservableObject
     public ObservableCollection<TenantProfile> Profiles { get; } = new();
 
     public IAsyncRelayCommand AddCommand { get; }
-    public IAsyncRelayCommand RenameCommand { get; }
+    public IAsyncRelayCommand SaveCommand { get; }
     public IAsyncRelayCommand DeleteCommand { get; }
     public IAsyncRelayCommand BrowseClientLogoCommand { get; }
     public IAsyncRelayCommand ClearClientLogoCommand { get; }
@@ -77,7 +82,7 @@ public partial class ProfileManagementViewModel : ObservableObject
         _appRegistrationService = appRegistrationService;
 
         AddCommand = new AsyncRelayCommand(AddAsync, CanAdd);
-        RenameCommand = new AsyncRelayCommand(RenameAsync, () => SelectedProfile != null && !string.IsNullOrWhiteSpace(NewName));
+        SaveCommand = new AsyncRelayCommand(SaveAsync, CanSave);
         DeleteCommand = new AsyncRelayCommand(DeleteAsync, () => SelectedProfile != null);
         BrowseClientLogoCommand = new AsyncRelayCommand(BrowseClientLogoAsync, () => SelectedProfile != null);
         ClearClientLogoCommand = new AsyncRelayCommand(ClearClientLogoAsync, () => SelectedProfile != null);
@@ -107,11 +112,24 @@ public partial class ProfileManagementViewModel : ObservableObject
 
     partial void OnSelectedProfileChanged(TenantProfile? value)
     {
+        if (value != null)
+        {
+            NewName = value.Name;
+            NewTenantUrl = value.TenantUrl;
+            NewClientId = value.ClientId ?? string.Empty;
+        }
+        else
+        {
+            NewName = string.Empty;
+            NewTenantUrl = string.Empty;
+            NewClientId = string.Empty;
+        }
+        ValidationMessage = string.Empty;
         ClientLogoPreview = FormatLogoPreview(value?.ClientLogo);
         BrowseClientLogoCommand.NotifyCanExecuteChanged();
         ClearClientLogoCommand.NotifyCanExecuteChanged();
         AutoPullClientLogoCommand.NotifyCanExecuteChanged();
-        RenameCommand.NotifyCanExecuteChanged();
+        SaveCommand.NotifyCanExecuteChanged();
         DeleteCommand.NotifyCanExecuteChanged();
         OnPropertyChanged(nameof(HasRegisteredApp));
         RegisterAppCommand.NotifyCanExecuteChanged();
@@ -130,14 +148,27 @@ public partial class ProfileManagementViewModel : ObservableObject
     private void NotifyCommandsCanExecuteChanged()
     {
         AddCommand.NotifyCanExecuteChanged();
-        RenameCommand.NotifyCanExecuteChanged();
+        SaveCommand.NotifyCanExecuteChanged();
     }
 
     private bool CanAdd()
     {
         if (string.IsNullOrWhiteSpace(NewName)) return false;
         if (!Uri.TryCreate(NewTenantUrl, UriKind.Absolute, out _)) return false;
-        if (string.IsNullOrWhiteSpace(NewClientId)) return false;
+        // Fields mirror the selected profile after selection; block Add so the user doesn't
+        // create a duplicate — they should use Save to update, or change the name to fork.
+        if (SelectedProfile != null &&
+            string.Equals(NewName.Trim(), SelectedProfile.Name, StringComparison.Ordinal))
+            return false;
+        // ClientId is optional — leaving it blank lets the user register the app from within the tool.
+        return true;
+    }
+
+    private bool CanSave()
+    {
+        if (SelectedProfile == null) return false;
+        if (string.IsNullOrWhiteSpace(NewName)) return false;
+        if (!Uri.TryCreate(NewTenantUrl, UriKind.Absolute, out _)) return false;
         return true;
     }
 
@@ -150,7 +181,7 @@ public partial class ProfileManagementViewModel : ObservableObject
             {
                 Name = NewName.Trim(),
                 TenantUrl = NewTenantUrl.Trim(),
-                ClientId = NewClientId.Trim()
+                ClientId = NewClientId?.Trim() ?? string.Empty
             };
             await _profileService.AddProfileAsync(profile);
             Profiles.Add(profile);
@@ -166,19 +197,43 @@ public partial class ProfileManagementViewModel : ObservableObject
         }
     }
 
-    private async Task RenameAsync()
+    private async Task SaveAsync()
     {
-        if (SelectedProfile == null || string.IsNullOrWhiteSpace(NewName)) return;
+        if (!CanSave()) return;
+        var target = SelectedProfile!;
         try
         {
-            await _profileService.RenameProfileAsync(SelectedProfile.Name, NewName.Trim());
+            var newName = NewName.Trim();
-            SelectedProfile.Name = NewName.Trim();
+            var newUrl = NewTenantUrl.Trim();
-            NewName = string.Empty;
+            var newClientId = NewClientId?.Trim() ?? string.Empty;
+            var oldName = target.Name;
+
+            if (!string.Equals(oldName, newName, StringComparison.Ordinal))
+            {
+                await _profileService.RenameProfileAsync(oldName, newName);
+                target.Name = newName;
+            }
+
+            target.TenantUrl = newUrl;
+            target.ClientId = newClientId;
+            await _profileService.UpdateProfileAsync(target);
+
+            // Force ListBox to pick up the renamed entry (TenantProfile is a plain POCO,
+            // so mutating Name does not raise PropertyChanged).
+            var idx = Profiles.IndexOf(target);
+            if (idx >= 0)
+            {
+                Profiles.RemoveAt(idx);
+                Profiles.Insert(idx, target);
+                SelectedProfile = target;
+            }
+
+            ValidationMessage = string.Empty;
         }
         catch (Exception ex)
         {
             ValidationMessage = ex.Message;
-            _logger.LogError(ex, "Failed to rename profile.");
+            _logger.LogError(ex, "Failed to save profile.");
         }
     }
 
@@ -291,32 +346,64 @@ public partial class ProfileManagementViewModel : ObservableObject
     private bool CanRemoveApp()
         => SelectedProfile != null && SelectedProfile.AppId != null && !IsRegistering;
 
+    /// <summary>
+    /// Set by the view to display the pre-registration warning. Returns true if the
+    /// user accepts and registration should proceed.
+    /// </summary>
+    public Func<string, bool>? ConfirmRegisterApp { get; set; }
+
     private async Task RegisterAppAsync(CancellationToken ct)
     {
         if (SelectedProfile == null) return;
+
+        // Auth caching reduces this to one prompt in the common case, but a fresh
+        // tenant or different admin account may still trigger up to two — warn so
+        // the user knows another window is expected after they sign in.
+        if (ConfirmRegisterApp != null)
+        {
+            var msg = string.Format(TranslationSource.Instance["profile.register.warning"], 2);
+            if (!ConfirmRegisterApp(msg)) return;
+        }
+
         IsRegistering = true;
         ShowFallbackInstructions = false;
         RegistrationStatus = TranslationSource.Instance["profile.register.checking"];
         try
         {
-            var isAdmin = await _appRegistrationService.IsGlobalAdminAsync(SelectedProfile.ClientId, ct);
+            // Use the profile's own ClientId if it has one; otherwise bootstrap with the
-            if (!isAdmin)
+            // Microsoft Graph Command Line Tools public client so a first-time profile
-            {
+            // (name + URL only) can still perform registration.
-                ShowFallbackInstructions = true;
+            var authClientId = string.IsNullOrWhiteSpace(SelectedProfile.ClientId)
-                RegistrationStatus = TranslationSource.Instance["profile.register.noperm"];
+                ? BootstrapClientId
-                return;
+                : SelectedProfile.ClientId;
-            }
 
+            // No preflight admin check: it used Global Admin as the criterion and
+            // rejected Application Admins / Cloud Application Admins who can also
+            // create apps. Let Entra enforce authorization via the POST itself —
+            // any 401/403 returns FallbackRequired and triggers the tutorial.
             RegistrationStatus = TranslationSource.Instance["profile.register.registering"];
-            var result = await _appRegistrationService.RegisterAsync(SelectedProfile.ClientId, SelectedProfile.Name, ct);
+            var result = await _appRegistrationService.RegisterAsync(authClientId, SelectedProfile.TenantUrl, SelectedProfile.Name, ct);
 
             if (result.IsSuccess)
             {
                 SelectedProfile.AppId = result.AppId;
+                // If the profile had no ClientId, adopt the freshly registered app's id
+                // so subsequent sign-ins use the profile's own app registration.
+                if (string.IsNullOrWhiteSpace(SelectedProfile.ClientId))
+                    SelectedProfile.ClientId = result.AppId!;
                 await _profileService.UpdateProfileAsync(SelectedProfile);
+                // Reflect adopted ClientId in the bound TextBox. Without this the
+                // field stays blank and the next Save would overwrite the stored
+                // ClientId with an empty string.
+                NewClientId = SelectedProfile.ClientId;
                 RegistrationStatus = TranslationSource.Instance["profile.register.success"];
                 OnPropertyChanged(nameof(HasRegisteredApp));
             }
+            else if (result.IsFallback)
+            {
+                ShowFallbackInstructions = true;
+                RegistrationStatus = TranslationSource.Instance["profile.register.noperm"];
+            }
             else
             {
                 RegistrationStatus = result.ErrorMessage ?? TranslationSource.Instance["profile.register.failed"];
@@ -340,7 +427,7 @@ public partial class ProfileManagementViewModel : ObservableObject
         RegistrationStatus = TranslationSource.Instance["profile.remove.removing"];
         try
         {
-            await _appRegistrationService.RemoveAsync(SelectedProfile.ClientId, SelectedProfile.AppId!, ct);
+            await _appRegistrationService.RemoveAsync(SelectedProfile.ClientId, SelectedProfile.TenantUrl, SelectedProfile.AppId!, ct);
             await _appRegistrationService.ClearMsalSessionAsync(SelectedProfile.ClientId, SelectedProfile.TenantUrl);
             SelectedProfile.AppId = null;
             await _profileService.UpdateProfileAsync(SelectedProfile);

SharepointToolbox/ViewModels/Tabs/BulkMembersViewModel.cs

@@ -105,9 +105,9 @@ public partial class BulkMembersViewModel : FeatureViewModelBase
 
     protected override async Task RunOperationAsync(CancellationToken ct, IProgress<OperationProgress> progress)
     {
-        if (_currentProfile == null) throw new InvalidOperationException("No tenant connected.");
+        if (_currentProfile == null) throw new InvalidOperationException(TranslationSource.Instance["err.no_tenant"]);
         if (_validRows == null || _validRows.Count == 0)
-            throw new InvalidOperationException("No valid rows to process. Import a CSV first.");
+            throw new InvalidOperationException(TranslationSource.Instance["err.no_valid_rows"]);
 
         var message = string.Format(TranslationSource.Instance["bulk.confirm.message"],
             $"{_validRows.Count} members will be added");

SharepointToolbox/ViewModels/Tabs/BulkSitesViewModel.cs

@@ -105,9 +105,9 @@ public partial class BulkSitesViewModel : FeatureViewModelBase
 
     protected override async Task RunOperationAsync(CancellationToken ct, IProgress<OperationProgress> progress)
     {
-        if (_currentProfile == null) throw new InvalidOperationException("No tenant connected.");
+        if (_currentProfile == null) throw new InvalidOperationException(TranslationSource.Instance["err.no_tenant"]);
         if (_validRows == null || _validRows.Count == 0)
-            throw new InvalidOperationException("No valid rows to process. Import a CSV first.");
+            throw new InvalidOperationException(TranslationSource.Instance["err.no_valid_rows"]);
 
         var message = string.Format(TranslationSource.Instance["bulk.confirm.message"],
             $"{_validRows.Count} sites will be created");

SharepointToolbox/ViewModels/Tabs/DuplicatesViewModel.cs

@@ -6,6 +6,7 @@ using CommunityToolkit.Mvvm.Input;
 using Microsoft.Extensions.Logging;
 using Microsoft.Win32;
 using SharepointToolbox.Core.Models;
+using SharepointToolbox.Localization;
 using SharepointToolbox.Services;
 using SharepointToolbox.Services.Export;
 
@@ -31,6 +32,7 @@ public partial class DuplicatesViewModel : FeatureViewModelBase
     private readonly IDuplicatesService _duplicatesService;
     private readonly ISessionManager _sessionManager;
     private readonly DuplicatesHtmlExportService _htmlExportService;
+    private readonly DuplicatesCsvExportService _csvExportService;
     private readonly IBrandingService _brandingService;
     private readonly ILogger<FeatureViewModelBase> _logger;
     private TenantProfile? _currentProfile;
@@ -46,6 +48,14 @@ public partial class DuplicatesViewModel : FeatureViewModelBase
     [ObservableProperty] private bool _includeSubsites;
     [ObservableProperty] private string _library = string.Empty;
 
+    /// <summary>0 = Single file, 1 = Split by site.</summary>
+    [ObservableProperty] private int _splitModeIndex;
+    /// <summary>0 = Separate HTML files, 1 = Single tabbed HTML.</summary>
+    [ObservableProperty] private int _htmlLayoutIndex;
+
+    private ReportSplitMode CurrentSplit => SplitModeIndex == 1 ? ReportSplitMode.BySite : ReportSplitMode.Single;
+    private HtmlSplitLayout CurrentLayout => HtmlLayoutIndex == 1 ? HtmlSplitLayout.SingleTabbed : HtmlSplitLayout.SeparateFiles;
+
     private ObservableCollection<DuplicateRow> _results = new();
     public ObservableCollection<DuplicateRow> Results
     {
@@ -55,16 +65,19 @@ public partial class DuplicatesViewModel : FeatureViewModelBase
             _results = value;
             OnPropertyChanged();
             ExportHtmlCommand.NotifyCanExecuteChanged();
+            ExportCsvCommand.NotifyCanExecuteChanged();
         }
     }
 
     public IAsyncRelayCommand ExportHtmlCommand { get; }
+    public IAsyncRelayCommand ExportCsvCommand { get; }
     public TenantProfile? CurrentProfile => _currentProfile;
 
     public DuplicatesViewModel(
         IDuplicatesService duplicatesService,
         ISessionManager sessionManager,
         DuplicatesHtmlExportService htmlExportService,
+        DuplicatesCsvExportService csvExportService,
         IBrandingService brandingService,
         ILogger<FeatureViewModelBase> logger)
         : base(logger)
@@ -72,24 +85,26 @@ public partial class DuplicatesViewModel : FeatureViewModelBase
         _duplicatesService = duplicatesService;
         _sessionManager    = sessionManager;
         _htmlExportService = htmlExportService;
+        _csvExportService  = csvExportService;
         _brandingService   = brandingService;
         _logger            = logger;
 
         ExportHtmlCommand = new AsyncRelayCommand(ExportHtmlAsync, CanExport);
+        ExportCsvCommand  = new AsyncRelayCommand(ExportCsvAsync,  CanExport);
     }
 
     protected override async Task RunOperationAsync(CancellationToken ct, IProgress<OperationProgress> progress)
     {
         if (_currentProfile == null)
         {
-            StatusMessage = "No tenant selected. Please connect to a tenant first.";
+            StatusMessage = TranslationSource.Instance["err.no_tenant_connected"];
             return;
         }
 
         var urls = GlobalSites.Select(s => s.Url).Where(u => !string.IsNullOrWhiteSpace(u)).ToList();
         if (urls.Count == 0)
         {
-            StatusMessage = "Select at least one site from the toolbar.";
+            StatusMessage = TranslationSource.Instance["err.no_sites_selected"];
             return;
         }
 
@@ -152,6 +167,7 @@ public partial class DuplicatesViewModel : FeatureViewModelBase
         _lastGroups = Array.Empty<DuplicateGroup>();
         OnPropertyChanged(nameof(CurrentProfile));
         ExportHtmlCommand.NotifyCanExecuteChanged();
+        ExportCsvCommand.NotifyCanExecuteChanged();
     }
 
     internal void SetCurrentProfile(TenantProfile profile) => _currentProfile = profile;
@@ -179,9 +195,28 @@ public partial class DuplicatesViewModel : FeatureViewModelBase
                 branding = new ReportBranding(mspLogo, clientLogo);
             }
 
-            await _htmlExportService.WriteAsync(_lastGroups, dialog.FileName, CancellationToken.None, branding);
+            await _htmlExportService.WriteAsync(_lastGroups, dialog.FileName, CurrentSplit, CurrentLayout, CancellationToken.None, branding);
             Process.Start(new ProcessStartInfo(dialog.FileName) { UseShellExecute = true });
         }
         catch (Exception ex) { StatusMessage = $"Export failed: {ex.Message}"; _logger.LogError(ex, "HTML export failed."); }
     }
+
+    private async Task ExportCsvAsync()
+    {
+        if (_lastGroups.Count == 0) return;
+        var dialog = new SaveFileDialog
+        {
+            Title = "Export duplicates report to CSV",
+            Filter = "CSV files (*.csv)|*.csv|All files (*.*)|*.*",
+            DefaultExt = "csv",
+            FileName = "duplicates_report"
+        };
+        if (dialog.ShowDialog() != true) return;
+        try
+        {
+            await _csvExportService.WriteAsync(_lastGroups, dialog.FileName, CurrentSplit, CancellationToken.None);
+            Process.Start(new ProcessStartInfo(dialog.FileName) { UseShellExecute = true });
+        }
+        catch (Exception ex) { StatusMessage = $"Export failed: {ex.Message}"; _logger.LogError(ex, "CSV export failed."); }
+    }
 }

SharepointToolbox/ViewModels/Tabs/FolderStructureViewModel.cs

@@ -103,15 +103,16 @@ public partial class FolderStructureViewModel : FeatureViewModelBase
 
     protected override async Task RunOperationAsync(CancellationToken ct, IProgress<OperationProgress> progress)
     {
-        if (_currentProfile == null) throw new InvalidOperationException("No tenant connected.");
+        var T = TranslationSource.Instance;
+        if (_currentProfile == null) throw new InvalidOperationException(T["err.no_tenant"]);
         if (_validRows == null || _validRows.Count == 0)
-            throw new InvalidOperationException("No valid rows. Import a CSV first.");
+            throw new InvalidOperationException(T["err.no_valid_rows"]);
         if (string.IsNullOrWhiteSpace(LibraryTitle))
-            throw new InvalidOperationException("Library title is required.");
+            throw new InvalidOperationException(T["err.library_title_required"]);
 
         var urls = GlobalSites.Select(s => s.Url).Where(u => !string.IsNullOrWhiteSpace(u)).ToList();
         if (urls.Count == 0)
-            throw new InvalidOperationException("Select at least one site from the toolbar.");
+            throw new InvalidOperationException(T["err.no_sites_selected"]);
 
         var uniquePaths = FolderStructureService.BuildUniquePaths(_validRows);
         var message = string.Format(TranslationSource.Instance["bulk.confirm.message"],

SharepointToolbox/ViewModels/Tabs/PermissionsViewModel.cs

@@ -8,6 +8,7 @@ using Microsoft.Extensions.Logging;
 using Microsoft.Win32;
 using SharepointToolbox.Core.Messages;
 using SharepointToolbox.Core.Models;
+using SharepointToolbox.Localization;
 using SharepointToolbox.Services;
 using SharepointToolbox.Core.Helpers;
 using SharepointToolbox.Services.Export;
@@ -84,6 +85,14 @@ public partial class PermissionsViewModel : FeatureViewModelBase
     [ObservableProperty]
     private bool _isDetailView = true;
 
+    /// <summary>0 = Single file, 1 = Split by site.</summary>
+    [ObservableProperty] private int _splitModeIndex;
+    /// <summary>0 = Separate HTML files, 1 = Single tabbed HTML.</summary>
+    [ObservableProperty] private int _htmlLayoutIndex;
+
+    private ReportSplitMode CurrentSplit => SplitModeIndex == 1 ? ReportSplitMode.BySite : ReportSplitMode.Single;
+    private HtmlSplitLayout CurrentLayout => HtmlLayoutIndex == 1 ? HtmlSplitLayout.SingleTabbed : HtmlSplitLayout.SeparateFiles;
+
     /// <summary>
     /// Simplified wrappers computed from Results. Rebuilt when Results changes.
     /// </summary>
@@ -214,7 +223,7 @@ public partial class PermissionsViewModel : FeatureViewModelBase
         var urls = GlobalSites.Select(s => s.Url).Where(u => !string.IsNullOrWhiteSpace(u)).ToList();
         if (urls.Count == 0)
         {
-            StatusMessage = "Select at least one site from the toolbar.";
+            StatusMessage = TranslationSource.Instance["err.no_sites_selected"];
             return;
         }
 
@@ -308,6 +317,32 @@ public partial class PermissionsViewModel : FeatureViewModelBase
     /// Derives the tenant admin URL from a standard tenant URL.
     /// E.g. https://tenant.sharepoint.com → https://tenant-admin.sharepoint.com
     /// </summary>
+    /// <summary>
+    /// Extracts the site-collection root URL from an arbitrary SharePoint object URL.
+    /// E.g. https://t.sharepoint.com/sites/hr/Shared%20Documents/Reports → https://t.sharepoint.com/sites/hr
+    /// Falls back to scheme+host for root-collection URLs.
+    /// </summary>
+    internal static string DeriveSiteCollectionUrl(string objectUrl)
+    {
+        if (string.IsNullOrWhiteSpace(objectUrl)) return string.Empty;
+        if (!Uri.TryCreate(objectUrl, UriKind.Absolute, out var uri))
+            return objectUrl.TrimEnd('/');
+
+        var baseUrl = $"{uri.Scheme}://{uri.Host}";
+        var segments = uri.AbsolutePath.Trim('/').Split('/', StringSplitOptions.RemoveEmptyEntries);
+
+        // Managed paths: /sites/<name> or /teams/<name>
+        if (segments.Length >= 2 &&
+            (segments[0].Equals("sites", StringComparison.OrdinalIgnoreCase) ||
+             segments[0].Equals("teams", StringComparison.OrdinalIgnoreCase)))
+        {
+            return $"{baseUrl}/{segments[0]}/{segments[1]}";
+        }
+
+        // Root site collection
+        return baseUrl;
+    }
+
     internal static string DeriveAdminUrl(string tenantUrl)
     {
         var uri = new Uri(tenantUrl.TrimEnd('/'));
@@ -374,9 +409,9 @@ public partial class PermissionsViewModel : FeatureViewModelBase
         try
         {
             if (IsSimplifiedMode && SimplifiedResults.Count > 0)
-                await _csvExportService.WriteAsync(SimplifiedResults.ToList(), dialog.FileName, CancellationToken.None);
+                await _csvExportService.WriteAsync(SimplifiedResults.ToList(), dialog.FileName, CurrentSplit, CancellationToken.None);
             else
-                await _csvExportService.WriteAsync(Results, dialog.FileName, CancellationToken.None);
+                await _csvExportService.WriteAsync((IReadOnlyList<PermissionEntry>)Results, dialog.FileName, CurrentSplit, CancellationToken.None);
             OpenFile(dialog.FileName);
         }
         catch (Exception ex)
@@ -408,36 +443,64 @@ public partial class PermissionsViewModel : FeatureViewModelBase
             }
 
             IReadOnlyDictionary<string, IReadOnlyList<ResolvedMember>>? groupMembers = null;
-            if (_groupResolver != null && Results.Count > 0)
+            if (_groupResolver != null && Results.Count > 0 && _currentProfile != null)
             {
-                var groupNames = Results
+                // SharePoint groups live per site collection. Bucket each group
+                // by the site it was observed on, then resolve against that
+                // site's context. Using the root tenant ctx for a group that
+                // lives on a sub-site makes CSOM fail with "Group not found".
+                var groupsBySite = Results
                     .Where(r => r.PrincipalType == "SharePointGroup")
-                    .SelectMany(r => r.Users.Split(';', StringSplitOptions.RemoveEmptyEntries))
+                    .SelectMany(r => r.Users
-                    .Select(n => n.Trim())
+                        .Split(';', StringSplitOptions.RemoveEmptyEntries)
-                    .Where(n => n.Length > 0)
+                        .Select(n => (SiteUrl: DeriveSiteCollectionUrl(r.Url), GroupName: n.Trim())))
-                    .Distinct(StringComparer.OrdinalIgnoreCase)
+                    .Where(x => x.GroupName.Length > 0)
+                    .GroupBy(x => x.SiteUrl, StringComparer.OrdinalIgnoreCase)
                     .ToList();
 
-                if (groupNames.Count > 0 && _currentProfile != null)
+                if (groupsBySite.Count > 0)
                 {
-                    try
+                    var merged = new Dictionary<string, IReadOnlyList<ResolvedMember>>(
+                        StringComparer.OrdinalIgnoreCase);
+
+                    foreach (var bucket in groupsBySite)
                     {
-                        var ctx = await _sessionManager.GetOrCreateContextAsync(
+                        var distinctNames = bucket
-                            _currentProfile, CancellationToken.None);
+                            .Select(x => x.GroupName)
-                        groupMembers = await _groupResolver.ResolveGroupsAsync(
+                            .Distinct(StringComparer.OrdinalIgnoreCase)
-                            ctx, _currentProfile.ClientId, groupNames, CancellationToken.None);
+                            .ToList();
-                    }
+
-                    catch (Exception ex)
+                        try
-                    {
+                        {
-                        _logger.LogWarning(ex, "Group resolution failed — exporting without member expansion.");
+                            var siteProfile = new TenantProfile
+                            {
+                                TenantUrl = bucket.Key,
+                                ClientId = _currentProfile.ClientId,
+                                Name = _currentProfile.Name
+                            };
+                            var ctx = await _sessionManager.GetOrCreateContextAsync(
+                                siteProfile, CancellationToken.None);
+                            var resolved = await _groupResolver.ResolveGroupsAsync(
+                                ctx, _currentProfile.ClientId, distinctNames, CancellationToken.None);
+                            foreach (var kv in resolved)
+                                merged[kv.Key] = kv.Value;
+                        }
+                        catch (Exception ex)
+                        {
+                            _logger.LogWarning(ex,
+                                "Group resolution failed for {Site} — continuing without member expansion.",
+                                bucket.Key);
+                        }
                     }
+
+                    groupMembers = merged;
                 }
             }
 
             if (IsSimplifiedMode && SimplifiedResults.Count > 0)
-                await _htmlExportService.WriteAsync(SimplifiedResults.ToList(), dialog.FileName, CancellationToken.None, branding, groupMembers);
+                await _htmlExportService.WriteAsync(SimplifiedResults.ToList(), dialog.FileName, CurrentSplit, CurrentLayout, CancellationToken.None, branding, groupMembers);
             else
-                await _htmlExportService.WriteAsync(Results, dialog.FileName, CancellationToken.None, branding, groupMembers);
+                await _htmlExportService.WriteAsync((IReadOnlyList<PermissionEntry>)Results, dialog.FileName, CurrentSplit, CurrentLayout, CancellationToken.None, branding, groupMembers);
             OpenFile(dialog.FileName);
         }
         catch (Exception ex)

SharepointToolbox/ViewModels/Tabs/SearchViewModel.cs

@@ -6,6 +6,7 @@ using CommunityToolkit.Mvvm.Input;
 using Microsoft.Extensions.Logging;
 using Microsoft.Win32;
 using SharepointToolbox.Core.Models;
+using SharepointToolbox.Localization;
 using SharepointToolbox.Services;
 using SharepointToolbox.Services.Export;
 
@@ -79,14 +80,14 @@ public partial class SearchViewModel : FeatureViewModelBase
     {
         if (_currentProfile == null)
         {
-            StatusMessage = "No tenant selected. Please connect to a tenant first.";
+            StatusMessage = TranslationSource.Instance["err.no_tenant_connected"];
             return;
         }
 
         var urls = GlobalSites.Select(s => s.Url).Where(u => !string.IsNullOrWhiteSpace(u)).ToList();
         if (urls.Count == 0)
         {
-            StatusMessage = "Select at least one site from the toolbar.";
+            StatusMessage = TranslationSource.Instance["err.no_sites_selected"];
             return;
         }
 

SharepointToolbox/ViewModels/Tabs/SettingsViewModel.cs

@@ -12,6 +12,7 @@ public partial class SettingsViewModel : FeatureViewModelBase
 {
     private readonly SettingsService _settingsService;
     private readonly IBrandingService _brandingService;
+    private readonly ThemeManager _themeManager;
 
     private string _selectedLanguage = "en";
     public string SelectedLanguage
@@ -39,6 +40,19 @@ public partial class SettingsViewModel : FeatureViewModelBase
         }
     }
 
+    private string _selectedTheme = "System";
+    public string SelectedTheme
+    {
+        get => _selectedTheme;
+        set
+        {
+            if (_selectedTheme == value) return;
+            _selectedTheme = value;
+            OnPropertyChanged();
+            _ = ApplyThemeAsync(value);
+        }
+    }
+
     private bool _autoTakeOwnership;
     public bool AutoTakeOwnership
     {
@@ -63,11 +77,12 @@ public partial class SettingsViewModel : FeatureViewModelBase
     public IAsyncRelayCommand BrowseMspLogoCommand { get; }
     public IAsyncRelayCommand ClearMspLogoCommand { get; }
 
-    public SettingsViewModel(SettingsService settingsService, IBrandingService brandingService, ILogger<FeatureViewModelBase> logger)
+    public SettingsViewModel(SettingsService settingsService, IBrandingService brandingService, ThemeManager themeManager, ILogger<FeatureViewModelBase> logger)
         : base(logger)
     {
         _settingsService = settingsService;
         _brandingService = brandingService;
+        _themeManager = themeManager;
         BrowseFolderCommand = new RelayCommand(BrowseFolder);
         BrowseMspLogoCommand = new AsyncRelayCommand(BrowseMspLogoAsync);
         ClearMspLogoCommand = new AsyncRelayCommand(ClearMspLogoAsync);
@@ -79,14 +94,29 @@ public partial class SettingsViewModel : FeatureViewModelBase
         _selectedLanguage = settings.Lang;
         _dataFolder = settings.DataFolder;
         _autoTakeOwnership = settings.AutoTakeOwnership;
+        _selectedTheme = settings.Theme;
         OnPropertyChanged(nameof(SelectedLanguage));
         OnPropertyChanged(nameof(DataFolder));
         OnPropertyChanged(nameof(AutoTakeOwnership));
+        OnPropertyChanged(nameof(SelectedTheme));
 
         var mspLogo = await _brandingService.GetMspLogoAsync();
         MspLogoPreview = mspLogo is not null ? $"data:{mspLogo.MimeType};base64,{mspLogo.Base64}" : null;
     }
 
+    private async Task ApplyThemeAsync(string mode)
+    {
+        try
+        {
+            _themeManager.ApplyFromString(mode);
+            await _settingsService.SetThemeAsync(mode);
+        }
+        catch (Exception ex)
+        {
+            StatusMessage = ex.Message;
+        }
+    }
+
     private async Task ApplyLanguageAsync(string code)
     {
         try

SharepointToolbox/ViewModels/Tabs/StorageViewModel.cs

@@ -9,6 +9,7 @@ using LiveChartsCore.SkiaSharpView.Painting;
 using Microsoft.Extensions.Logging;
 using Microsoft.Win32;
 using SharepointToolbox.Core.Models;
+using SharepointToolbox.Localization;
 using SharepointToolbox.Services;
 using SharepointToolbox.Services.Export;
 using SkiaSharp;
@@ -22,6 +23,9 @@ public partial class StorageViewModel : FeatureViewModelBase
     private readonly StorageCsvExportService _csvExportService;
     private readonly StorageHtmlExportService _htmlExportService;
     private readonly IBrandingService? _brandingService;
+    private readonly IOwnershipElevationService? _ownershipService;
+    private readonly SettingsService? _settingsService;
+    private readonly ThemeManager? _themeManager;
     private readonly ILogger<FeatureViewModelBase> _logger;
     private TenantProfile? _currentProfile;
 
@@ -37,6 +41,47 @@ public partial class StorageViewModel : FeatureViewModelBase
     [ObservableProperty]
     private bool _isDonutChart = true;
 
+    // ── Scan-time flags (control what is captured during the CSOM scan) ─────
+    [ObservableProperty] private bool _scanHiddenLibraries = true;
+    [ObservableProperty] private bool _scanPreservationHold = true;
+    [ObservableProperty] private bool _scanListAttachments = true;
+    [ObservableProperty] private bool _scanRecycleBin = true;
+
+    // ── Report filter flags (gate which kinds appear in DataGrid + exports) ─
+    [ObservableProperty] private bool _showLibraries = true;
+    [ObservableProperty] private bool _showHiddenLibraries = true;
+    [ObservableProperty] private bool _showPreservationHold = true;
+    [ObservableProperty] private bool _showListAttachments = true;
+    [ObservableProperty] private bool _showRecycleBin = true;
+    [ObservableProperty] private bool _showSubsites = true;
+
+    /// <summary>
+    /// When true, recycle bin stage 1 + stage 2 collapse into a single
+    /// "[Recycle Bin] Total" row whose size is the sum of both stages.
+    /// When false, both stages render as separate rows.
+    /// </summary>
+    [ObservableProperty] private bool _combineRecycleBinStages = true;
+
+    // SPO-reported site total (Site.Usage.Storage). Independent reference
+    // value the user can compare against the scanned total.
+    [ObservableProperty] private long _spoReportedTotalSize;
+
+    partial void OnShowLibrariesChanged(bool value) => RebuildFilteredResults();
+    partial void OnShowHiddenLibrariesChanged(bool value) => RebuildFilteredResults();
+    partial void OnShowPreservationHoldChanged(bool value) => RebuildFilteredResults();
+    partial void OnShowListAttachmentsChanged(bool value) => RebuildFilteredResults();
+    partial void OnShowRecycleBinChanged(bool value) => RebuildFilteredResults();
+    partial void OnShowSubsitesChanged(bool value) => RebuildFilteredResults();
+    partial void OnCombineRecycleBinStagesChanged(bool value) => RebuildFilteredResults();
+
+    /// <summary>0 = Single file, 1 = Split by site.</summary>
+    [ObservableProperty] private int _splitModeIndex;
+    /// <summary>0 = Separate HTML files, 1 = Single tabbed HTML.</summary>
+    [ObservableProperty] private int _htmlLayoutIndex;
+
+    private ReportSplitMode CurrentSplit => SplitModeIndex == 1 ? ReportSplitMode.BySite : ReportSplitMode.Single;
+    private HtmlSplitLayout CurrentLayout => HtmlLayoutIndex == 1 ? HtmlSplitLayout.SingleTabbed : HtmlSplitLayout.SeparateFiles;
+
     private ObservableCollection<FileTypeMetric> _fileTypeMetrics = new();
     public ObservableCollection<FileTypeMetric> FileTypeMetrics
     {
@@ -79,6 +124,15 @@ public partial class StorageViewModel : FeatureViewModelBase
         private set { _barYAxes = value; OnPropertyChanged(); }
     }
 
+    // Stable paint instances. SKDefaultTooltip/Legend bake the Fill paint reference
+    // into their geometry on first Initialize() and never re-read the chart's paint
+    // properties. Replacing instances on theme change has no effect — we mutate
+    // .Color in place so the new theme color renders on the next frame.
+    public SolidColorPaint LegendTextPaint { get; } = new(default(SKColor));
+    public SolidColorPaint LegendBackgroundPaint { get; } = new(default(SKColor));
+    public SolidColorPaint TooltipTextPaint { get; } = new(default(SKColor));
+    public SolidColorPaint TooltipBackgroundPaint { get; } = new(default(SKColor));
+
     public bool IsMaxDepth
     {
         get => FolderDepth >= 999;
@@ -90,6 +144,10 @@ public partial class StorageViewModel : FeatureViewModelBase
         }
     }
 
+    // Raw scan output — never filtered. RebuildFilteredResults projects this
+    // into Results based on the Show* flags.
+    private List<StorageNode> _allNodes = new();
+
     private ObservableCollection<StorageNode> _results = new();
     public ObservableCollection<StorageNode> Results
     {
@@ -105,15 +163,36 @@ public partial class StorageViewModel : FeatureViewModelBase
     }
 
     // ── Summary properties (computed from root-level library nodes) ─────────
+    //
+    // Recycle-bin contents are rolled into each library's TotalSizeBytes by the
+    // StorageService (matches storman.aspx). Including the synthetic root-level
+    // RecycleBin nodes here would double-count those bytes — filter them out.
+    // SummaryRecycleBinSize below still reads from _allNodes so the bin metric
+    // remains visible to the user.
 
-    /// <summary>Sum of TotalSizeBytes across root-level library nodes.</summary>
+    /// <summary>Sum of TotalSizeBytes across root-level non-bin nodes.</summary>
-    public long SummaryTotalSize => Results.Where(n => n.IndentLevel == 0).Sum(n => n.TotalSizeBytes);
+    public long SummaryTotalSize => Results
+        .Where(n => n.IndentLevel == 0 && n.Kind != StorageNodeKind.RecycleBin)
+        .Sum(n => n.TotalSizeBytes);
 
-    /// <summary>Sum of VersionSizeBytes across root-level library nodes.</summary>
+    /// <summary>Sum of VersionSizeBytes across root-level non-bin nodes.</summary>
-    public long SummaryVersionSize => Results.Where(n => n.IndentLevel == 0).Sum(n => n.VersionSizeBytes);
+    public long SummaryVersionSize => Results
+        .Where(n => n.IndentLevel == 0 && n.Kind != StorageNodeKind.RecycleBin)
+        .Sum(n => n.VersionSizeBytes);
 
-    /// <summary>Sum of TotalFileCount across root-level library nodes.</summary>
+    /// <summary>Sum of TotalFileCount across root-level non-bin nodes.</summary>
-    public long SummaryFileCount => Results.Where(n => n.IndentLevel == 0).Sum(n => n.TotalFileCount);
+    public long SummaryFileCount => Results
+        .Where(n => n.IndentLevel == 0 && n.Kind != StorageNodeKind.RecycleBin)
+        .Sum(n => n.TotalFileCount);
+
+    /// <summary>
+    /// Aggregate recycle-bin size (stage 1 + stage 2 across all sites). Reads
+    /// from the raw scan so it stays visible even when the user hides the
+    /// recycle-bin row in the report filter.
+    /// </summary>
+    public long SummaryRecycleBinSize => _allNodes
+        .Where(n => n.Kind == StorageNodeKind.RecycleBin)
+        .Sum(n => n.TotalSizeBytes);
 
     public bool HasResults => Results.Count > 0;
 
@@ -121,6 +200,7 @@ public partial class StorageViewModel : FeatureViewModelBase
     {
         OnPropertyChanged(nameof(SummaryTotalSize));
         OnPropertyChanged(nameof(SummaryVersionSize));
+        OnPropertyChanged(nameof(SummaryRecycleBinSize));
         OnPropertyChanged(nameof(SummaryFileCount));
         OnPropertyChanged(nameof(HasResults));
     }
@@ -136,7 +216,10 @@ public partial class StorageViewModel : FeatureViewModelBase
         StorageCsvExportService csvExportService,
         StorageHtmlExportService htmlExportService,
         IBrandingService brandingService,
-        ILogger<FeatureViewModelBase> logger)
+        ILogger<FeatureViewModelBase> logger,
+        IOwnershipElevationService? ownershipService = null,
+        SettingsService? settingsService = null,
+        ThemeManager? themeManager = null)
         : base(logger)
     {
         _storageService    = storageService;
@@ -144,10 +227,17 @@ public partial class StorageViewModel : FeatureViewModelBase
         _csvExportService  = csvExportService;
         _htmlExportService = htmlExportService;
         _brandingService   = brandingService;
+        _ownershipService  = ownershipService;
+        _settingsService   = settingsService;
+        _themeManager      = themeManager;
         _logger            = logger;
 
         ExportCsvCommand  = new AsyncRelayCommand(ExportCsvAsync,  CanExport);
         ExportHtmlCommand = new AsyncRelayCommand(ExportHtmlAsync, CanExport);
+
+        ApplyChartThemeColors();
+        if (_themeManager is not null)
+            _themeManager.ThemeChanged += (_, _) => UpdateChartSeries();
     }
 
     /// <summary>Test constructor — omits export services.</summary>
@@ -173,14 +263,14 @@ public partial class StorageViewModel : FeatureViewModelBase
     {
         if (_currentProfile == null)
         {
-            StatusMessage = "No tenant selected. Please connect to a tenant first.";
+            StatusMessage = TranslationSource.Instance["err.no_tenant_connected"];
             return;
         }
 
         var urls = GlobalSites.Select(s => s.Url).Where(u => !string.IsNullOrWhiteSpace(u)).ToList();
         if (urls.Count == 0)
         {
-            StatusMessage = "Select at least one site from the toolbar.";
+            StatusMessage = TranslationSource.Instance["err.no_sites_selected"];
             return;
         }
 
@@ -189,10 +279,17 @@ public partial class StorageViewModel : FeatureViewModelBase
         var options = new StorageScanOptions(
             PerLibrary: PerLibrary,
             IncludeSubsites: IncludeSubsites,
-            FolderDepth: FolderDepth);
+            FolderDepth: FolderDepth,
+            IncludeHiddenLibraries: ScanHiddenLibraries,
+            IncludePreservationHold: ScanPreservationHold,
+            IncludeListAttachments: ScanListAttachments,
+            IncludeRecycleBin: ScanRecycleBin);
 
         var allNodes = new List<StorageNode>();
         var allTypeMetrics = new List<FileTypeMetric>();
+        long spoReportedTotal = 0;
+
+        var autoOwnership = await IsAutoTakeOwnershipEnabled();
 
         int i = 0;
         foreach (var url in nonEmpty)
@@ -207,9 +304,30 @@ public partial class StorageViewModel : FeatureViewModelBase
                 ClientId = _currentProfile.ClientId,
                 Name = _currentProfile.Name
             };
+
             var ctx = await _sessionManager.GetOrCreateContextAsync(siteProfile, ct);
 
-            var nodes = await _storageService.CollectStorageAsync(ctx, options, progress, ct);
+            IReadOnlyList<StorageNode> nodes;
+            try
+            {
+                nodes = await _storageService.CollectStorageAsync(ctx, options, progress, ct);
+            }
+            catch (Microsoft.SharePoint.Client.ServerUnauthorizedAccessException) when (_ownershipService != null && autoOwnership)
+            {
+                _logger.LogWarning("Access denied on {Url}, auto-elevating ownership...", url);
+                var adminUrl = DeriveAdminUrl(_currentProfile.TenantUrl ?? url);
+                var adminProfile = new TenantProfile
+                {
+                    TenantUrl = adminUrl,
+                    ClientId = _currentProfile.ClientId,
+                    Name = _currentProfile.Name
+                };
+                var adminCtx = await _sessionManager.GetOrCreateContextAsync(adminProfile, ct);
+                await _ownershipService.ElevateAsync(adminCtx, url, string.Empty, ct);
+
+                ctx = await _sessionManager.GetOrCreateContextAsync(siteProfile, ct);
+                nodes = await _storageService.CollectStorageAsync(ctx, options, progress, ct);
+            }
 
             // Backfill any libraries where StorageMetrics returned zeros
             await _storageService.BackfillZeroNodesAsync(ctx, nodes, progress, ct);
@@ -219,6 +337,8 @@ public partial class StorageViewModel : FeatureViewModelBase
             progress.Report(OperationProgress.Indeterminate($"Scanning file types: {url}..."));
             var typeMetrics = await _storageService.CollectFileTypeMetricsAsync(ctx, progress, ct);
             allTypeMetrics.AddRange(typeMetrics);
+
+            spoReportedTotal += await _storageService.GetSiteUsageStorageBytesAsync(ctx, progress, ct);
         }
 
         // Flatten tree for DataGrid display
@@ -237,20 +357,113 @@ public partial class StorageViewModel : FeatureViewModelBase
         {
             await dispatcher.InvokeAsync(() =>
             {
-                Results = new ObservableCollection<StorageNode>(flat);
+                _allNodes = flat;
+                SpoReportedTotalSize = spoReportedTotal;
+                RebuildFilteredResults();
                 FileTypeMetrics = new ObservableCollection<FileTypeMetric>(mergedMetrics);
             });
         }
         else
         {
-            Results = new ObservableCollection<StorageNode>(flat);
+            _allNodes = flat;
+            SpoReportedTotalSize = spoReportedTotal;
+            RebuildFilteredResults();
             FileTypeMetrics = new ObservableCollection<FileTypeMetric>(mergedMetrics);
         }
     }
 
+    /// <summary>
+    /// Project <see cref="_allNodes"/> into <see cref="Results"/> using the
+    /// Show* flags. Nodes whose root ancestor is excluded by the flags are
+    /// dropped along with their entire subtree, preserving DFS ordering.
+    /// </summary>
+    private void RebuildFilteredResults()
+    {
+        if (_allNodes.Count == 0)
+        {
+            Results = new ObservableCollection<StorageNode>();
+            return;
+        }
+
+        var filtered = new List<StorageNode>(_allNodes.Count);
+        bool includeCurrentSubtree = true;
+
+        foreach (var node in _allNodes)
+        {
+            if (node.IndentLevel == 0)
+                includeCurrentSubtree = IsKindShown(node.Kind);
+            if (includeCurrentSubtree)
+                filtered.Add(node);
+        }
+
+        if (CombineRecycleBinStages)
+            filtered = CombineRecycleBins(filtered);
+
+        Results = new ObservableCollection<StorageNode>(filtered);
+    }
+
+    /// <summary>
+    /// Replaces all root recycle-bin nodes (stage 1 + stage 2) with a single
+    /// aggregate row inserted at the position of the first recycle-bin node
+    /// encountered. Preserves SiteTitle grouping when scans cover multiple
+    /// sites by aggregating per SiteTitle.
+    /// </summary>
+    private static List<StorageNode> CombineRecycleBins(List<StorageNode> input)
+    {
+        var byPath = new Dictionary<string, StorageNode>(StringComparer.OrdinalIgnoreCase);
+        var result = new List<StorageNode>(input.Count);
+
+        foreach (var node in input)
+        {
+            if (node.IndentLevel == 0 && node.Kind == StorageNodeKind.RecycleBin)
+            {
+                string key = node.SiteTitle ?? string.Empty;
+                if (!byPath.TryGetValue(key, out var agg))
+                {
+                    agg = new StorageNode
+                    {
+                        Name        = "[Recycle Bin] Total",
+                        SiteTitle   = node.SiteTitle ?? string.Empty,
+                        Library     = "RecycleBin",
+                        Kind        = StorageNodeKind.RecycleBin,
+                        IndentLevel = 0,
+                        Children    = new List<StorageNode>()
+                    };
+                    byPath[key] = agg;
+                    result.Add(agg);
+                }
+                agg.TotalSizeBytes      += node.TotalSizeBytes;
+                agg.FileStreamSizeBytes += node.FileStreamSizeBytes;
+                agg.TotalFileCount      += node.TotalFileCount;
+                if (node.LastModified.HasValue &&
+                    (!agg.LastModified.HasValue || node.LastModified > agg.LastModified))
+                    agg.LastModified = node.LastModified;
+            }
+            else
+            {
+                result.Add(node);
+            }
+        }
+
+        return result;
+    }
+
+    private bool IsKindShown(StorageNodeKind kind) => kind switch
+    {
+        StorageNodeKind.Library          => ShowLibraries,
+        StorageNodeKind.HiddenLibrary    => ShowHiddenLibraries,
+        StorageNodeKind.PreservationHold => ShowPreservationHold,
+        StorageNodeKind.ListAttachments  => ShowListAttachments,
+        StorageNodeKind.RecycleBin       => ShowRecycleBin,
+        StorageNodeKind.Subsite          => ShowSubsites,
+        _ => true
+    };
+
     protected override void OnTenantSwitched(TenantProfile profile)
     {
         _currentProfile = profile;
+        _allNodes = new List<StorageNode>();
+        SpoReportedTotalSize = 0;
         Results = new ObservableCollection<StorageNode>();
         FileTypeMetrics = new ObservableCollection<FileTypeMetric>();
         OnPropertyChanged(nameof(CurrentProfile));
@@ -258,6 +471,24 @@ public partial class StorageViewModel : FeatureViewModelBase
         ExportHtmlCommand.NotifyCanExecuteChanged();
     }
 
+    private async Task<bool> IsAutoTakeOwnershipEnabled()
+    {
+        if (_settingsService == null) return false;
+        var settings = await _settingsService.GetSettingsAsync();
+        return settings.AutoTakeOwnership;
+    }
+
+    internal static string DeriveAdminUrl(string tenantUrl)
+    {
+        var uri = new Uri(tenantUrl.TrimEnd('/'));
+        var host = uri.Host;
+        if (host.Contains("-admin.sharepoint.com", StringComparison.OrdinalIgnoreCase))
+            return tenantUrl;
+        var adminHost = host.Replace(".sharepoint.com", "-admin.sharepoint.com",
+            StringComparison.OrdinalIgnoreCase);
+        return $"{uri.Scheme}://{adminHost}";
+    }
+
     internal void SetCurrentProfile(TenantProfile profile) => _currentProfile = profile;
 
     internal Task TestRunOperationAsync(CancellationToken ct, IProgress<OperationProgress> progress)
@@ -278,7 +509,7 @@ public partial class StorageViewModel : FeatureViewModelBase
         if (dialog.ShowDialog() != true) return;
         try
         {
-            await _csvExportService.WriteAsync(Results, FileTypeMetrics, dialog.FileName, CancellationToken.None);
+            await _csvExportService.WriteAsync(Results, FileTypeMetrics, dialog.FileName, CurrentSplit, CancellationToken.None);
             OpenFile(dialog.FileName);
         }
         catch (Exception ex)
@@ -309,7 +540,7 @@ public partial class StorageViewModel : FeatureViewModelBase
                 branding = new ReportBranding(mspLogo, clientLogo);
             }
 
-            await _htmlExportService.WriteAsync(Results, FileTypeMetrics, dialog.FileName, CancellationToken.None, branding);
+            await _htmlExportService.WriteAsync(Results, FileTypeMetrics, dialog.FileName, CurrentSplit, CurrentLayout, CancellationToken.None, branding);
             OpenFile(dialog.FileName);
         }
         catch (Exception ex)
@@ -324,11 +555,25 @@ public partial class StorageViewModel : FeatureViewModelBase
         UpdateChartSeries();
     }
 
+    private SKColor ChartFgColor => (_themeManager?.IsDarkActive ?? false) ? new SKColor(0xE7, 0xEA, 0xF1) : new SKColor(0x1F, 0x24, 0x30);
+    private SKColor ChartSeparatorColor => (_themeManager?.IsDarkActive ?? false) ? new SKColor(0x32, 0x38, 0x49) : new SKColor(0xE3, 0xE6, 0xEC);
+    private SKColor ChartSurfaceColor => (_themeManager?.IsDarkActive ?? false) ? new SKColor(0x1E, 0x22, 0x30) : new SKColor(0xFF, 0xFF, 0xFF);
+
+    private void ApplyChartThemeColors()
+    {
+        LegendTextPaint.Color = ChartFgColor;
+        LegendBackgroundPaint.Color = ChartSurfaceColor;
+        TooltipTextPaint.Color = ChartFgColor;
+        TooltipBackgroundPaint.Color = ChartSurfaceColor;
+    }
+
     private void UpdateChartSeries()
     {
         var metrics = FileTypeMetrics.ToList();
         OnPropertyChanged(nameof(HasChartData));
 
+        ApplyChartThemeColors();
+
         if (metrics.Count == 0)
         {
             PieChartSeries = Enumerable.Empty<ISeries>();
@@ -361,6 +606,7 @@ public partial class StorageViewModel : FeatureViewModelBase
                 HoverPushout = 8,
                 MaxRadialColumnWidth = 60,
                 DataLabelsFormatter = _ => m.DisplayLabel,
+                DataLabelsPaint = new SolidColorPaint(ChartFgColor),
                 ToolTipLabelFormatter = _ =>
                     $"{m.DisplayLabel}: {FormatBytes(m.TotalSizeBytes)} ({m.FileCount} files)",
                 IsVisibleAtLegend = true,
@@ -379,7 +625,8 @@ public partial class StorageViewModel : FeatureViewModelBase
                 {
                     int idx = (int)point.Index;
                     return idx < chartItems.Count ? FormatBytes(chartItems[idx].TotalSizeBytes) : "";
-                }
+                },
+                DataLabelsPaint = new SolidColorPaint(ChartFgColor)
             }
         };
 
@@ -388,7 +635,10 @@ public partial class StorageViewModel : FeatureViewModelBase
             new Axis
             {
                 Labels = chartItems.Select(m => m.DisplayLabel).ToArray(),
-                LabelsRotation = -45
+                LabelsRotation = -45,
+                LabelsPaint = new SolidColorPaint(ChartFgColor),
+                TicksPaint  = new SolidColorPaint(ChartFgColor),
+                SeparatorsPaint = new SolidColorPaint(ChartSeparatorColor)
             }
         };
 
@@ -396,7 +646,10 @@ public partial class StorageViewModel : FeatureViewModelBase
         {
             new Axis
             {
-                Labeler = value => FormatBytes((long)value)
+                Labeler = value => FormatBytes((long)value),
+                LabelsPaint = new SolidColorPaint(ChartFgColor),
+                TicksPaint  = new SolidColorPaint(ChartFgColor),
+                SeparatorsPaint = new SolidColorPaint(ChartSeparatorColor)
             }
         };
     }

SharepointToolbox/ViewModels/Tabs/TemplatesViewModel.cs

@@ -6,6 +6,7 @@ using Microsoft.Extensions.Logging;
 using Serilog;
 using SharepointToolbox.Core.Models;
 using SharepointToolbox.Infrastructure.Persistence;
+using SharepointToolbox.Localization;
 using SharepointToolbox.Services;
 
 namespace SharepointToolbox.ViewModels.Tabs;
@@ -39,6 +40,7 @@ public partial class TemplatesViewModel : FeatureViewModelBase
     // Apply options
     [ObservableProperty] private string _newSiteTitle = string.Empty;
     [ObservableProperty] private string _newSiteAlias = string.Empty;
+    private bool _aliasManuallyEdited;
 
     public IAsyncRelayCommand CaptureCommand { get; }
     public IAsyncRelayCommand ApplyCommand { get; }
@@ -78,19 +80,20 @@ public partial class TemplatesViewModel : FeatureViewModelBase
 
     private async Task CaptureAsync()
     {
+        var T = TranslationSource.Instance;
         if (_currentProfile == null)
-            throw new InvalidOperationException("No tenant connected.");
+            throw new InvalidOperationException(T["err.no_tenant"]);
         if (string.IsNullOrWhiteSpace(TemplateName))
-            throw new InvalidOperationException("Template name is required.");
+            throw new InvalidOperationException(T["err.template_name_required"]);
 
         var captureSiteUrl = GlobalSites.Select(s => s.Url).FirstOrDefault(u => !string.IsNullOrWhiteSpace(u));
         if (string.IsNullOrWhiteSpace(captureSiteUrl))
-            throw new InvalidOperationException("Select at least one site from the toolbar.");
+            throw new InvalidOperationException(T["err.no_sites_selected"]);
 
         try
         {
             IsRunning = true;
-            StatusMessage = "Capturing template...";
+            StatusMessage = T["templates.status.capturing"];
 
             var profile = new TenantProfile
             {
@@ -117,11 +120,11 @@ public partial class TemplatesViewModel : FeatureViewModelBase
             Log.Information("Template captured: {Name} from {Url}", template.Name, captureSiteUrl);
 
             await RefreshListAsync();
-            StatusMessage = $"Template captured successfully.";
+            StatusMessage = T["templates.status.success"];
         }
         catch (Exception ex)
         {
-            StatusMessage = $"Capture failed: {ex.Message}";
+            StatusMessage = string.Format(T["templates.status.capture_failed"], ex.Message);
             Log.Error(ex, "Template capture failed");
         }
         finally
@@ -133,15 +136,23 @@ public partial class TemplatesViewModel : FeatureViewModelBase
     private async Task ApplyAsync()
     {
         if (_currentProfile == null || SelectedTemplate == null) return;
+        var T = TranslationSource.Instance;
         if (string.IsNullOrWhiteSpace(NewSiteTitle))
-            throw new InvalidOperationException("New site title is required.");
+            throw new InvalidOperationException(T["err.site_title_required"]);
+
+        // Auto-fill alias from title if user left it blank
         if (string.IsNullOrWhiteSpace(NewSiteAlias))
-            throw new InvalidOperationException("New site alias is required.");
+        {
+            var generated = GenerateAliasFromTitle(NewSiteTitle);
+            if (string.IsNullOrWhiteSpace(generated))
+                throw new InvalidOperationException(T["err.site_alias_required"]);
+            NewSiteAlias = generated;
+        }
 
         try
         {
             IsRunning = true;
-            StatusMessage = $"Applying template...";
+            StatusMessage = T["templates.status.applying"];
 
             var ctx = await _sessionManager.GetOrCreateContextAsync(_currentProfile, CancellationToken.None);
             var progress = new Progress<OperationProgress>(p => StatusMessage = p.Message);
@@ -150,12 +161,12 @@ public partial class TemplatesViewModel : FeatureViewModelBase
                 ctx, SelectedTemplate, NewSiteTitle, NewSiteAlias,
                 progress, CancellationToken.None);
 
-            StatusMessage = $"Template applied. Site created at: {siteUrl}";
+            StatusMessage = string.Format(T["templates.status.applied"], siteUrl);
             Log.Information("Template applied. New site: {Url}", siteUrl);
         }
         catch (Exception ex)
         {
-            StatusMessage = $"Apply failed: {ex.Message}";
+            StatusMessage = string.Format(T["templates.status.apply_failed"], ex.Message);
             Log.Error(ex, "Template apply failed");
         }
         finally
@@ -204,6 +215,7 @@ public partial class TemplatesViewModel : FeatureViewModelBase
         TemplateName = string.Empty;
         NewSiteTitle = string.Empty;
         NewSiteAlias = string.Empty;
+        _aliasManuallyEdited = false;
         StatusMessage = string.Empty;
 
         _ = RefreshListAsync();
@@ -215,4 +227,44 @@ public partial class TemplatesViewModel : FeatureViewModelBase
         RenameCommand.NotifyCanExecuteChanged();
         DeleteCommand.NotifyCanExecuteChanged();
     }
+
+    partial void OnNewSiteTitleChanged(string value)
+    {
+        if (_aliasManuallyEdited) return;
+        var generated = GenerateAliasFromTitle(value);
+        if (NewSiteAlias != generated)
+        {
+            // Bypass user-edit flag while we sync alias to title
+            _suppressAliasEditedFlag = true;
+            NewSiteAlias = generated;
+            _suppressAliasEditedFlag = false;
+        }
+    }
+
+    private bool _suppressAliasEditedFlag;
+
+    partial void OnNewSiteAliasChanged(string value)
+    {
+        if (_suppressAliasEditedFlag) return;
+        _aliasManuallyEdited = !string.IsNullOrWhiteSpace(value)
+            && value != GenerateAliasFromTitle(NewSiteTitle);
+        if (string.IsNullOrWhiteSpace(value)) _aliasManuallyEdited = false;
+    }
+
+    internal static string GenerateAliasFromTitle(string title)
+    {
+        if (string.IsNullOrWhiteSpace(title)) return string.Empty;
+
+        var normalized = title.Normalize(System.Text.NormalizationForm.FormD);
+        var sb = new System.Text.StringBuilder(normalized.Length);
+        foreach (var c in normalized)
+        {
+            var cat = System.Globalization.CharUnicodeInfo.GetUnicodeCategory(c);
+            if (cat == System.Globalization.UnicodeCategory.NonSpacingMark) continue;
+            if (char.IsLetterOrDigit(c)) sb.Append(c);
+            else if (c == ' ' || c == '-' || c == '_') sb.Append('-');
+        }
+        var collapsed = System.Text.RegularExpressions.Regex.Replace(sb.ToString(), "-+", "-");
+        return collapsed.Trim('-');
+    }
 }

SharepointToolbox/ViewModels/Tabs/TransferViewModel.cs

@@ -5,6 +5,7 @@ using Microsoft.Extensions.Logging;
 using Microsoft.Win32;
 using Serilog;
 using SharepointToolbox.Core.Models;
+using SharepointToolbox.Localization;
 using SharepointToolbox.Services;
 using SharepointToolbox.Services.Export;
 
@@ -15,6 +16,8 @@ public partial class TransferViewModel : FeatureViewModelBase
     private readonly IFileTransferService _transferService;
     private readonly ISessionManager _sessionManager;
     private readonly BulkResultCsvExportService _exportService;
+    private readonly IOwnershipElevationService? _ownershipService;
+    private readonly SettingsService? _settingsService;
     private readonly ILogger<FeatureViewModelBase> _logger;
     private TenantProfile? _currentProfile;
     private bool _hasLocalSourceSiteOverride;
@@ -32,6 +35,17 @@ public partial class TransferViewModel : FeatureViewModelBase
     // Transfer options
     [ObservableProperty] private TransferMode _transferMode = TransferMode.Copy;
     [ObservableProperty] private ConflictPolicy _conflictPolicy = ConflictPolicy.Skip;
+    [ObservableProperty] private bool _includeSourceFolder;
+    [ObservableProperty] private bool _copyFolderContents = true;
+
+    /// <summary>
+    /// Library-relative file paths the user checked in the source picker.
+    /// When non-empty, only these files are transferred — folder recursion is skipped.
+    /// </summary>
+    public List<string> SelectedFilePaths { get; } = new();
+
+    /// <summary>Count of per-file selections, for display in the view.</summary>
+    public int SelectedFileCount => SelectedFilePaths.Count;
 
     // Results
     [ObservableProperty] private string _resultSummary = string.Empty;
@@ -51,12 +65,16 @@ public partial class TransferViewModel : FeatureViewModelBase
         IFileTransferService transferService,
         ISessionManager sessionManager,
         BulkResultCsvExportService exportService,
-        ILogger<FeatureViewModelBase> logger)
+        ILogger<FeatureViewModelBase> logger,
+        IOwnershipElevationService? ownershipService = null,
+        SettingsService? settingsService = null)
         : base(logger)
     {
         _transferService = transferService;
         _sessionManager = sessionManager;
         _exportService = exportService;
+        _ownershipService = ownershipService;
+        _settingsService = settingsService;
         _logger = logger;
 
         ExportFailedCommand = new AsyncRelayCommand(ExportFailedAsync, () => HasFailures);
@@ -84,14 +102,15 @@ public partial class TransferViewModel : FeatureViewModelBase
 
     protected override async Task RunOperationAsync(CancellationToken ct, IProgress<OperationProgress> progress)
     {
+        var T = TranslationSource.Instance;
         if (_currentProfile == null)
-            throw new InvalidOperationException("No tenant connected.");
+            throw new InvalidOperationException(T["err.no_tenant"]);
 
         if (string.IsNullOrWhiteSpace(SourceSiteUrl) || string.IsNullOrWhiteSpace(SourceLibrary))
-            throw new InvalidOperationException("Source site and library must be selected.");
+            throw new InvalidOperationException(T["err.transfer_source_required"]);
 
         if (string.IsNullOrWhiteSpace(DestSiteUrl) || string.IsNullOrWhiteSpace(DestLibrary))
-            throw new InvalidOperationException("Destination site and library must be selected.");
+            throw new InvalidOperationException(T["err.transfer_dest_required"]);
 
         // Confirmation dialog
         var message = $"{TransferMode} files from {SourceLibrary} to {DestLibrary} ({ConflictPolicy} on conflict)";
@@ -108,6 +127,9 @@ public partial class TransferViewModel : FeatureViewModelBase
             DestinationFolderPath = DestFolderPath,
             Mode = TransferMode,
             ConflictPolicy = ConflictPolicy,
+            SelectedFilePaths = SelectedFilePaths.ToList(),
+            IncludeSourceFolder = IncludeSourceFolder,
+            CopyFolderContents = CopyFolderContents,
         };
 
         // Build per-site profiles so SessionManager can resolve contexts
@@ -127,7 +149,33 @@ public partial class TransferViewModel : FeatureViewModelBase
         var srcCtx = await _sessionManager.GetOrCreateContextAsync(srcProfile, ct);
         var dstCtx = await _sessionManager.GetOrCreateContextAsync(dstProfile, ct);
 
-        _lastResult = await _transferService.TransferAsync(srcCtx, dstCtx, job, progress, ct);
+        var autoOwnership = await IsAutoTakeOwnershipEnabled();
+
+        try
+        {
+            _lastResult = await _transferService.TransferAsync(srcCtx, dstCtx, job, progress, ct);
+        }
+        catch (Microsoft.SharePoint.Client.ServerUnauthorizedAccessException ex)
+            when (_ownershipService != null && autoOwnership)
+        {
+            _logger.LogWarning(ex, "Transfer hit access denied — auto-elevating on source and destination.");
+            var adminUrl = DeriveAdminUrl(_currentProfile.TenantUrl ?? SourceSiteUrl);
+            var adminProfile = new TenantProfile
+            {
+                Name = _currentProfile.Name,
+                TenantUrl = adminUrl,
+                ClientId = _currentProfile.ClientId,
+            };
+            var adminCtx = await _sessionManager.GetOrCreateContextAsync(adminProfile, ct);
+
+            await _ownershipService.ElevateAsync(adminCtx, SourceSiteUrl, string.Empty, ct);
+            await _ownershipService.ElevateAsync(adminCtx, DestSiteUrl, string.Empty, ct);
+
+            // Retry with fresh contexts so the new admin membership is honoured.
+            srcCtx = await _sessionManager.GetOrCreateContextAsync(srcProfile, ct);
+            dstCtx = await _sessionManager.GetOrCreateContextAsync(dstProfile, ct);
+            _lastResult = await _transferService.TransferAsync(srcCtx, dstCtx, job, progress, ct);
+        }
 
         // Update UI on dispatcher
         await Application.Current.Dispatcher.InvokeAsync(() =>
@@ -182,6 +230,34 @@ public partial class TransferViewModel : FeatureViewModelBase
         DestFolderPath = string.Empty;
         ResultSummary = string.Empty;
         HasFailures = false;
+        SelectedFilePaths.Clear();
+        OnPropertyChanged(nameof(SelectedFileCount));
         _lastResult = null;
     }
+
+    /// <summary>Replaces the current per-file selection and notifies the view.</summary>
+    public void SetSelectedFiles(IEnumerable<string> libraryRelativePaths)
+    {
+        SelectedFilePaths.Clear();
+        SelectedFilePaths.AddRange(libraryRelativePaths);
+        OnPropertyChanged(nameof(SelectedFileCount));
+    }
+
+    private async Task<bool> IsAutoTakeOwnershipEnabled()
+    {
+        if (_settingsService == null) return false;
+        var settings = await _settingsService.GetSettingsAsync();
+        return settings.AutoTakeOwnership;
+    }
+
+    internal static string DeriveAdminUrl(string tenantUrl)
+    {
+        var uri = new Uri(tenantUrl.TrimEnd('/'));
+        var host = uri.Host;
+        if (host.Contains("-admin.sharepoint.com", StringComparison.OrdinalIgnoreCase))
+            return tenantUrl;
+        var adminHost = host.Replace(".sharepoint.com", "-admin.sharepoint.com",
+            StringComparison.OrdinalIgnoreCase);
+        return $"{uri.Scheme}://{adminHost}";
+    }
 }

SharepointToolbox/ViewModels/Tabs/UserAccessAuditViewModel.cs

@@ -8,6 +8,7 @@ using CommunityToolkit.Mvvm.Input;
 using Microsoft.Extensions.Logging;
 using Microsoft.Win32;
 using SharepointToolbox.Core.Models;
+using SharepointToolbox.Localization;
 using SharepointToolbox.Services;
 using SharepointToolbox.Services.Export;
 
@@ -27,6 +28,8 @@ public partial class UserAccessAuditViewModel : FeatureViewModelBase
     private readonly UserAccessHtmlExportService? _htmlExportService;
     private readonly IBrandingService? _brandingService;
     private readonly IGraphUserDirectoryService? _graphUserDirectoryService;
+    private readonly IOwnershipElevationService? _ownershipService;
+    private readonly SettingsService? _settingsService;
     private readonly ILogger<FeatureViewModelBase> _logger;
 
     // ── People picker debounce ──────────────────────────────────────────────
@@ -105,6 +108,19 @@ public partial class UserAccessAuditViewModel : FeatureViewModelBase
     [ObservableProperty]
     private bool _mergePermissions;
 
+    /// <summary>0 = Single file, 1 = Split by site, 2 = Split by user.</summary>
+    [ObservableProperty] private int _splitModeIndex;
+    /// <summary>0 = Separate HTML files, 1 = Single tabbed HTML.</summary>
+    [ObservableProperty] private int _htmlLayoutIndex;
+
+    private ReportSplitMode CurrentSplit => SplitModeIndex switch
+    {
+        1 => ReportSplitMode.BySite,
+        2 => ReportSplitMode.ByUser,
+        _ => ReportSplitMode.Single
+    };
+    private HtmlSplitLayout CurrentLayout => HtmlLayoutIndex == 1 ? HtmlSplitLayout.SingleTabbed : HtmlSplitLayout.SeparateFiles;
+
     private CancellationTokenSource? _directoryCts = null;
 
     // ── Computed summary properties ─────────────────────────────────────────
@@ -163,7 +179,9 @@ public partial class UserAccessAuditViewModel : FeatureViewModelBase
         UserAccessHtmlExportService htmlExportService,
         IBrandingService brandingService,
         IGraphUserDirectoryService graphUserDirectoryService,
-        ILogger<FeatureViewModelBase> logger)
+        ILogger<FeatureViewModelBase> logger,
+        IOwnershipElevationService? ownershipService = null,
+        SettingsService? settingsService = null)
         : base(logger)
     {
         _auditService = auditService;
@@ -173,6 +191,8 @@ public partial class UserAccessAuditViewModel : FeatureViewModelBase
         _htmlExportService = htmlExportService;
         _brandingService = brandingService;
         _graphUserDirectoryService = graphUserDirectoryService;
+        _ownershipService = ownershipService;
+        _settingsService = settingsService;
         _logger = logger;
 
         ExportCsvCommand = new AsyncRelayCommand(ExportCsvAsync, CanExport);
@@ -248,13 +268,13 @@ public partial class UserAccessAuditViewModel : FeatureViewModelBase
     {
         if (SelectedUsers.Count == 0)
         {
-            StatusMessage = "Add at least one user to audit.";
+            StatusMessage = TranslationSource.Instance["err.no_users_selected"];
             return;
         }
 
         if (GlobalSites.Count == 0)
         {
-            StatusMessage = "Select at least one site from the toolbar.";
+            StatusMessage = TranslationSource.Instance["err.no_sites_selected"];
             return;
         }
 
@@ -269,10 +289,39 @@ public partial class UserAccessAuditViewModel : FeatureViewModelBase
 
         if (_currentProfile == null)
         {
-            StatusMessage = "No tenant profile selected. Please connect first.";
+            StatusMessage = TranslationSource.Instance["err.no_profile_selected"];
             return;
         }
 
+        var autoOwnership = await IsAutoTakeOwnershipEnabled();
+
+        Func<string, CancellationToken, Task<bool>>? onAccessDenied = null;
+        if (_ownershipService != null && autoOwnership)
+        {
+            onAccessDenied = async (siteUrl, token) =>
+            {
+                try
+                {
+                    _logger.LogWarning("Access denied on {Url}, auto-elevating ownership...", siteUrl);
+                    var adminUrl = DeriveAdminUrl(_currentProfile?.TenantUrl ?? siteUrl);
+                    var adminProfile = new TenantProfile
+                    {
+                        TenantUrl = adminUrl,
+                        ClientId = _currentProfile?.ClientId ?? string.Empty,
+                        Name = _currentProfile?.Name ?? string.Empty
+                    };
+                    var adminCtx = await _sessionManager.GetOrCreateContextAsync(adminProfile, token);
+                    await _ownershipService.ElevateAsync(adminCtx, siteUrl, string.Empty, token);
+                    return true;
+                }
+                catch (Exception ex)
+                {
+                    _logger.LogError(ex, "Auto-elevation failed for {Url}", siteUrl);
+                    return false;
+                }
+            };
+        }
+
         var entries = await _auditService.AuditUsersAsync(
             _sessionManager,
             _currentProfile,
@@ -280,7 +329,8 @@ public partial class UserAccessAuditViewModel : FeatureViewModelBase
             effectiveSites,
             scanOptions,
             progress,
-            ct);
+            ct,
+            onAccessDenied);
 
         // Update Results on the UI thread — clear + repopulate (not replace)
         // so the CollectionViewSource bound to ResultsView stays connected.
@@ -307,6 +357,26 @@ public partial class UserAccessAuditViewModel : FeatureViewModelBase
         ExportHtmlCommand.NotifyCanExecuteChanged();
     }
 
+    // ── Auto-ownership helpers ───────────────────────────────────────────────
+
+    private async Task<bool> IsAutoTakeOwnershipEnabled()
+    {
+        if (_settingsService == null) return false;
+        var settings = await _settingsService.GetSettingsAsync();
+        return settings.AutoTakeOwnership;
+    }
+
+    internal static string DeriveAdminUrl(string tenantUrl)
+    {
+        var uri = new Uri(tenantUrl.TrimEnd('/'));
+        var host = uri.Host;
+        if (host.Contains("-admin.sharepoint.com", StringComparison.OrdinalIgnoreCase))
+            return tenantUrl;
+        var adminHost = host.Replace(".sharepoint.com", "-admin.sharepoint.com",
+            StringComparison.OrdinalIgnoreCase);
+        return $"{uri.Scheme}://{adminHost}";
+    }
+
     // ── Tenant switching ─────────────────────────────────────────────────────
 
     protected override void OnTenantSwitched(TenantProfile profile)
@@ -402,7 +472,7 @@ public partial class UserAccessAuditViewModel : FeatureViewModelBase
         var clientId = _currentProfile?.ClientId;
         if (string.IsNullOrEmpty(clientId))
         {
-            StatusMessage = "No tenant profile selected. Please connect first.";
+            StatusMessage = TranslationSource.Instance["err.no_profile_selected"];
             return;
         }
 
@@ -496,7 +566,7 @@ public partial class UserAccessAuditViewModel : FeatureViewModelBase
         if (dialog.ShowDialog() != true) return;
         try
         {
-            await _csvExportService.WriteSingleFileAsync(Results, dialog.FileName, CancellationToken.None, MergePermissions);
+            await _csvExportService.WriteAsync((IReadOnlyList<UserAccessEntry>)Results, dialog.FileName, CurrentSplit, CancellationToken.None, MergePermissions);
             OpenFile(dialog.FileName);
         }
         catch (Exception ex)
@@ -527,7 +597,7 @@ public partial class UserAccessAuditViewModel : FeatureViewModelBase
                 branding = new ReportBranding(mspLogo, clientLogo);
             }
 
-            await _htmlExportService.WriteAsync(Results, dialog.FileName, CancellationToken.None, MergePermissions, branding);
+            await _htmlExportService.WriteAsync((IReadOnlyList<UserAccessEntry>)Results, dialog.FileName, CurrentSplit, CurrentLayout, CancellationToken.None, MergePermissions, branding);
             OpenFile(dialog.FileName);
         }
         catch (Exception ex)

SharepointToolbox/ViewModels/Tabs/VersionCleanupViewModel.cs

@@ -0,0 +1,279 @@
+using System.Collections.ObjectModel;
+using System.Diagnostics;
+using System.Windows;
+using CommunityToolkit.Mvvm.ComponentModel;
+using CommunityToolkit.Mvvm.Input;
+using Microsoft.Extensions.Logging;
+using Microsoft.Win32;
+using SharepointToolbox.Core.Models;
+using SharepointToolbox.Localization;
+using SharepointToolbox.Services;
+using SharepointToolbox.Services.Export;
+
+namespace SharepointToolbox.ViewModels.Tabs;
+
+public partial class VersionCleanupViewModel : FeatureViewModelBase
+{
+    private readonly IVersionCleanupService _versionService;
+    private readonly ISessionManager _sessionManager;
+    private readonly VersionCleanupHtmlExportService _htmlExportService;
+    private readonly IBrandingService _brandingService;
+    private readonly ILogger<FeatureViewModelBase> _logger;
+    private TenantProfile? _currentProfile;
+
+    [ObservableProperty]
+    private int _keepLast = 5;
+
+    [ObservableProperty]
+    private bool _keepFirstVersion;
+
+    [ObservableProperty]
+    private bool _confirmDelete = true;
+
+    [ObservableProperty]
+    private string _selectedLibrariesLabel = string.Empty;
+
+    public ObservableCollection<string> SelectedLibraries { get; } = new();
+
+    public ObservableCollection<VersionCleanupResult> Results { get; } = new();
+
+    public long TotalBytesFreed => Results.Sum(r => r.BytesFreed);
+    public int TotalVersionsDeleted => Results.Sum(r => r.VersionsDeleted);
+    public int TotalFilesAffected => Results.Count(r => r.VersionsDeleted > 0);
+    public bool HasResults => Results.Count > 0;
+
+    public TenantProfile? CurrentProfile => _currentProfile;
+
+    /// <summary>Set by the view to invoke <see cref="LibraryPickerDialog"/> against the current site.</summary>
+    public Func<string, IReadOnlyCollection<string>, Task<IReadOnlyList<string>?>>? PickLibrariesAsync { get; set; }
+
+    /// <summary>Set by the view to display a confirm dialog before destructive run.</summary>
+    public Func<string, bool>? ConfirmAction { get; set; }
+
+    public IAsyncRelayCommand SelectLibrariesCommand { get; }
+    public IRelayCommand ClearLibrariesCommand { get; }
+    public IAsyncRelayCommand ExportCsvCommand { get; }
+    public IAsyncRelayCommand ExportHtmlCommand { get; }
+
+    public VersionCleanupViewModel(
+        IVersionCleanupService versionService,
+        ISessionManager sessionManager,
+        VersionCleanupHtmlExportService htmlExportService,
+        IBrandingService brandingService,
+        ILogger<FeatureViewModelBase> logger)
+        : base(logger)
+    {
+        _versionService = versionService;
+        _sessionManager = sessionManager;
+        _htmlExportService = htmlExportService;
+        _brandingService = brandingService;
+        _logger = logger;
+
+        SelectLibrariesCommand = new AsyncRelayCommand(SelectLibrariesAsync, CanPickLibraries);
+        ClearLibrariesCommand = new RelayCommand(ClearLibraries);
+        ExportCsvCommand = new AsyncRelayCommand(ExportCsvAsync, () => Results.Count > 0);
+        ExportHtmlCommand = new AsyncRelayCommand(ExportHtmlAsync, () => Results.Count > 0);
+
+        SelectedLibraries.CollectionChanged += (_, _) => UpdateSelectedLibrariesLabel();
+        Results.CollectionChanged += (_, _) =>
+        {
+            OnPropertyChanged(nameof(HasResults));
+            OnPropertyChanged(nameof(TotalBytesFreed));
+            OnPropertyChanged(nameof(TotalVersionsDeleted));
+            OnPropertyChanged(nameof(TotalFilesAffected));
+            ExportCsvCommand.NotifyCanExecuteChanged();
+            ExportHtmlCommand.NotifyCanExecuteChanged();
+        };
+        UpdateSelectedLibrariesLabel();
+    }
+
+    protected override void OnTenantSwitched(TenantProfile profile)
+    {
+        _currentProfile = profile;
+        SelectedLibraries.Clear();
+        Results.Clear();
+        OnPropertyChanged(nameof(CurrentProfile));
+        SelectLibrariesCommand.NotifyCanExecuteChanged();
+    }
+
+    protected override void OnGlobalSitesChanged(IReadOnlyList<SiteInfo> sites)
+    {
+        // Site changes invalidate library list — clear so user re-picks.
+        SelectedLibraries.Clear();
+        SelectLibrariesCommand.NotifyCanExecuteChanged();
+    }
+
+    private bool CanPickLibraries() => _currentProfile != null && GlobalSites.Count > 0;
+
+    private async Task SelectLibrariesAsync()
+    {
+        if (PickLibrariesAsync == null || _currentProfile == null) return;
+        var first = GlobalSites.FirstOrDefault();
+        if (first == null)
+        {
+            StatusMessage = TranslationSource.Instance["err.no_sites_selected"];
+            return;
+        }
+
+        var picked = await PickLibrariesAsync(first.Url, SelectedLibraries.ToArray());
+        if (picked == null) return;
+        SelectedLibraries.Clear();
+        foreach (var t in picked) SelectedLibraries.Add(t);
+    }
+
+    private void ClearLibraries() => SelectedLibraries.Clear();
+
+    private void UpdateSelectedLibrariesLabel()
+    {
+        SelectedLibrariesLabel = SelectedLibraries.Count == 0
+            ? TranslationSource.Instance["versions.libs.all"]
+            : string.Format(TranslationSource.Instance["versions.libs.count"], SelectedLibraries.Count);
+    }
+
+    protected override async Task RunOperationAsync(CancellationToken ct, IProgress<OperationProgress> progress)
+    {
+        if (_currentProfile == null)
+        {
+            StatusMessage = TranslationSource.Instance["err.no_tenant_connected"];
+            return;
+        }
+
+        var urls = GlobalSites.Select(s => s.Url).Where(u => !string.IsNullOrWhiteSpace(u)).ToList();
+        if (urls.Count == 0)
+        {
+            StatusMessage = TranslationSource.Instance["err.no_sites_selected"];
+            return;
+        }
+
+        if (KeepLast < 0)
+        {
+            StatusMessage = TranslationSource.Instance["versions.err.keepLast"];
+            return;
+        }
+
+        if (ConfirmDelete && ConfirmAction != null)
+        {
+            var msg = string.Format(
+                TranslationSource.Instance["versions.confirm"],
+                KeepLast,
+                KeepFirstVersion ? TranslationSource.Instance["versions.confirm.keepFirst"] : string.Empty);
+            if (!ConfirmAction(msg)) return;
+        }
+
+        var options = new VersionCleanupOptions(
+            SelectedLibraries.ToList(), KeepLast, KeepFirstVersion);
+
+        Results.Clear();
+        int siteIdx = 0;
+        foreach (var url in urls)
+        {
+            ct.ThrowIfCancellationRequested();
+            siteIdx++;
+            progress.Report(new OperationProgress(siteIdx, urls.Count, $"Cleaning {url}..."));
+
+            var siteProfile = new TenantProfile
+            {
+                TenantUrl = url.TrimEnd('/'),
+                ClientId = _currentProfile.ClientId,
+                Name = _currentProfile.Name,
+            };
+
+            var ctx = await _sessionManager.GetOrCreateContextAsync(siteProfile, ct);
+            var siteResults = await _versionService.DeleteOldVersionsAsync(ctx, options, progress, ct);
+
+            if (Application.Current?.Dispatcher is { } dispatcher)
+            {
+                await dispatcher.InvokeAsync(() =>
+                {
+                    foreach (var r in siteResults) Results.Add(r);
+                });
+            }
+            else
+            {
+                foreach (var r in siteResults) Results.Add(r);
+            }
+        }
+    }
+
+    private async Task ExportCsvAsync()
+    {
+        if (Results.Count == 0) return;
+        var dialog = new SaveFileDialog
+        {
+            Title = "Export version cleanup results",
+            Filter = "CSV files (*.csv)|*.csv",
+            DefaultExt = "csv",
+            FileName = "version_cleanup",
+        };
+        if (dialog.ShowDialog() != true) return;
+        try
+        {
+            using var w = new System.IO.StreamWriter(dialog.FileName);
+            await w.WriteLineAsync("Site,Library,File,Versions Before,Versions Deleted,Versions Remaining,Bytes Freed,Error");
+            foreach (var r in Results)
+            {
+                await w.WriteLineAsync(string.Join(",",
+                    Csv(r.SiteUrl),
+                    Csv(r.Library),
+                    Csv(r.FileServerRelativeUrl),
+                    r.VersionsBefore,
+                    r.VersionsDeleted,
+                    r.VersionsRemaining,
+                    r.BytesFreed,
+                    Csv(r.Error ?? string.Empty)));
+            }
+            OpenFile(dialog.FileName);
+        }
+        catch (Exception ex)
+        {
+            StatusMessage = $"Export failed: {ex.Message}";
+            _logger.LogError(ex, "Version cleanup CSV export failed.");
+        }
+    }
+
+    private async Task ExportHtmlAsync()
+    {
+        if (Results.Count == 0) return;
+        var dialog = new SaveFileDialog
+        {
+            Title = "Export version cleanup results to HTML",
+            Filter = "HTML files (*.html)|*.html|All files (*.*)|*.*",
+            DefaultExt = "html",
+            FileName = "version_cleanup",
+        };
+        if (dialog.ShowDialog() != true) return;
+        try
+        {
+            var mspLogo = await _brandingService.GetMspLogoAsync();
+            var clientLogo = _currentProfile?.ClientLogo;
+            var branding = new ReportBranding(mspLogo, clientLogo);
+
+            await _htmlExportService.WriteAsync(Results, dialog.FileName, CancellationToken.None, branding);
+            OpenFile(dialog.FileName);
+        }
+        catch (Exception ex)
+        {
+            StatusMessage = $"Export failed: {ex.Message}";
+            _logger.LogError(ex, "Version cleanup HTML export failed.");
+        }
+    }
+
+    private static void OpenFile(string filePath)
+    {
+        try { Process.Start(new ProcessStartInfo(filePath) { UseShellExecute = true }); }
+        catch { }
+    }
+
+    private static string Csv(string value)
+    {
+        if (string.IsNullOrEmpty(value)) return string.Empty;
+        if (value.Contains(',') || value.Contains('"') || value.Contains('\n'))
+            return "\"" + value.Replace("\"", "\"\"") + "\"";
+        return value;
+    }
+
+    partial void OnKeepLastChanged(int value)
+    {
+        if (value < 0) KeepLast = 0;
+    }
+}

SharepointToolbox/Views/Common/Spinner.xaml

@@ -0,0 +1,26 @@
+<UserControl x:Class="SharepointToolbox.Views.Common.Spinner"
+             xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             Width="20" Height="20">
+    <Grid RenderTransformOrigin="0.5,0.5">
+        <Grid.RenderTransform>
+            <RotateTransform x:Name="Rot" Angle="0" />
+        </Grid.RenderTransform>
+        <Grid.Triggers>
+            <EventTrigger RoutedEvent="Loaded">
+                <BeginStoryboard>
+                    <Storyboard>
+                        <DoubleAnimation
+                            Storyboard.TargetName="Rot"
+                            Storyboard.TargetProperty="Angle"
+                            From="0" To="360" Duration="0:0:1"
+                            RepeatBehavior="Forever" />
+                    </Storyboard>
+                </BeginStoryboard>
+            </EventTrigger>
+        </Grid.Triggers>
+        <Ellipse Stroke="{DynamicResource BorderSoftBrush}" StrokeThickness="3" />
+        <Ellipse Stroke="{DynamicResource AccentBrush}" StrokeThickness="3"
+                 StrokeDashArray="3 3" StrokeDashCap="Round" />
+    </Grid>
+</UserControl>

SharepointToolbox/Views/Common/Spinner.xaml.cs

@@ -0,0 +1,11 @@
+using System.Windows.Controls;
+
+namespace SharepointToolbox.Views.Common;
+
+public partial class Spinner : UserControl
+{
+    public Spinner()
+    {
+        InitializeComponent();
+    }
+}

SharepointToolbox/Views/Converters/IndentConverter.cs

@@ -96,3 +96,30 @@ public class ListToStringConverter : IValueConverter
         => throw new NotImplementedException();
 }
 
+/// <summary>
+/// Converts a <see cref="SharepointToolbox.Core.Models.StorageNodeKind"/> enum
+/// to a localized display string via the translation source.
+/// </summary>
+[ValueConversion(typeof(SharepointToolbox.Core.Models.StorageNodeKind), typeof(string))]
+public class StorageKindConverter : IValueConverter
+{
+    public object Convert(object value, Type targetType, object parameter, CultureInfo culture)
+    {
+        if (value is not SharepointToolbox.Core.Models.StorageNodeKind kind) return string.Empty;
+        var T = SharepointToolbox.Localization.TranslationSource.Instance;
+        return kind switch
+        {
+            SharepointToolbox.Core.Models.StorageNodeKind.Library          => T["stor.kind.library"],
+            SharepointToolbox.Core.Models.StorageNodeKind.HiddenLibrary    => T["stor.kind.hidden"],
+            SharepointToolbox.Core.Models.StorageNodeKind.PreservationHold => T["stor.kind.preservation"],
+            SharepointToolbox.Core.Models.StorageNodeKind.ListAttachments  => T["stor.kind.attachments"],
+            SharepointToolbox.Core.Models.StorageNodeKind.RecycleBin       => T["stor.kind.recyclebin"],
+            SharepointToolbox.Core.Models.StorageNodeKind.Subsite          => T["stor.kind.subsite"],
+            _ => kind.ToString()
+        };
+    }
+
+    public object ConvertBack(object value, Type targetType, object parameter, CultureInfo culture)
+        => throw new NotImplementedException();
+}
+

SharepointToolbox/Views/Dialogs/ConfirmBulkOperationDialog.xaml

@@ -4,6 +4,9 @@
         xmlns:loc="clr-namespace:SharepointToolbox.Localization"
         Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[bulk.confirm.title]}"
         Width="450" Height="220" WindowStartupLocation="CenterOwner"
+        Background="{DynamicResource AppBgBrush}"
+        Foreground="{DynamicResource TextBrush}"
+        TextOptions.TextFormattingMode="Ideal"
         ResizeMode="NoResize">
     <Grid Margin="20">
         <Grid.RowDefinitions>

SharepointToolbox/Views/Dialogs/FolderBrowserDialog.xaml

@@ -3,13 +3,24 @@
         xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
         xmlns:loc="clr-namespace:SharepointToolbox.Localization"
         Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[folderbrowser.title]}"
-        Width="400" Height="500" WindowStartupLocation="CenterOwner"
+        Width="520" Height="560" WindowStartupLocation="CenterOwner"
+        Background="{DynamicResource AppBgBrush}"
+        Foreground="{DynamicResource TextBrush}"
+        TextOptions.TextFormattingMode="Ideal"
         ResizeMode="CanResizeWithGrip">
     <DockPanel Margin="10">
         <!-- Status -->
         <TextBlock x:Name="StatusText" DockPanel.Dock="Top" Margin="0,0,0,10"
                    Text="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[folderbrowser.loading]}" />
 
+        <!-- Action bar: new folder (destination mode only) -->
+        <StackPanel x:Name="ActionBar" DockPanel.Dock="Top" Orientation="Horizontal"
+                    Margin="0,0,0,6" Visibility="Collapsed">
+            <Button x:Name="NewFolderButton"
+                    Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[common.new_folder]}"
+                    Padding="8,3" Click="NewFolder_Click" IsEnabled="False" />
+        </StackPanel>
+
         <!-- Buttons -->
         <StackPanel DockPanel.Dock="Bottom" Orientation="Horizontal"
                     HorizontalAlignment="Right" Margin="0,10,0,0">

SharepointToolbox/Views/Dialogs/FolderBrowserDialog.xaml.cs

@@ -8,13 +8,38 @@ namespace SharepointToolbox.Views.Dialogs;
 public partial class FolderBrowserDialog : Window
 {
     private readonly ClientContext _ctx;
+    private readonly bool _allowFileSelection;
+    private readonly bool _allowFolderCreation;
+
     public string SelectedLibrary { get; private set; } = string.Empty;
     public string SelectedFolderPath { get; private set; } = string.Empty;
 
-    public FolderBrowserDialog(ClientContext ctx)
+    /// <summary>
+    /// Library-relative file paths checked by the user. Only populated when
+    /// <paramref name="allowFileSelection"/> was true. Empty if the user picked
+    /// a folder node instead.
+    /// </summary>
+    public IReadOnlyList<string> SelectedFilePaths { get; private set; } = Array.Empty<string>();
+
+    private readonly List<CheckBox> _fileCheckboxes = new();
+    private readonly List<TreeViewItem> _expandedNodes = new();
+
+    /// <summary>
+    /// Dialog for browsing library folders. Set <paramref name="allowFileSelection"/>
+    /// to show individual files (with sizes) and allow ticking them for targeted
+    /// transfer. Set <paramref name="allowFolderCreation"/> to expose a "New
+    /// Folder" button that creates a folder under the selected node.
+    /// </summary>
+    public FolderBrowserDialog(ClientContext ctx,
+        bool allowFileSelection = false,
+        bool allowFolderCreation = false)
     {
         InitializeComponent();
         _ctx = ctx;
+        _allowFileSelection = allowFileSelection;
+        _allowFolderCreation = allowFolderCreation;
+        if (allowFolderCreation)
+            ActionBar.Visibility = Visibility.Visible;
         Loaded += OnLoaded;
     }
 
@@ -22,24 +47,19 @@ public partial class FolderBrowserDialog : Window
     {
         try
         {
-            // Load libraries
             var web = _ctx.Web;
             var lists = _ctx.LoadQuery(web.Lists
-                .Include(l => l.Title, l => l.Hidden, l => l.BaseType, l => l.RootFolder)
+                .Include(l => l.Title, l => l.Hidden, l => l.BaseType,
+                         l => l.RootFolder.ServerRelativeUrl)
                 .Where(l => !l.Hidden && l.BaseType == BaseType.DocumentLibrary));
             var progress = new Progress<Core.Models.OperationProgress>();
             await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(_ctx, progress, CancellationToken.None);
 
             foreach (var list in lists)
             {
-                var libNode = new TreeViewItem
+                var rootUrl = list.RootFolder.ServerRelativeUrl.TrimEnd('/');
-                {
+                var libNode = MakeFolderNode(list.Title,
-                    Header = list.Title,
+                    new FolderNodeInfo(list.Title, string.Empty, rootUrl));
-                    Tag = new FolderNodeInfo(list.Title, string.Empty),
-                };
-                // Add dummy child for expand arrow
-                libNode.Items.Add(new TreeViewItem { Header = "Loading..." });
-                libNode.Expanded += LibNode_Expanded;
                 FolderTree.Items.Add(libNode);
             }
 
@@ -51,52 +71,146 @@ public partial class FolderBrowserDialog : Window
         }
     }
 
-    private async void LibNode_Expanded(object sender, RoutedEventArgs e)
+    private TreeViewItem MakeFolderNode(string name, FolderNodeInfo info)
+    {
+        var node = new TreeViewItem
+        {
+            Header = name,
+            Tag = info,
+        };
+        // Placeholder child so the expand arrow appears.
+        node.Items.Add(new TreeViewItem { Header = "Loading..." });
+        node.Expanded += FolderNode_Expanded;
+        _expandedNodes.Add(node);
+        return node;
+    }
+
+    private async void FolderNode_Expanded(object sender, RoutedEventArgs e)
     {
         if (sender is not TreeViewItem node || node.Tag is not FolderNodeInfo info)
             return;
 
-        // Only load children once
+        // Only load children once.
-        if (node.Items.Count == 1 && node.Items[0] is TreeViewItem dummy && dummy.Header?.ToString() == "Loading...")
+        if (!(node.Items.Count == 1
+              && node.Items[0] is TreeViewItem dummy
+              && dummy.Header?.ToString() == "Loading..."))
+            return;
+
+        node.Items.Clear();
+        try
         {
-            node.Items.Clear();
+            var folder = _ctx.Web.GetFolderByServerRelativeUrl(info.ServerRelativeUrl);
-            try
+            _ctx.Load(folder, f => f.StorageMetrics.TotalSize,
+                              f => f.StorageMetrics.TotalFileCount);
+            var list = _ctx.Web.Lists.GetByTitle(info.LibraryTitle);
+            _ctx.Load(list, l => l.Title);
+            var progress = new Progress<Core.Models.OperationProgress>();
+            await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(_ctx, progress, CancellationToken.None);
+
+            // Annotate the parent node header with total metrics now that they loaded.
+            node.Header = FormatFolderHeader(info.LibraryTitle == info.RelativePath || string.IsNullOrEmpty(info.RelativePath)
+                    ? (string)node.Header!
+                    : System.IO.Path.GetFileName(info.RelativePath),
+                folder.StorageMetrics.TotalFileCount,
+                folder.StorageMetrics.TotalSize);
+
+            // Enumerate direct children via paginated CAML — Folder.Folders /
+            // Folder.Files lazy loading hits the list-view threshold on libraries
+            // above 5,000 items even when only a small folder is being expanded.
+            var subFolders = new List<(string Name, string Url)>();
+            var filesInFolder = new List<(string Name, long Length, string Url)>();
+
+            await foreach (var item in SharePointPaginationHelper.GetItemsInFolderAsync(
+                _ctx, list, info.ServerRelativeUrl, recursive: false,
+                viewFields: new[] { "FSObjType", "FileLeafRef", "FileRef", "File_x0020_Size" },
+                ct: CancellationToken.None))
             {
-                var folderUrl = string.IsNullOrEmpty(info.FolderPath)
+                var fsType  = item["FSObjType"]?.ToString();
-                    ? GetLibraryRootUrl(info.LibraryTitle)
+                var name    = item["FileLeafRef"]?.ToString() ?? string.Empty;
-                    : info.FolderPath;
+                var fileRef = item["FileRef"]?.ToString() ?? string.Empty;
 
-                var folder = _ctx.Web.GetFolderByServerRelativeUrl(folderUrl);
+                if (fsType == "1")
-                _ctx.Load(folder, f => f.Folders.Include(sf => sf.Name, sf => sf.ServerRelativeUrl));
-                var progress = new Progress<Core.Models.OperationProgress>();
-                await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(_ctx, progress, CancellationToken.None);
-
-                foreach (var subFolder in folder.Folders)
                 {
-                    if (subFolder.Name.StartsWith("_") || subFolder.Name == "Forms")
+                    if (name.StartsWith("_") || name == "Forms") continue;
-                        continue;
+                    subFolders.Add((name, fileRef));
-
+                }
-                    var childNode = new TreeViewItem
+                else if (fsType == "0" && _allowFileSelection)
-                    {
+                {
-                        Header = subFolder.Name,
+                    long.TryParse(item["File_x0020_Size"]?.ToString() ?? "0", out long size);
-                        Tag = new FolderNodeInfo(info.LibraryTitle, subFolder.ServerRelativeUrl),
+                    filesInFolder.Add((name, size, fileRef));
-                    };
-                    childNode.Items.Add(new TreeViewItem { Header = "Loading..." });
-                    childNode.Expanded += LibNode_Expanded;
-                    node.Items.Add(childNode);
                 }
             }
-            catch (Exception ex)
+
+            // Batch-load StorageMetrics for each subfolder in one round-trip.
+            var metricFolders = subFolders
+                .Select(sf => _ctx.Web.GetFolderByServerRelativeUrl(sf.Url))
+                .ToList();
+            foreach (var mf in metricFolders)
+                _ctx.Load(mf, f => f.StorageMetrics.TotalSize,
+                              f => f.StorageMetrics.TotalFileCount);
+            if (metricFolders.Count > 0)
+                await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(_ctx, progress, CancellationToken.None);
+
+            for (int i = 0; i < subFolders.Count; i++)
             {
-                node.Items.Add(new TreeViewItem { Header = $"Error: {ex.Message}" });
+                var (name, url) = subFolders[i];
+                var childRelative = string.IsNullOrEmpty(info.RelativePath)
+                    ? name
+                    : $"{info.RelativePath}/{name}";
+
+                var childInfo = new FolderNodeInfo(info.LibraryTitle, childRelative, url);
+
+                var childNode = MakeFolderNode(
+                    FormatFolderHeader(name,
+                        metricFolders[i].StorageMetrics.TotalFileCount,
+                        metricFolders[i].StorageMetrics.TotalSize),
+                    childInfo);
+                node.Items.Add(childNode);
             }
+
+            // Files under this folder — only shown when selection is enabled.
+            if (_allowFileSelection)
+            {
+                foreach (var (fileName, fileSize, _) in filesInFolder)
+                {
+                    var fileRel = string.IsNullOrEmpty(info.RelativePath)
+                        ? fileName
+                        : $"{info.RelativePath}/{fileName}";
+
+                    var cb = new CheckBox
+                    {
+                        Content = $"{fileName}   ({FormatSize(fileSize)})",
+                        Tag = new FileNodeInfo(info.LibraryTitle, fileRel),
+                        Margin = new Thickness(4, 2, 0, 2),
+                    };
+                    cb.Checked += FileCheckbox_Toggled;
+                    cb.Unchecked += FileCheckbox_Toggled;
+                    _fileCheckboxes.Add(cb);
+
+                    var fileItem = new TreeViewItem { Header = cb, Focusable = false };
+                    node.Items.Add(fileItem);
+                }
+            }
+        }
+        catch (Exception ex)
+        {
+            node.Items.Add(new TreeViewItem { Header = $"Error: {ex.Message}" });
         }
     }
 
-    private string GetLibraryRootUrl(string libraryTitle)
+    private static string FormatFolderHeader(string name, long fileCount, long totalBytes)
     {
-        var uri = new Uri(_ctx.Url);
+        if (fileCount <= 0) return name;
-        return $"{uri.AbsolutePath.TrimEnd('/')}/{libraryTitle}";
+        return $"{name}   ({fileCount} files, {FormatSize(totalBytes)})";
+    }
+
+    private static string FormatSize(long bytes)
+    {
+        if (bytes <= 0) return "0 B";
+        if (bytes >= 1_073_741_824L) return $"{bytes / 1_073_741_824.0:F2} GB";
+        if (bytes >= 1_048_576L)     return $"{bytes / 1_048_576.0:F2} MB";
+        if (bytes >= 1024L)          return $"{bytes / 1024.0:F2} KB";
+        return $"{bytes} B";
     }
 
     private void FolderTree_SelectedItemChanged(object sender, RoutedPropertyChangedEventArgs<object> e)
@@ -104,13 +218,83 @@ public partial class FolderBrowserDialog : Window
         if (e.NewValue is TreeViewItem node && node.Tag is FolderNodeInfo info)
         {
             SelectedLibrary = info.LibraryTitle;
-            SelectedFolderPath = info.FolderPath;
+            SelectedFolderPath = info.RelativePath;
             SelectButton.IsEnabled = true;
+            NewFolderButton.IsEnabled = _allowFolderCreation;
+        }
+        else
+        {
+            // File nodes have CheckBox headers, not FolderNodeInfo tags.
+            NewFolderButton.IsEnabled = false;
+        }
+    }
+
+    private void FileCheckbox_Toggled(object sender, RoutedEventArgs e)
+    {
+        // Enable "Select" as soon as any file is checked — user can confirm
+        // purely via file selection without also picking a folder node.
+        if (_fileCheckboxes.Any(c => c.IsChecked == true))
+            SelectButton.IsEnabled = true;
+    }
+
+    private async void NewFolder_Click(object sender, RoutedEventArgs e)
+    {
+        if (FolderTree.SelectedItem is not TreeViewItem node ||
+            node.Tag is not FolderNodeInfo info)
+            return;
+
+        var dlg = new InputDialog("New folder name:", string.Empty)
+        {
+            Owner = this
+        };
+        if (dlg.ShowDialog() != true) return;
+        var folderName = dlg.ResponseText.Trim();
+        if (string.IsNullOrEmpty(folderName)) return;
+
+        try
+        {
+            var parent = _ctx.Web.GetFolderByServerRelativeUrl(info.ServerRelativeUrl);
+            var created = parent.Folders.Add(folderName);
+            _ctx.Load(created, f => f.ServerRelativeUrl, f => f.Name);
+            var progress = new Progress<Core.Models.OperationProgress>();
+            await ExecuteQueryRetryHelper.ExecuteQueryRetryAsync(_ctx, progress, CancellationToken.None);
+
+            var childRelative = string.IsNullOrEmpty(info.RelativePath)
+                ? created.Name
+                : $"{info.RelativePath}/{created.Name}";
+            var childInfo = new FolderNodeInfo(
+                info.LibraryTitle, childRelative, created.ServerRelativeUrl);
+            var childNode = MakeFolderNode(created.Name, childInfo);
+
+            // Expand the parent so the fresh folder is visible immediately.
+            node.IsExpanded = true;
+            node.Items.Add(childNode);
+            StatusText.Text = $"Created: {created.ServerRelativeUrl}";
+        }
+        catch (Exception ex)
+        {
+            StatusText.Text = $"Error: {ex.Message}";
         }
     }
 
     private void Select_Click(object sender, RoutedEventArgs e)
     {
+        // Harvest checked files (library-relative paths).
+        SelectedFilePaths = _fileCheckboxes
+            .Where(c => c.IsChecked == true && c.Tag is FileNodeInfo)
+            .Select(c => ((FileNodeInfo)c.Tag!).RelativePath)
+            .ToList();
+
+        // If files were picked but no folder node was selected, borrow the
+        // library from the first file so the caller still has a valid target.
+        if (SelectedFilePaths.Count > 0 && string.IsNullOrEmpty(SelectedLibrary))
+        {
+            var firstTag = (FileNodeInfo)_fileCheckboxes
+                .First(c => c.IsChecked == true && c.Tag is FileNodeInfo).Tag!;
+            SelectedLibrary = firstTag.LibraryTitle;
+            SelectedFolderPath = string.Empty;
+        }
+
         DialogResult = true;
         Close();
     }
@@ -121,5 +305,21 @@ public partial class FolderBrowserDialog : Window
         Close();
     }
 
-    private record FolderNodeInfo(string LibraryTitle, string FolderPath);
+    protected override void OnClosed(EventArgs e)
+    {
+        Loaded -= OnLoaded;
+        foreach (var node in _expandedNodes)
+            node.Expanded -= FolderNode_Expanded;
+        _expandedNodes.Clear();
+        foreach (var cb in _fileCheckboxes)
+        {
+            cb.Checked -= FileCheckbox_Toggled;
+            cb.Unchecked -= FileCheckbox_Toggled;
+        }
+        _fileCheckboxes.Clear();
+        base.OnClosed(e);
+    }
+
+    private record FolderNodeInfo(string LibraryTitle, string RelativePath, string ServerRelativeUrl);
+    private record FileNodeInfo(string LibraryTitle, string RelativePath);
 }

SharepointToolbox/Views/Dialogs/InputDialog.xaml

@@ -0,0 +1,24 @@
+<Window x:Class="SharepointToolbox.Views.Dialogs.InputDialog"
+        xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+        xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+        xmlns:loc="clr-namespace:SharepointToolbox.Localization"
+        Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[input.title]}"
+        Width="340" Height="140"
+        WindowStartupLocation="CenterOwner"
+        Background="{DynamicResource AppBgBrush}"
+        Foreground="{DynamicResource TextBrush}"
+        TextOptions.TextFormattingMode="Ideal"
+        ResizeMode="NoResize">
+    <DockPanel Margin="12">
+        <StackPanel DockPanel.Dock="Bottom" Orientation="Horizontal"
+                    HorizontalAlignment="Right" Margin="0,10,0,0">
+            <Button Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[btn.cancel]}"
+                    Width="70" IsCancel="True" Margin="0,0,8,0"
+                    Click="Cancel_Click" />
+            <Button Content="OK" Width="70" IsDefault="True"
+                    Click="Ok_Click" />
+        </StackPanel>
+        <TextBlock x:Name="PromptText" DockPanel.Dock="Top" Margin="0,0,0,6" />
+        <TextBox x:Name="ResponseBox" VerticalContentAlignment="Center" Padding="4" />
+    </DockPanel>
+</Window>

SharepointToolbox/Views/Dialogs/InputDialog.xaml.cs

@@ -0,0 +1,28 @@
+using System.Windows;
+
+namespace SharepointToolbox.Views.Dialogs;
+
+public partial class InputDialog : Window
+{
+    public string ResponseText => ResponseBox.Text;
+
+    public InputDialog(string prompt, string initialValue)
+    {
+        InitializeComponent();
+        PromptText.Text = prompt;
+        ResponseBox.Text = initialValue ?? string.Empty;
+        Loaded += (_, _) => { ResponseBox.Focus(); ResponseBox.SelectAll(); };
+    }
+
+    private void Ok_Click(object sender, RoutedEventArgs e)
+    {
+        DialogResult = true;
+        Close();
+    }
+
+    private void Cancel_Click(object sender, RoutedEventArgs e)
+    {
+        DialogResult = false;
+        Close();
+    }
+}

SharepointToolbox/Views/Dialogs/LibraryPickerDialog.xaml

@@ -0,0 +1,42 @@
+<Window x:Class="SharepointToolbox.Views.Dialogs.LibraryPickerDialog"
+        xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+        xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+        xmlns:loc="clr-namespace:SharepointToolbox.Localization"
+        Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[librarypicker.title]}"
+        Width="420" Height="520" WindowStartupLocation="CenterOwner"
+        Background="{DynamicResource AppBgBrush}"
+        Foreground="{DynamicResource TextBrush}"
+        TextOptions.TextFormattingMode="Ideal"
+        ResizeMode="CanResizeWithGrip">
+  <DockPanel Margin="10">
+    <TextBlock x:Name="StatusText" DockPanel.Dock="Top" Margin="0,0,0,8"
+               Text="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[librarypicker.loading]}" />
+
+    <StackPanel DockPanel.Dock="Top" Orientation="Horizontal" Margin="0,0,0,6">
+      <Button Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[librarypicker.selectAll]}"
+              Click="SelectAll_Click" Margin="0,0,6,0" Padding="6,2" />
+      <Button Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[librarypicker.selectNone]}"
+              Click="SelectNone_Click" Padding="6,2" />
+    </StackPanel>
+
+    <StackPanel DockPanel.Dock="Bottom" Orientation="Horizontal"
+                HorizontalAlignment="Right" Margin="0,8,0,0">
+      <Button Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[folderbrowser.cancel]}"
+              Width="80" Margin="0,0,8,0" IsCancel="True" Click="Cancel_Click" />
+      <Button x:Name="OkButton"
+              Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[folderbrowser.select]}"
+              Width="80" IsDefault="True" IsEnabled="False" Click="Ok_Click" />
+    </StackPanel>
+
+    <ScrollViewer VerticalScrollBarVisibility="Auto">
+      <ItemsControl x:Name="LibrariesList">
+        <ItemsControl.ItemTemplate>
+          <DataTemplate>
+            <CheckBox Content="{Binding Title}" IsChecked="{Binding IsSelected, Mode=TwoWay}"
+                      Margin="2,4" />
+          </DataTemplate>
+        </ItemsControl.ItemTemplate>
+      </ItemsControl>
+    </ScrollViewer>
+  </DockPanel>
+</Window>

SharepointToolbox/Views/Dialogs/LibraryPickerDialog.xaml.cs

@@ -0,0 +1,105 @@
+using System.Collections.ObjectModel;
+using System.ComponentModel;
+using System.Windows;
+using Microsoft.SharePoint.Client;
+using SharepointToolbox.Services;
+
+namespace SharepointToolbox.Views.Dialogs;
+
+public partial class LibraryPickerDialog : Window
+{
+    private readonly ClientContext _ctx;
+    private readonly IVersionCleanupService _libraryLister;
+    private readonly ObservableCollection<LibraryItem> _items = new();
+
+    public IReadOnlyList<string> SelectedLibraryTitles { get; private set; } = Array.Empty<string>();
+
+    public LibraryPickerDialog(
+        ClientContext ctx,
+        IVersionCleanupService libraryLister,
+        IReadOnlyCollection<string>? preselected = null)
+    {
+        InitializeComponent();
+        _ctx = ctx;
+        _libraryLister = libraryLister;
+        LibrariesList.ItemsSource = _items;
+        Loaded += async (_, _) => await LoadAsync(preselected ?? Array.Empty<string>());
+    }
+
+    private async Task LoadAsync(IReadOnlyCollection<string> preselected)
+    {
+        try
+        {
+            var titles = await _libraryLister.ListLibraryTitlesAsync(_ctx, CancellationToken.None);
+            var preset = new HashSet<string>(preselected, StringComparer.OrdinalIgnoreCase);
+            foreach (var t in titles)
+            {
+                var item = new LibraryItem { Title = t, IsSelected = preset.Contains(t) };
+                item.PropertyChanged += OnItemChanged;
+                _items.Add(item);
+            }
+            StatusText.Text = string.Format(
+                Localization.TranslationSource.Instance["librarypicker.loaded"],
+                _items.Count);
+            UpdateOkEnabled();
+        }
+        catch (Exception ex)
+        {
+            StatusText.Text = $"Error: {ex.Message}";
+        }
+    }
+
+    private void OnItemChanged(object? sender, PropertyChangedEventArgs e)
+    {
+        if (e.PropertyName == nameof(LibraryItem.IsSelected)) UpdateOkEnabled();
+    }
+
+    private void UpdateOkEnabled()
+        => OkButton.IsEnabled = _items.Any(i => i.IsSelected);
+
+    private void SelectAll_Click(object sender, RoutedEventArgs e)
+    {
+        foreach (var i in _items) i.IsSelected = true;
+    }
+
+    private void SelectNone_Click(object sender, RoutedEventArgs e)
+    {
+        foreach (var i in _items) i.IsSelected = false;
+    }
+
+    private void Ok_Click(object sender, RoutedEventArgs e)
+    {
+        SelectedLibraryTitles = _items.Where(i => i.IsSelected).Select(i => i.Title).ToList();
+        DialogResult = true;
+        Close();
+    }
+
+    private void Cancel_Click(object sender, RoutedEventArgs e)
+    {
+        DialogResult = false;
+        Close();
+    }
+
+    protected override void OnClosed(EventArgs e)
+    {
+        foreach (var i in _items) i.PropertyChanged -= OnItemChanged;
+        base.OnClosed(e);
+    }
+
+    public class LibraryItem : INotifyPropertyChanged
+    {
+        private bool _isSelected;
+        public string Title { get; init; } = string.Empty;
+        public bool IsSelected
+        {
+            get => _isSelected;
+            set
+            {
+                if (_isSelected == value) return;
+                _isSelected = value;
+                PropertyChanged?.Invoke(this, new PropertyChangedEventArgs(nameof(IsSelected)));
+            }
+        }
+        public event PropertyChangedEventHandler? PropertyChanged;
+    }
+}

SharepointToolbox/Views/Dialogs/ProfileManagementDialog.xaml

@@ -2,8 +2,12 @@
         xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
         xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
         xmlns:loc="clr-namespace:SharepointToolbox.Localization"
-        Title="Manage Profiles" Width="500" Height="750"
+        Title="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[profmgmt.title]}"
+        Width="500" Height="750"
         WindowStartupLocation="CenterOwner" ShowInTaskbar="False"
+        Background="{DynamicResource AppBgBrush}"
+        Foreground="{DynamicResource TextBrush}"
+        TextOptions.TextFormattingMode="Ideal"
         ResizeMode="NoResize">
   <Window.Resources>
     <BooleanToVisibilityConverter x:Key="BooleanToVisibilityConverter" />
@@ -16,10 +20,11 @@
       <RowDefinition Height="Auto" />
       <RowDefinition Height="Auto" />
       <RowDefinition Height="Auto" />
+      <RowDefinition Height="Auto" />
     </Grid.RowDefinitions>
 
     <!-- Profile list -->
-    <Label Content="Profiles" Grid.Row="0" />
+    <Label Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[profmgmt.group]}" Grid.Row="0" />
     <ListBox Grid.Row="1" Margin="0,0,0,8"
              ItemsSource="{Binding Profiles}"
              SelectedItem="{Binding SelectedProfile}"
@@ -35,6 +40,7 @@
         <RowDefinition Height="Auto" />
         <RowDefinition Height="Auto" />
         <RowDefinition Height="Auto" />
+        <RowDefinition Height="Auto" />
       </Grid.RowDefinitions>
       <Label Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[profile.name]}"
              Grid.Row="0" Grid.Column="0" />
@@ -48,12 +54,38 @@
              Grid.Row="2" Grid.Column="0" />
       <TextBox Text="{Binding NewClientId, UpdateSourceTrigger=PropertyChanged}"
                Grid.Row="2" Grid.Column="1" Margin="0,2" />
+      <TextBlock Grid.Row="3" Grid.Column="1" Margin="0,2,0,0"
+                 FontSize="11" FontStyle="Italic" Foreground="{DynamicResource TextMutedBrush}" TextWrapping="Wrap"
+                 Text="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[profile.clientid.hint]}" />
+    </Grid>
+
+    <!-- Profile CRUD buttons (placed under fields for natural flow) -->
+    <Grid Grid.Row="3" Margin="0,4,0,8">
+      <Grid.ColumnDefinitions>
+        <ColumnDefinition Width="*" />
+        <ColumnDefinition Width="Auto" />
+      </Grid.ColumnDefinitions>
+      <StackPanel Grid.Column="0" Orientation="Horizontal">
+        <Button Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[profile.add]}"
+                Command="{Binding AddCommand}"
+                MinWidth="90" Padding="10,4" Margin="0,0,6,0"
+                ToolTip="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[profile.add.tooltip]}" />
+        <Button Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[profile.save]}"
+                Command="{Binding SaveCommand}"
+                MinWidth="90" Padding="10,4"
+                ToolTip="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[profile.save.tooltip]}" />
+      </StackPanel>
+      <Button Grid.Column="1" Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[profile.delete]}"
+              Command="{Binding DeleteCommand}"
+              MinWidth="90" Padding="10,4"
+              Foreground="{DynamicResource DangerBrush}"
+              ToolTip="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[profile.delete.tooltip]}" />
     </Grid>
 
     <!-- Client Logo -->
-    <StackPanel Grid.Row="3" Margin="0,8,0,8">
+    <StackPanel Grid.Row="4" Margin="0,8,0,8">
       <Label Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[profile.logo.title]}" Padding="0,0,0,4" />
-      <Border BorderBrush="#DDDDDD" BorderThickness="1" Padding="8" CornerRadius="4"
+      <Border BorderBrush="{DynamicResource BorderSoftBrush}" BorderThickness="1" Padding="8" CornerRadius="4"
               HorizontalAlignment="Left" MinWidth="200" MinHeight="50">
         <Grid>
           <Image Source="{Binding ClientLogoPreview, Converter={StaticResource Base64ToImageConverter}}"
@@ -61,7 +93,7 @@
                  Visibility="{Binding ClientLogoPreview, Converter={StaticResource StringToVisibilityConverter}}" />
           <TextBlock Text="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[profile.logo.nopreview]}"
                      VerticalAlignment="Center" HorizontalAlignment="Center"
-                     Foreground="#999999" FontStyle="Italic">
+                     Foreground="{DynamicResource TextMutedBrush}" FontStyle="Italic">
             <TextBlock.Style>
               <Style TargetType="TextBlock">
                 <Setter Property="Visibility" Value="Visible" />
@@ -83,12 +115,12 @@
         <Button Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[profile.logo.autopull]}"
                 Command="{Binding AutoPullClientLogoCommand}" Width="130" />
       </StackPanel>
-      <TextBlock Text="{Binding ValidationMessage}" Foreground="#CC0000" FontSize="11" Margin="0,4,0,0"
+      <TextBlock Text="{Binding ValidationMessage}" Foreground="{DynamicResource DangerBrush}" FontSize="11" Margin="0,4,0,0"
                  Visibility="{Binding ValidationMessage, Converter={StaticResource StringToVisibilityConverter}}" />
     </StackPanel>
 
     <!-- App Registration -->
-    <StackPanel Grid.Row="4" Margin="0,8,0,8">
+    <StackPanel Grid.Row="5" Margin="0,8,0,8">
       <Label Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[profile.fallback.title]}"
              FontWeight="SemiBold" Padding="0,0,0,4"
              Visibility="{Binding ShowFallbackInstructions, Converter={StaticResource BooleanToVisibilityConverter}}" />
@@ -103,11 +135,11 @@
 
       <!-- Status text -->
       <TextBlock Text="{Binding RegistrationStatus}" FontSize="11" Margin="0,2,0,0"
-                 Foreground="#006600"
+                 Foreground="{DynamicResource SuccessBrush}"
                  Visibility="{Binding RegistrationStatus, Converter={StaticResource StringToVisibilityConverter}}" />
 
       <!-- Fallback instructions panel -->
-      <Border BorderBrush="#DDDDDD" BorderThickness="1" Padding="8" CornerRadius="4" Margin="0,4,0,0"
+      <Border BorderBrush="{DynamicResource BorderSoftBrush}" BorderThickness="1" Padding="8" CornerRadius="4" Margin="0,4,0,0"
               Visibility="{Binding ShowFallbackInstructions, Converter={StaticResource BooleanToVisibilityConverter}}">
         <StackPanel>
           <TextBlock Text="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[profile.fallback.step1]}"
@@ -126,15 +158,10 @@
       </Border>
     </StackPanel>
 
-    <!-- Buttons -->
+    <!-- Close button -->
-    <StackPanel Grid.Row="5" Orientation="Horizontal" HorizontalAlignment="Right">
+    <StackPanel Grid.Row="6" Orientation="Horizontal" HorizontalAlignment="Right" Margin="0,8,0,0">
-      <Button Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[profile.add]}"
+      <Button Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[common.close]}"
-              Command="{Binding AddCommand}" Width="60" Margin="4,0" />
+              MinWidth="80" Padding="10,4"
-      <Button Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[profile.rename]}"
-              Command="{Binding RenameCommand}" Width="60" Margin="4,0" />
-      <Button Content="{Binding Source={x:Static loc:TranslationSource.Instance}, Path=[profile.delete]}"
-              Command="{Binding DeleteCommand}" Width="60" Margin="4,0" />
-      <Button Content="Close" Width="60" Margin="4,0"
               Click="CloseButton_Click" IsCancel="True" />
     </StackPanel>
   </Grid>